Call Us Today! 877-659-2467

Category: HIPAA Compliance News

FTC $20M Fine Highlights the Risk of Using AI without Verification

Posted bySuze Shaffer

$20 Million Settlement Highlights Risks of False Medical Billing and AI-Generated Documentation

DOJ Settlement: $20 Million, Including $10 Million in Restitution

The U.S. Department of Justice (DOJ) announced a $20 million settlement involving Heal 360 urgent-care and primary-care clinics. The settlement resolves allegations that the clinics submitted fraudulent claims for COVID-19 testing services.

The DOJ alleged that Heal 360 billed a federal COVID-19 program for medical services the clinics never performed.

Patients reportedly received only COVID-19 specimen collection services. However, the clinics billed higher-level evaluation and management (E/M) codes, including 99203, 99204, 99213, and 99214.

These codes represented more extensive medical services than patients allegedly received.

How Medical Documentation Contributed to the Alleged Fraud

The DOJ identified several practices that raised serious concerns about billing accuracy and medical record integrity.

According to the allegations:

  • False Medical Records: Staff used electronic templates to document examinations and medical services that never occurred.
  • Remote Scribes: Overseas remote scribes entered information into patient records, including documentation supporting services the clinics allegedly never provided.
  • Incorrect Rendering Providers: The clinics identified a physician as the rendering provider on most claims, despite no patient examination or treatment.
  • Improper Billing: The clinics submitted hundreds of thousands of claims using higher-level E/M codes instead of appropriate collection codes.

These allegations highlight the importance of accurate medical documentation, proper coding, and provider oversight.

What This Means for Healthcare Providers

This settlement raises important concerns for medical practices, urgent-care centers, billing companies, coding vendors, and remote-scribe services.

Organizations using electronic templates or AI-assisted documentation should pay particular attention.

Technology can simplify medical documentation, but providers must verify that every record accurately reflects the services performed.

AI-generated notes and automated templates do not eliminate the provider’s responsibility for accurate documentation and billing.

Steps Healthcare Organizations Should Take Now

Healthcare organizations should review their documentation and billing procedures to reduce compliance risks.

  1. Verify Billing Accuracy: Compare billed E/M codes against the services performed and documented.
  2. Audit Medical Records: Review templated and copied notes for examinations, patient histories, or medical decisions that never occurred.
  3. Confirm Provider Responsibility: Require rendering providers to review and authenticate documentation supporting their claims.
  4. Review AI and Remote-Scribe Documentation: Verify the accuracy of AI-generated notes and information entered by remote scribes.
  5. Monitor Billing Vendors: Ensure billing companies select codes based on documented services, not automatically populated template fields.
  6. Address Overpayments: Investigate potential billing errors and promptly correct and return identified overpayments when required.
  7. Maintain Audit Trails: Preserve records identifying who created, reviewed, modified, and authenticated each medical note.

AI Documentation Creates New Compliance Responsibilities

Healthcare organizations increasingly rely on AI, remote scribes, and electronic templates to improve efficiency.

These technologies can reduce administrative workloads, but they also introduce documentation and compliance risks.

Providers must ensure that automated records accurately reflect each patient’s encounter.

A completed medical record does not prove that a documented service actually occurred.

Organizations should establish clear policies for reviewing AI-generated documentation, verifying clinical accuracy, and maintaining accountability.

The Bottom Line

This settlement does not prohibit healthcare organizations from using remote scribes, electronic templates, or AI-assisted documentation.

However, electronically generated records can become evidence in False Claims Act investigations when they misrepresent services.

Healthcare providers must maintain accurate records, verify billing codes, and ensure that documentation supports every submitted claim.

Remember: Technology can assist with documentation, but it cannot replace provider accountability.

The defendants deny the allegations, and the settlement does not establish liability.

Source: U.S. Department of Justice – Heal 360 $20 Million Settlement

Contact Aris Medical Solutions for a complimentary HIPAA compliance consultation.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Hurricane Preparedness

Posted bySuze Shaffer

For those of you in the path of this storm here are some guidelines to prepare for a hurricane.

