If you run a small medical or dental practice, the emails about the 2026 HIPAA Security Rule keep coming, and most of them are selling urgency. Here is the part they skip: a HIPAA security risk analysis is already required by law, has been for years, and is the single most common gap the government […]
HIPAA Security Risk Analysis: Already Required by Law Read More »
The 2026 HIPAA Security Rule is still a proposal. There is no deadline on your calendar, and any vendor implying otherwise is selling urgency that does not exist. What does exist is a federal enforcement campaign that has been settling with practices, including small ones, over a requirement that is already years old. This post
The 90-Day HIPAA Get-Ready Plan for Small Practices Read More »
No, HIPAA does not require MFA and encryption yet. The 2026 Security Rule that would make both mandatory is still proposed, not law, and OCR has not finalized it. But encryption and MFA are where enforcement is already heading, and for most small practices the work is configuration you can finish this month, not a
HIPAA MFA and Encryption: What Small Practices Do Now Read More »
If you run a small medical or dental practice, you have probably gotten a few emails lately warning you that major new HIPAA rules are coming and you need to act right now. Some of that is true. A lot of it is the same fear pitch every IT and compliance vendor sends when they
2026 HIPAA Security Rule: What Small Practices Should Know Read More »