A collection of 12 posts
A therapist in Florida conducts a video session with a patient using a consumer-grade messaging app. No encryption. No business associate agreement. No documentation of
A community health center in Georgia thought they were doing everything right. They had a privacy officer, a policies binder, and annual staff reminders about
A Single Fax Machine Cost One Health System $4.3 Million In 2023, Banner Health agreed to a $1.25 million settlement with the Office
A pediatric clinic in Idaho had a binder on the shelf labeled "HIPAA Compliance Plan." It was printed in 2017, never updated, and
A single misconfigured EHR server exposed the protected health information of 3.9 million patients at Advocate Medical Group — and cost the organization $5.55
That Text You Just Sent? It Probably Violated Federal Law A nurse at a mid-size cardiology practice texts the on-call physician: "Mrs. Rivera'
A Stolen Laptop. A $1.5 Million Fine. One Unlocked Screen. In 2018, the University of Texas MD Anderson Cancer Center lost a $4.3
A Receptionist, a Waiting Room, and a $1.5 Million Mistake A few years ago, I consulted with a mid-size behavioral health clinic that had
A Stolen Laptop, a $3 Million Fine, and a Lesson in How NOT to Protect PHI In 2016, the University of Mississippi Medical Center paid
A Mother Couldn't Get Her Own Son's Medical Records — Then the Feds Got Involved In 2019, a small medical practice in
A $4.75 Million Invoice Nobody Expected In 2022, a cancer care center in Indiana opened an envelope from HHS that changed everything. The Centers
In February 2024, OCR announced a $4.75 million settlement with a hospital system that had failed to conduct an enterprise-wide risk analysis for over
Join healthcare organizations that trust HIPAA Certify for their workforce training and compliance tracking.