Prep your office

  • Print your Contingency Plan or have it available in an alternate location. Make sure you have your emergency contact list that includes vendors you may need.
  • Take your inventory list with you, if possible, take pictures of all equipment with serial and model numbers. You may need this for an insurance claim.
  • If necessary, create a backup and take it with you. Secure it if it is not encrypted.
  • Print out patient schedules, in case of internet outage. 
  • Print out your manual forms/procedures in case systems are down. Place in plastic tubs.
  • Shut down servers and workstations properly and disconnect power (contact your IT vendor to advise them you are shutting down). This includes firewalls / switches / printers / scanners, etc. Place equipment on a desk and cover with plastic bags or place them in plastic tubs if you are not taking them with you. If you have a rack system, place large garage bags over the racks and secure.
  • Remove laptops / external hard drives / software installation disks / operating system disks. There is nothing worse than trying to reload a server or workstations operating system and software and not be able to find the discs. Be sure to label them before removing them so you know where to return them to. Be sure to shut laptops down to engage encryption (if encryption is activated). Secure external hard drive and media. Be sure the person taking the equipment is not in the path of the storm, or travel as far inland as possible.
  • Move any equipment away from windows if possible. If you are expecting a storm surge, it is recommended to take as much of your equipment with you as possible. It would be a good idea to identify who carries servers like yours and note the lead times in case you have to buy a new one.
  • Move anything of value OFF the floor in case of flooding. Place it in plastic tubs.
  • It may be necessary to turn off the main breaker as well.

Prep your home

  • Make extra ice or fill empty containers and freeze them. This can be used to keep your refrigerator and/or freezer cooler longer.
  • Fill the cooler with ice. If you lose power, put the items that you use the most to prevent opening your refrigerator.
  • Make sure all devices and portable chargers are charged.
  • Have battery powered lights or flashlights on hand (extra batteries as well).
  • Important papers, including insurance policies should be stored in the cloud or in a waterproof container.
  • Have a container ready with medications, water, and food for at least 3-5 days.
  • If you have a generator, be sure to test it and have additional fuel on hand.
  • Heavy items and furniture, such as a patio table, may be turned on their sides or upside down to help prevent it from being caught by the wind and tossed about the patio.
  • Potted plants – even small pots can become dangerous projectiles in hurricane strength winds; therefore, they should be removed.
  • Patio umbrellas – close them and remove them from stands and/or patio tables. A gust of wind can send an open umbrella flying through your screen enclosure.
  • Flagpoles – remove flags, and lower or remove pole, if possible.
  • Decorative items – store them safely inside your home or garage to ensure protection from water damage.
  • Enclosed swimming pool – Pool builders recommend leaving water in your pool during a hurricane or strong storm but adding more chlorine to reduce storm water contamination. Your pool may overflow but will be less likely to be damaged by the storm and/or debris that may fall into it. Most importantly, cover outdoor electrical devices with appropriate waterproof material to reduce the risk of damage.

This should be reviewed each year

Overhanging trees, cut back limbs, remove decaying branches, trim off weak limbs and loose leaves. Pay extra attention to any trees or shrubs that are close to your home and especially your patio area and screen enclosure or pool.

Stay safe and watch for downed power lines. These can be deadly!

NIST OCR conference highlights

Posted bySuze Shaffer

HIPAA Risk Analysis Is More Than a Checklist

The message from the NIST OCR conference was clear: a HIPAA risk analysis is not a checklist. It must be comprehensive, accurate, and specific to your organization. Once a thorough and accurate risk analysis is completed, then the mitigation process must be documented. Again, not simply a checklist.

Where is ePHI?

The risk analysis must identify every location where electronic protected health information (ePHI) is created, received, maintained, or transmitted. This includes EHR systems, email, mobile devices, cloud applications, medical equipment, patient portals, billing platforms, databases, websites, backups, and third-party vendors.

Medical practices must map how ePHI flows into, throughout, and outside their systems. This data-flow mapping helps identify unauthorized access, transmission, storage, and disclosure risks that a simple checklist may overlook.

Risk Management

Identifying vulnerabilities is only the beginning. The practice must maintain a documented risk management plan that:

  • Prioritizes identified risks
  • Lists the corrective actions taken
  • Assigns responsibility
  • Establishes completion dates
  • Demonstrates how each vulnerability was mitigated
  • Documents any remaining risk the organization accepts

What is NOT a Risk Analysis?

Several security assessments can support the process, but they do not replace an SRA:

  • A penetration test is useful, but it is not an SRA.
  • A vulnerability scan is useful, but it is not an SRA.
  • A gap analysis is helpful, but it is not an SRA.
  • Completing the HHS SRA Tool does not create a compliant risk analysis if questions are unanswered or marked “Don’t Know.”

