Healthcare & Medical Compliance

Regulations That Apply

Regulation	What It Covers
HIPAA Privacy Rule	How you can use and share Protected Health Information (PHI)
HIPAA Security Rule	Safeguards required to protect electronic PHI
HITECH Act	Breach notification, increased penalties, business associate liability
HHS 405(d) HICP	Recognized cybersecurity practices — regulatory benefit if implemented 12+ months before an incident
42 CFR Part 2	Confidentiality of Substance Use Disorder records — enforcement began Feb 16, 2026
PA 73 Pa. Stat. §2301	PA Breach of Personal Information Notification Act

What You Need In Place

• Encryption of patient data in storage and in transit
• Multi-factor authentication on all systems with PHI (industry standard, expected to become required under the 2026 Security Rule update)
• Periodic risk analysis (annual recommended) and risk management plan
• Workforce training on Privacy and Security Rules
• Backup and disaster recovery planning
• Signed Business Associate Agreements with vendors
• Audit logs and regular log review
• Written incident response plan

Common Threats In This Sector

Healthcare remains the most-targeted industry for ransomware. The financial motivation (insurance payouts, identity-theft markets for PHI) and operational pressure (life-safety systems, no downtime tolerance) make it a consistent target.

• Ransomware tuned to encrypt EMR, PACS, and billing systems
• Business email compromise targeting billing and claims staff
• Phishing for patient-portal credentials and bulk PHI exfiltration
• Third-party vendor compromise (medical device manufacturers, transcription, billing services, scheduling platforms)
• Insider misuse — staff browsing celebrity, neighbor, or family member records
• Lost or stolen mobile devices with unencrypted PHI

Documentation You’ll Be Asked For

HHS Office for Civil Rights audits, cyber insurance applications, and Business Associate Agreement reviews all request the same core artifacts. Having them current and accessible is the difference between a routine inquiry and a forensic engagement.

• Security Rule Risk Analysis (annual) and Risk Management Plan, per 45 CFR § 164.308(a)(1)
• Sanctions policy and current workforce training records
• Business Associate Agreement inventory with renewal tracking
• Incident Response Plan including breach-notification workflow (45 CFR §§ 164.400–414)
• Audit log retention policy and evidence of log review
• Encryption inventory covering endpoints, backups, and removable media
• Contingency Plan and disaster recovery procedures with tested-restore evidence

Where Most Small Practices Fall Short

HHS OCR resolution agreements cite the same handful of gaps year after year. None of them are technically difficult to address — they just require sustained attention.

• No documented Risk Analysis within the past 12 months
• MFA not enforced on all systems with access to PHI
• Business Associate Agreements signed years ago and never updated as the vendor list changed
• Audit logs exist but no one reviews them
• Backups run nightly but no one has ever validated a restore
• Generic, off-the-shelf policies that do not reflect the actual environment