For practices, clinics and their vendors
The HIPAA Security Rule requires every covered entity and business associate to protect electronic patient information with administrative, physical and technical safeguards. We set up those safeguards in your daily IT, document them as we go and sign a Business Associate Agreement with you.
The Security Rule applies to covered entities: health plans, health care clearinghouses and health care providers that transmit health information electronically, for example when they bill insurers. A medical or dental practice that submits claims electronically is a covered entity, regardless of its size.
It also applies to business associates. These are vendors that create, receive, maintain or transmit protected health information on behalf of a covered entity, such as billing services, IT providers, cloud hosts and transcription services. Business associates are directly liable for complying with the Security Rule, so a vendor cannot leave security to the practice.
A risk analysis and a risk management plan, a named security official, workforce training, access management, a sanctions policy, contingency planning with data backup and disaster recovery, and regular evaluation of the program.
Controlled access to server rooms and offices, rules for workstations in exam rooms and at the front desk, and secure handling, reuse and disposal of devices and storage media.
Unique user IDs, automatic logoff, audit logs that show who opened which record, protection against improper changes to data, verification of who is signing in, and protection of data in transit.
Every covered entity and business associate must conduct an accurate and thorough risk analysis of the risks to the electronic protected health information it holds. It is the step HHS asks about first after a breach, and a missing or outdated risk analysis is one of the most common findings in enforcement cases. Some other specifications are called addressable. That means you may choose a reasonable alternative and document why, not that you may skip the point.
These are the points we set up and document in a typical practice:
If unsecured protected health information is breached, the Breach Notification Rule sets these deadlines:
| Affected individuals | Without unreasonable delay, no later than 60 days after discovery |
| HHS, 500 or more individuals | Within the same 60 days, through the HHS breach portal |
| HHS, fewer than 500 individuals | Annual log, due within 60 days after the end of the calendar year |
| Media, more than 500 residents of a state | Notice to prominent media outlets within 60 days |
| Business associates | Notify the covered entity no later than 60 days after discovery |
Data that is encrypted according to HHS guidance is not unsecured, so its loss is generally not a reportable breach. Many states have their own, sometimes shorter, deadlines. Your legal counsel decides whether an incident is a reportable breach.
On January 6, 2025, HHS published a proposed rule to update the Security Rule. Among other things, it would require multi-factor authentication, encryption of patient data at rest and in transit, a written technology asset inventory, and the ability to restore critical systems within 72 hours. It would also remove most of the distinction between required and addressable specifications.
As of October 2026 the proposal is not final, and the current Security Rule remains in force. Most of the proposed measures are good practice anyway, so we plan new setups to meet them where the effort is reasonable.
For practices with up to 15 people at one location we review your IT against the Security Rule for a fixed $3,500. Larger organizations start with a security assessment from $7,900, which we credit toward the follow-up project.
You receive a written risk analysis and a list of measures ordered by risk and effort, in a form you can show to HHS or an insurer.
We set up accounts, MFA, encryption, logging and backup, and we work with your EHR vendor where its system is involved.
We keep the safeguards running, update the documentation when something changes and sign a Business Associate Agreement with you.
Updated:
FAQ
Yes. A health care provider that transmits health information electronically, for example to bill insurers, is a covered entity regardless of its size. The Security Rule lets you scale the safeguards to your size and risk, but it does not exempt small practices.
It is a documented review of where your electronic patient information is stored and transmitted, which threats and weaknesses exist, how likely they are and what harm they would cause. The Security Rule requires it, and you should update it when your systems or practice change.
Yes. When we manage systems that hold or transmit protected health information, we sign a Business Associate Agreement with you before we start. It sets out how we protect the data and how we report a security incident to you.
No. HHS does not certify organizations or products as HIPAA compliant. What counts is that you have implemented the required safeguards and can show it with your risk analysis, policies and records. We implement the technical controls and prepare the evidence. Your legal counsel decides questions of interpretation.
For practices with up to 15 people at one location the readiness check costs a fixed $3,500. Larger organizations or several locations start with a security assessment from $7,900, which we credit toward the follow-up project.
Not every incident is a reportable breach. If unsecured protected health information was acquired, accessed, used or disclosed in a way the Privacy Rule does not permit, you must notify affected individuals within 60 days of discovery and report to HHS. Encrypted data is generally not unsecured. Your legal counsel makes the final call.
No. HHS published a proposed update in January 2025, but as of October 2026 it is not final. The current Security Rule applies. We plan new setups so that they also meet most of the proposed requirements, such as MFA and encryption.
HIPAA
Tell us how many people work in your practice and which systems you use. We will tell you what a readiness check covers and where you likely stand today.