Another common problem is leaving the physical safeguards section incomplete. An SRA must evaluate administrative, physical, and technical safeguards and not just cybersecurity controls.

Integrating AI

Before adding an AI tool to a medical practice, the organization should complete the proper privacy, security, and compliance review. Determine whether the AI vendor will access, store, or transmit ePHI. Understand where the data is stored and whether it is used to train AI models. Update the organization’s risk analysis and data-flow map. Establish user access controls, authentication, encryption, and audit logging. Whether ePHI will be shared with third party vendors. Create policies for appropriate AI use and human review. Once this is outlined, then the organization must:

  • Develop procedures for errors, security incidents, and potential breaches
  • Train employees on privacy risks and prohibited uses
  • Obtain a Business Associate Agreement
  • Address patient consent and state-law requirements when applicable

AI can improve efficiency, but it should not be integrated until the practice understands how patient information will be handled and has documented safeguards in place.

Breach Notification

The breach notification clock starts when the breach is discovered, not when the investigation is completed. An organization should not delay the required notification solely because the final number of affected individuals is unknown. File the initial breach report within the applicable deadline using the best information available, and submit an addendum when the investigation confirms the affected-record count or provides additional details. Be sure to follow state law requirement if they are more stringent.

FTC and HIPAA

The FTC does not enforce HIPAA. That responsibility belongs to HHS’s Office for Civil Rights (OCR). However, the FTC can intervene when a healthcare organization’s conduct involves an unfair or deceptive business practice under the FTC Act. A provider could face FTC scrutiny if it misrepresents how patient information is protected. For example, the practice has a “Seal of HIPAA Compliance” on their website and fails to use reasonable security safeguards. The use of online trackers may be sharing health information with advertising or tracking companies contrary to their privacy promises. Therefore, HIPAA compliance does not automatically protect an organization from FTC enforcement. The FTC’s separate Health Breach Notification Rule (HBNR) generally applies to health apps, personal health-record vendors, and related businesses that are not regulated by HIPAA; in some situations, an organization with both HIPAA-regulated and consumer-facing operations may have obligations under both regulatory frameworks.

Summary

The NIST OCR conference clarified the HIPAA compliance requirements. It is crystal clear that more enforcement in on the way due to the increased data breach activity and the lack of documented compliance efforts. They even specifically mentioned that even small providers are required to implement reasonable and appropriate safeguards. No provider is immune from investigations and enforcement.

Protect Your Organization and Your Patients Before It’s Too Late

At Aris Medical Solutions, our HIPAA Keeper™ cloud-based platform makes HIPAA compliance simple. It guides your organization through every requirement with a clear, step-by-step process. From risk analyses and policies to employee training and required documentation, you’ll have everything needed to remain compliant, protected, and audit-ready. Best of all, your HIPAA Compliance Officer is never on their own. Every client has access to a Certified HIPAA Security Analyst who provides expert guidance, answers questions, and helps ensure your compliance program is implemented correctly.

Schedule a free HIPAA checkup today at Aris Medical Solutions.

Don’t let the 2027 HIPAA updates catch you off guard

Posted bySuze Shaffer

Webinar date:

Join Suze Shaffer on Sept 16, 2026 at 1:00 pm to learn how evolving regulatory expectations may impact your organization and discover practical strategies to strengthen your risk analyses, business associate agreements, cybersecurity, data access controls, and AI governance to reduce breach risk and prepare for audits or regulatory investigations.

Why propose an update to the HIPAA Security rule?

The U.S. Department of Health and Human Services (HHS) has proposed a major overhaul of the HIPAA Security Rule, the first since 2013. There has been much discussion about the proposed updates, they have been postponed, but they are NOT canceled. These sweeping new security rule changes are a tough response to the rapidly growing number of large-scale data breaches and cyberattacks now targeting healthcare services and organizations across America.

Don’t let your medical organization get caught off guard! 

In just 60 minutes, you’ll discover what you need to know and what you need to do to navigate the coming HIPAA Security Rule changes. You will learn how to:

  • Navigate the Coming 2027 HIPAA Security Rule Changes: Get a clear update on the proposed overhaul and what it means for medical office managers and their organizations.
  • Many of the proposed changes are already enforceable, but these updates will make them mandatory and may increase fines.
  • Strengthen Risk Analyses and Business Associate Agreements: Discover practical strategies to improve risk analyses and BAAs so your practice is better prepared for stepped-up audits and investigations.
  • Improve Cybersecurity, Data Access Controls, and AI Governance: Learn how to reduce breach risk with stronger cybersecurity practices, access controls, and AI governance.
  • And MUCH MORE!

