HIPAA Compliance Insights

Accounting of Disclosures

HIPAA Requires an Accounting of Disclosures: Your Guide

In 2011, a small physician practice in the Midwest received a patient's written request for an accounting of disclosures. The office manager had

Carl B. Johnson · May 3, 2025

HIPAA Retention Policy

HIPAA Retention Policy: What You Must Keep and For How Long

In 2023, OCR settled with a dental practice for $350,000 after an investigation revealed the organization had no documentation of its risk analysis, policies,

Carl B. Johnson · May 3, 2025

HIPAA Rights

HIPAA Rights Violation: What OCR Enforces and How to Comply

In 2019, OCR launched its HIPAA Right of Access Initiative — and since then, it has settled more than 45 enforcement actions specifically targeting organizations that

Carl B. Johnson · May 3, 2025

HIPAA Risk Assessment

HIPAA Risk Assessment Requirement: What OCR Expects

In February 2023, OCR settled with a health system for $1.25 million after investigators found a fundamental gap: the organization had never conducted a

Carl B. Johnson · May 3, 2025

HIPAA Risks

HIPAA Risks Every Healthcare Organization Must Address

In February 2024, OCR announced a $4.75 million settlement with a hospital system that had failed to conduct an enterprise-wide risk analysis for over

Carl B. Johnson · May 3, 2025

HIPAA Rules and Compliance

HIPAA Rules and Compliance: What Enforcement Data Reveals

In January 2024, OCR settled with a healthcare system for $4.75 million after investigators found the organization had failed to conduct an enterprise-wide risk

Carl B. Johnson · May 3, 2025

HIPAA Privacy Rule

HIPAA Rules Are Divided Into 2 Sections: Privacy and Security

When OCR settled with Premera Blue Cross for $6.85 million in 2020, the enforcement action didn't hinge on a single failure. Investigators

Carl B. Johnson · May 3, 2025

HIPAA Security Incident

HIPAA Security Incident: Response Steps Your Team Needs

In 2023, OCR settled with a Louisiana medical group for $480,000 after a HIPAA security incident involving a stolen unencrypted laptop — an incident the

Carl B. Johnson · May 3, 2025

HIPAA Security Rule

HIPAA Security Incident Definition: What Counts and Why

In 2023, OCR settled with a healthcare system for $1.3 million after investigators found the organization had no process for identifying or responding to

Carl B. Johnson · May 3, 2025

HIPAA Security Rule

HIPAA Security Safeguards Include These Three Categories

In 2023, OCR settled with a healthcare provider for $1.3 million after an investigation revealed the organization had failed to implement even basic technical

Carl B. Johnson · Feb 28, 2025

HIPAA Security Rule

HIPAA Security Safeguards Include All of the Following

When OCR settled with Premera Blue Cross for $6.85 million in 2020, the root cause wasn't a single missing firewall or an

Carl B. Johnson · Feb 28, 2025

HIPAA SMS

HIPAA SMS Rules: How to Text About PHI Legally

In 2023, a dental practice in Texas paid a $50,000 settlement after a staff member texted a patient's diagnosis and insurance details

Carl B. Johnson · Feb 28, 2025