All insights
Deep dives mapped to the Privacy, Security, and Breach Notification Rules, written for operators who need plain-English explanations, CFR citations, and practical checklists.
Try: BAA, Security Rule, breach notification, PHI, OCR enforcement
Featured insight
Analysis
OCR's HIPAA breach portal is running months behind schedule, still posting March 2026 breaches in late June. Here is what the lag means for covered entities tracking business associate risk.
Analysis
The share of healthcare breaches involving a business associate doubled in a year, from 15% to 30%. Halfway through 2026, the data explains why the biggest breaches keep starting at vendors, and what covered entities should do about it.
Analysis
Every HIPAA requirement in one checklist: risk assessment, training, BAAs, breach procedures, and safeguards. Built for small practices that need to get compliant without the legalese.
Analysis
A complete guide to HIPAA workforce training requirements under the Privacy Rule and Security Rule — who must be trained, what training must cover, how often it must occur, and how to document it for OCR.