Cost: $97 (Free for Premium Members)

Register here: Medical Office Manager

  • What: Webinar — What Every Medical Office Manager Needs to Know NOW about Sweeping New 2027 HIPAA Security Rule Changes
  • When: Wednesday, September 16, 2026, 1:00–2:00 p.m. Eastern Time
  • Who: Suze Shaffer, President, Aris Medical Solutions
  • Where: From the comfort of your computer, at your office, or at your home office!
  • Why: To update medical office managers on the latest changes to the 2027 HIPAA Security Rule and regulations—and show practical steps to reduce breach risk and prepare for audits.

Register here: Medical Office Manager

AI in Medical Offices and Patient Privacy

Posted bySuze Shaffer

Artificial intelligence (AI) is no longer a futuristic concept in healthcare; it is already reshaping day-to-day operations in medical offices and throughout healthcare. From automating appointment scheduling and streamlining billing to supporting clinical decision-making and analyzing medical images, AI tools promise greater efficiency, reduced administrative burden, and potentially better patient outcomes. Yet every application that touches patient data brings a corresponding obligation: careful protection of patient privacy. Healthcare AI tools are already facing lawsuits, and with state and federal AI regulations changing rapidly, shielding your practice from costly privacy litigation is becoming increasingly challenging, unless you understand how to minimize that risk and protect patient privacy. The key is implementing AI responsibly before legal or regulatory issues arise.

Practical Applications of AI in Medical Offices

Medical practices are adopting AI across both administrative and clinical workflows:

Administrative automation — AI-powered chatbots and voice systems handle appointment booking, reminders, insurance verification, and basic patient inquiries. Natural language processing tools can draft clinical notes from physician dictation or ambient conversation, reducing documentation time.

Clinical decision support — Algorithms analyze electronic health record (EHR) data to flag potential drug interactions, suggest differential diagnoses, or identify patients at elevated risk for certain conditions.

Imaging and diagnostics support — AI assists in reading X-rays, dermatology photos, or retinal scans, often as a “second reader” that highlights areas of concern for the clinician.

Operational insights — Predictive models forecast no-show rates, optimize staffing, and identify revenue-cycle bottlenecks.

Patient engagement — Personalized educational materials, remote monitoring alerts, and symptom checkers help patients stay engaged between visits.

Privacy Requirements: The Foundation of Trust

Under HIPAA, any AI system that creates, receives, maintains, or transmits PHI is subject to the Privacy Rule, Security Rule, and Breach Notification Rule.

Key obligations include:

1. Business Associate Agreements (BAAs) Most AI vendors act as business associates. Medical offices must execute a BAA before sharing any PHI. The agreement must require the vendor to implement appropriate safeguards, report breaches, and restrict use of data to the purposes authorized by the covered entity.

2. Minimum Necessary Standard AI systems should be configured to access only the data required for the specific task. Broad data lakes or unrestricted model training on full patient records violate this principle unless a clear, documented justification exists.

3. Security Safeguards The Security Rule requires administrative, physical, and technical protections. This typically means:

  • Encryption of data at rest and in transit
  • Strong access controls and multi-factor authentication
  • Audit logging of every access and model inference involving PHI
  • Regular technical risk analyses that specifically address AI-related threats

4. Patient Rights and Transparency Patients retain rights to access their records, request amendments, and receive an accounting of disclosures. When AI tools influence clinical decisions or generate notes that become part of the record, practices should be prepared to explain how those tools work at a high level and how patients can exercise their rights.

5. De-identification and Secondary Use If a practice or vendor wants to use data for model improvement or research, proper de-identification (Safe Harbor or Expert Determination methods) or a valid authorization is required. Simply stripping obvious identifiers is often insufficient for modern AI systems that can re-identify individuals through pattern recognition.

International practices or those serving patients across borders must also consider GDPR, state privacy laws (such as CCPA/CPRA in California or emerging comprehensive state laws), and any sector-specific rules.

