Healthcare IT questions, answered plainly

Yes. If you are a healthcare provider that conducts standard electronic transactions, such as billing insurance electronically, you are a covered entity, and the Security Rule applies to the electronic patient information you hold. The rule is flexible about how you meet it based on your size, but not about whether you do.

It's a documented assessment of the risks to the confidentiality, integrity and availability of your electronic protected health information, required by 45 CFR 164.308(a)(1)(ii)(A). It must be followed by a plan to reduce those risks to a reasonable level.

No. HHS does not certify organizations as HIPAA compliant. Some companies sell certificates or seals, but they have no legal standing. Compliance is shown through your risk analysis, safeguards, policies, training and records.

It's a contract required by HIPAA when a vendor creates, receives, keeps or transmits patient information for you. It commits the vendor to protect the data and report breaches. Your IT provider, billing company, cloud backup and EHR host should all have one with you. We sign one with every healthcare client.

Patients must be notified without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to HHS within that time and, if more than 500 residents of a state are affected, to prominent local media. Smaller breaches can be logged and reported to HHS within 60 days after the end of the calendar year.

HHS guidance says encryption of patient data by ransomware is presumed to be a breach unless you can show, through a documented risk assessment, a low probability that the data was compromised. Good logging and forensic evidence are what make that possible.

Not as of October 2026. HHS published a proposed rule in January 2025 that would make safeguards like multifactor authentication, encryption and asset inventories explicit requirements. It has not been finalized. Most of the proposed safeguards are already good practice, so we build toward them now.

Under the current rule, encryption is an addressable specification. That means you must implement it where reasonable, or document why not and what you do instead. For laptops, phones and email containing patient data, encryption is almost always reasonable. Properly encrypted data that is lost or stolen is generally not a reportable breach.

The Security Rule requires you to keep required policies, procedures and records of actions and assessments for six years from when they were created or last in effect, whichever is later.

Yes. We standardize networks, security settings and phones across locations, connect them securely to shared systems and make opening a new office a planned project. We work on site across metro Atlanta.