HIPAA Compliance Insights

HIPAA Rules

5 Rules of HIPAA: What Every Covered Entity Must Know

In 2023, OCR settled with Banner Health for $1.25 million after a breach affecting nearly 3 million individuals exposed failures across multiple HIPAA requirements

Carl B. Johnson · Dec 13, 2022

Administrative Simplification

Administrative Simplification HIPAA: What It Means

When OCR settled with Anthem Inc. for $16 million in 2018 — the largest HIPAA settlement in history at that time — the enforcement action didn'

Carl B. Johnson · Dec 13, 2022

American Health Training HIPAA

American Health Training HIPAA: What You Need to Know

In February 2024, OCR settled with a healthcare system for $480,000 after investigators found that workforce members had never completed HIPAA training — despite handling

Carl B. Johnson · Dec 13, 2022

HIPAA Certification

American Health Training HIPAA Certification Guide

In February 2023, OCR settled with a Florida-based medical practice for $30,000 after investigators found the organization had no evidence of workforce HIPAA training

Carl B. Johnson · Dec 13, 2022

HIPAA Authorization

Authorization for Release of Health Information Form

In 2023, OCR settled with a New England dermatology practice for $300,640 after the organization disclosed protected health information to a patient's

Carl B. Johnson · Dec 13, 2022

Business Associate Agreement

BAA HIPAA Compliance: The Agreement That Prevents Breaches

In June 2023, OCR settled with a dental management company for $350,000 after discovering it had allowed a business associate to access protected health

Carl B. Johnson · Dec 13, 2022

BBP Training

BBP Training Requirements Under HIPAA and OSHA

In 2023, OCR settled with a regional hospital system that had failed to conduct a thorough risk analysis — and during the investigation, auditors discovered the

Carl B. Johnson · Dec 13, 2022

HIPAA Training

Best Online HIPAA Training: What Actually Meets the Rules

In February 2024, OCR settled with a Florida-based healthcare provider for $160,000 after a breach investigation revealed that multiple workforce members had never received

Carl B. Johnson · Dec 13, 2022

HIPAA Release Form

Blank HIPAA Release Form: What You Must Include

In 2023, OCR settled with a covered entity for over $100,000 after the organization disclosed protected health information without a valid authorization — partly because

Carl B. Johnson · Dec 13, 2022

Business Associate Agreement

Business Associate Agreement for Subcontractor: What's Required

In 2023, OCR settled with a business associate that failed to ensure its subcontractors had proper safeguards in place for protected health information. The penalty

Carl B. Johnson · Nov 29, 2022

Business Associate Agreement

Business Associate Agreement Subcontractor Rules Explained

In 2023, OCR settled with a business associate that failed to ensure its subcontractor had adequate safeguards for protected health information — resulting in a six-figure

Carl B. Johnson · Nov 29, 2022

Business Associate Agreement

Business Associate HIPAA Agreement: What Must Be Included

In September 2023, OCR settled with a health system for $1.3 million after investigators found the organization had allowed a vendor to access protected

Carl B. Johnson · Oct 28, 2022