Best Practices for Implementing AI Responsibly

  • Conduct a thorough risk assessment before deployment, focusing on data flows, model training sources, and potential failure modes.
  • Prefer on-premises or private-cloud deployments when feasible, or insist on strong contractual and technical isolation in multi-tenant cloud environments.
  • Maintain human oversight. AI recommendations should remain decision-support tools, not autonomous clinical actors, unless the system has undergone appropriate regulatory review (FDA clearance for certain medical devices, for example).
  • Train staff on both the capabilities and the limitations of the AI tools they use, including how to recognize and report anomalous outputs that might indicate data leakage or bias.
  • Establish clear policies for prompt engineering and data entry so that staff do not inadvertently include unnecessary PHI in interactions with generative AI systems.
  • Monitor continuously. Privacy is not a one-time checkbox; ongoing auditing, penetration testing, and vendor assessments are essential.

Balancing Innovation and Obligation

The tension between rapid AI adoption and privacy protection is real. Practices that treat privacy as an afterthought risk regulatory penalties, reputational damage, and most importantly the erosion of trust that underpins the patient-clinician relationship. Those that embed privacy-by-design principles from the start can capture the efficiency and clinical benefits of AI while meeting their ethical and legal duties.

Medical offices do not need to choose between technological progress and patient confidentiality. The most successful implementations will be those that treat privacy requirements not as obstacles, but as essential design constraints that ultimately strengthen both the technology and the care it supports.

As AI continues to evolve, so will the regulatory landscape. Practices that build strong governance, demand accountability from vendors, and keep patients informed will be best positioned to use these powerful tools safely and effectively.

Protect your practice — and your patients

At Aris Medical Solutions, our HIPAA Keeper™ cloud-based platform makes HIPAA compliance simple. It guides your organization through every requirement with a clear, step-by-step process. From risk analyses and policies to employee training and required documentation, you’ll have everything needed to remain compliant, protected, and audit-ready. Best of all, your HIPAA Compliance Officer is never on their own. Every client has access to a Certified HIPAA Security Analyst who provides expert guidance, answers questions, and helps ensure your compliance program is implemented correctly.

Schedule a free HIPAA checkup today at Aris Medical Solutions.

Cybersecurity – Why Human Habits Matter

Posted bySuze Shaffer

When we think of cybersecurity, we often picture sophisticated hackers exploiting complex software bugs. In reality, the battlefield is much closer to home: it’s your busy routine, your packed inbox, and your daily habits. Cybercriminals rarely “break in” using high-tech tools; instead, they trick well-meaning employees into opening the digital front door for them. Whether it’s a fake job offer on LinkedIn, an urgent financial message, or a reused password, modern threats exploit our busy schedules and human nature. One click is all it takes to give a cybercriminal a foothold in your organization. Effective cybersecurity isn’t about imposing impossible restrictions; it’s about making secure habits the easiest choice every day. Building a culture where security becomes second nature is one of the most effective ways to reduce risk and protect your organization.

Why Your Staff Is the Target

Hackers don’t wait for a technical weakness; they wait for a human moment.

The “Human Element”: A massive 68% of security breaches involve human behavior.

Personal and Professional Mix: We use the same devices for work and life. If you click a bad link in your personal Facebook feed on a work laptop, the hacker is instantly inside the business.

The Busy Trap: You don’t have to be careless to get hacked; you just have to be busy. Phishing works because it catches people when they are distracted.

Password Recycling: If you use the same password for your Netflix and your company email, a leak at Netflix gives hackers a direct key to your business.

Why Strict “Bans” Usually Fail

When IT departments try to block everything, like banning personal social media or certain apps, it often backfires.

The Workaround: Instead of stopping the behavior, people just find “shadow” ways to do it, like using their personal phones.

Loss of Visibility: When employees hide their activity to get around strict rules, IT loses the ability to see and manage the real risks.

How to Actually Lower the Risk

The most effective security matches how people actually work.

Separate Your Digital Lives: Use different browser profiles for work and personal stuff. This keeps your “home” habits from accidentally bleeding into “work” data.

Expect a Leak: Assume a password will be stolen eventually. By turning on Multi-Factor Authentication (MFA), you make an account 99% less likely to be hacked even if the password is leaked. Protecting the MFA method is extremely important since hackers trick people into clicking on links that actually share their MFA process.

Unique Keys: Use a different password for every single account so one “bad apple” doesn’t spoil the whole bunch. Many people are turning to FIDO2 keys. FIDO2 security keys (hardware authenticators like YubiKeys) enable strong, phishing-resistant authentication using public-key cryptography, often for passwordless login or as a second factor. FIDO2 combines the WebAuthn API (for websites/browsers) and CTAP (for communicating with external keys via USB, NFC, or Bluetooth). A single key can hold credentials for many sites.

How to use a FIDO2 Key:

Registration

  1. The website (relying party) requests registration.
  2. The key generates a unique public/private key pair scoped to that site/origin.
  3. The private key stays on the hardware key and never leaves it.
  4. The public key (plus attestation data) is sent to and stored by the website.

Authentication

  1. The site sends a one-time random challenge.
  2. The user proves presence or verifies identity (touch the key, enter a PIN, or use biometrics if supported).
  3. The key signs the challenge with its private key.
  4. The site verifies the signature against the stored public key and grants access.

Because the private key never leaves the device and credentials are origin-bound, intercepted data or phishing sites cannot reuse them.

If you find this information helpful, please share it with your colleagues and friends. Together we can keep our information private!

Protect Your Organization Before It’s Too Late

At Aris Medical Solutions, our HIPAA Keeper™ cloud-based platform makes HIPAA compliance simple. It guides your organization through every requirement with a clear, step-by-step process. From risk analyses and policies to employee training and required documentation, you’ll have everything needed to remain compliant, protected, and audit-ready. Best of all, your HIPAA Compliance Officer is never on their own. Every client has access to a Certified HIPAA Security Analyst who provides expert guidance, answers questions, and helps ensure your compliance program is implemented correctly.

Protect your practice — and your patients.

Schedule a free HIPAA checkup today at Aris Medical Solutions.

Google Reviews on Medical Websites: HIPAA Compliance Risks

Posted bySuze Shaffer

Patients trust online reviews. A strong Google rating can influence where someone chooses to receive care. As a result, many medical practices display Google reviews directly on their websites to build credibility and attract new patients.

While this may seem harmless, healthcare organizations should carefully evaluate the HIPAA implications before embedding or displaying patient reviews. What appears to be a simple marketing strategy can create privacy and compliance risks.

Can Medical Practices Display Google Reviews on Their Website Without Violating HIPAA?

Patients may voluntarily post reviews about their own healthcare experiences on Google. HIPAA does not prevent patients from sharing their own health information publicly.

The compliance issue arises when a healthcare provider republishes those reviews on its own website.

Republishing a patient’s review may be viewed as using or disclosing protected health information (PHI) for marketing or promotional purposes. Even though the patient made the information public, HIPAA does not automatically grant the provider permission to reuse it.

The fact that information is publicly available does not eliminate a covered entity’s HIPAA obligations.

Does a Google Review Contain PHI?

Protected Health Information is individually identifiable health information that relates to an individual’s past, present, or future health, healthcare, or payment for healthcare.

Many patient reviews include statements such as:

  • “Dr. Smith treated my diabetes.”
  • “The staff helped me through chemotherapy.”
  • “I had cataract surgery here.”
  • “My child received ADHD treatment.”

When a healthcare provider republishes these reviews, the practice is associating an identified individual with healthcare services it provided. That combination may constitute PHI.

What If Only Initials Are Used?

Some practices believe replacing the patient’s full name with initials eliminates the HIPAA concern.

Unfortunately, it may not.

Initials often do not fully de-identify an individual. Combined with other information, such as the provider’s specialty, procedure performed, date of service, location, or the original review still available on Google, the individual may remain identifiable.

HIPAA’s de-identification standard requires that there be no reasonable basis to identify the individual. Simply changing “John Smith” to “J.S.” rarely satisfies that standard.

No.

Posting a review on Google demonstrates that the patient chose to share information with the public. It does not necessarily authorize the healthcare provider to reuse that information for its own marketing.

HIPAA authorizations have specific regulatory requirements. They generally must:

  • Clearly describe the information being used or disclosed.
  • Identify who may use the information.
  • Identify who may receive it.
  • Explain the purpose of the disclosure.
  • Include an expiration date or event.
  • Inform the individual of their right to revoke the authorization.
  • Be signed by the patient or personal representative.

A Google review does not meet these requirements.

Embedded Google Reviews May Create Additional Privacy Risks

Many practices use Google review widgets that automatically pull reviews onto their websites.

These widgets may introduce additional privacy concerns beyond the review itself.

Depending on how the widget functions, it may:

  • Load content directly from Google servers.
  • Place cookies on visitors’ browsers.
  • Collect IP addresses or device identifiers.
  • Share website activity with third parties.
  • Trigger analytics or advertising technologies.

If review widgets operate alongside analytics, advertising pixels, or other tracking technologies, practices should carefully evaluate whether protected health information could be disclosed to third parties.

Healthcare organizations should inventory all third-party technologies operating on their websites and determine whether appropriate safeguards, contracts, and configurations are in place.

OCR Has Increased Scrutiny of Website Tracking

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has repeatedly emphasized that healthcare organizations are responsible for understanding how third-party technologies collect and transmit information from their websites.

Authenticated patient portals, appointment scheduling systems, online bill payment pages, and other areas where visitors interact with healthcare services require particular attention.

Even public-facing websites deserve careful review when technologies collect information that could become individually identifiable in a healthcare context.

Best Practices for Medical Practices

If your practice wants to highlight positive patient experiences, consider these recommendations:

  • Obtain a HIPAA-compliant authorization before republishing identifiable patient testimonials.
  • Avoid copying reviews directly from Google without authorization.
  • Do not assume publicly posted information removes HIPAA obligations.
  • Evaluate whether review widgets transmit visitor information to third parties.
  • Conduct periodic website privacy and security reviews.
  • Review all analytics, advertising pixels, chat tools, and embedded third-party content.
  • Work with legal counsel or your HIPAA compliance team before implementing new marketing technologies.

Another Approach

Consider asking satisfied patients to provide a separate written testimonial using a HIPAA-compliant authorization form designed specifically for marketing purposes.

This approach provides clear documentation that the patient understands how the testimonial will be used and protects both the patient and the practice.

The Bottom Line

Google reviews are valuable marketing tools, but healthcare providers must approach them differently than most businesses.

A patient may choose to publicly discuss their healthcare experience, but that does not automatically give the provider permission to republish that information on its own website. In addition, embedded review technologies may introduce separate privacy risks that require careful evaluation.

HIPAA compliance extends beyond policies and training. It includes understanding how everyday marketing decisions can affect patient privacy.

Before displaying patient reviews on your website, make sure your practice has evaluated both the HIPAA authorization requirements and the privacy implications of the technology used to display them.

Disclaimer: This article is intended for educational purposes and does not constitute legal advice.

Protect Your Organization Before It’s Too Late

At Aris Medical Solutions, our HIPAA Keeper™ cloud-based platform makes HIPAA compliance simple. It guides your organization through every requirement with a clear, step-by-step process. From risk analyses and policies to employee training and required documentation, you’ll have everything needed to remain compliant, protected, and audit-ready. Best of all, your HIPAA Compliance Officer is never on their own. Every client has access to a Certified HIPAA Security Analyst who provides expert guidance, answers questions, and helps ensure your compliance program is implemented correctly.

Protect your practice — and your patients.

Schedule a free HIPAA checkup today at Aris Medical Solutions.

HIPAA Checklist vs True Compliance

Posted bySuze Shaffer

Distinction That Matters:

Many practitioners view HIPAA as a compliance checklist. They sign forms, complete training, and check boxes. This mindset weakens compliance and patient protection. HIPAA reflects the privacy and security principles that support quality patient care. These principles matter whether the law requires them or not. HIPAA compliance goes beyond checking off a list. Strong compliance creates a culture of privacy, security, and accountability. Organizations should strengthen their security programs now. Do not wait for stricter Security Rule requirements to be finalized before taking action. Patients entrust you to protect their privacy.

Patient Protection:

Trust as a prerequisite. Patients who fear disclosure often withhold important health information. This includes mental health, substance use, sexual health, and HIV status. Incomplete information can lead to inaccurate diagnoses and treatment decisions. Strong privacy protections build trust and encourage honest communication. Better communication leads to better clinical outcomes.

Preventing downstream harm. Cybersecurity is now viewed as a patient safety issue, not just an IT responsibility. PHI exposure doesn’t merely embarrass, it causes measurable injury: loss of employment, insurance discrimination, damaged relationships, domestic violence risk (particularly relevant when an abuser shares a health plan), and in some cases physical danger. Healthcare providers protect patients by securing their information and handling it responsibly.

Continuity of the relationship. Unauthorized disclosures can permanently damage patient trust. Even well-intentioned disclosures can weaken the patient-provider relationship. Patients who lose trust often delay or avoid needed care. Strong privacy protections support lasting relationships and better patient outcomes.

Practice Protection:

Breach costs are severe and compounding. OCR penalties range from $145 to $73,011 per violation, with annual caps reaching over $2 million per violation category. More damaging is the breach notification requirements, mandatory corrective action plans, and reputational exposure that affects patient volume and referral networks. A single ransomware incident or misdirected fax can trigger all of these simultaneously.

Breach exposure expands with data failures. A breach that causes patient harm creates dual liability, regulatory and civil. HIPAA does not offer a patient right of action; however, plaintiffs’ attorneys increasingly treat PHI mishandling as evidence of systemic negligence, not merely a technical violation. It colors how a jury perceives the entire standard of care and imposes high settlements during a class action lawsuit.

Third-party relationships. Business Associate Agreements exist because your liability extends through your vendors. A practice that doesn’t rigorously manage BAAs inherits risk from EHR vendors, billing services, and cloud storage providers. Ignorance of a downstream breach is not a defense. Business associates are increasingly being held to the same security expectations as covered entities.

Ethical Compliance Frameworks Often Miss:

HIPAA did not create patient confidentiality. It established enforceable standards for an existing ethical duty. The Hippocratic Oath, AMA ethics, and medical ethics frameworks all recognize confidentiality as a core responsibility.

HIPAA transforms that responsibility into specific, measurable, and auditable requirements. Many organizations treat HIPAA compliance as the finish line instead of the starting point. This approach creates unnecessary compliance and ethical risks. The Minimum Necessary Standard reflects more than a legal requirement. It requires staff to access only the information needed for legitimate purposes. This standard supports both patient privacy and ethical decision-making.

Practices that embrace this principle build stronger compliance programs. They also earn greater patient trust than organizations that simply check compliance boxes.

The Practical Mixture:

A practice that treats HIPAA as necessary and not merely required will:

  • Build patient relationships capable of supporting honest clinical communication
  • Reduce liability exposure across both regulatory and civil channels
  • Establish vendor and staff accountability structures that prevent the most common breaches (insider access, phishing, improper disposal)
  • Operate with a defensible standard of care in the event of litigation

The law exists. But the reasons to comply existed before it, and they matter more.

For organizations following HIPAA closely, the message from regulators and industry experts is clear: maintaining a written, well-documented compliance program with strong cybersecurity controls is becoming the baseline expectation, not a best practice. One of the main enforcement requirements is that of a Risk analysis as a starting point. Then must be updated as technology and staff changes.

Protect Your Organization Before It’s Too Late

HIPAA compliance isn’t a one-time project; it’s an ongoing process. At Aris Medical Solutions, our HIPAA Keeper™ system simplifies compliance with a cloud-based platform that walks you through each requirement, step by step. From risk analysis to training and documentation, you’ll have everything you need to stay protected, compliant, and audit ready.

Protect your practice — and your patients.


Schedule a free HIPAA checkup today at Aris Medical Solutions. Your HIPAA Compliance Officer will have a HIPAA security analyst to guide and assist them every step of the way.

HIPAA vs State Privacy Laws

Posted bySuze Shaffer

Many cash practices have the misconception that HIPAA does not apply to them. Well, that maybe true in some aspects, BUT… state privacy laws may actually be more stringent. In the coming years, more states will implement privacy laws to protect consumers from privacy and security failures due to the rise in cybercrime.

So, when practices compare HIPAA vs State Privacy laws, HIPAA sets a federal floor for covered entities. Cash practices escape HIPAA’s reach but land directly in a patchwork of state laws that can be equally or more demanding. The absence of HIPAA liability is not the absence of privacy liability.

What is HIPAA and Who Must Comply?

HIPAA (Health Insurance Portability and Accountability Act) applies to covered entities. This includes health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in connection with certain standard transactions (like billing insurance).

If you never bill insurance and never transmit health information electronically for covered transactions, you are likely not a HIPAA covered entity.

Cash-Only or Direct-Pay Practices and HIPAA

Although a cash only or direct pay practice may not fall under the HIPAA rule guidelines there are other laws they must follow and still have significant legal obligations to protect patient information.

Specialized Federal Privacy Laws

Depending on the services provided, additional federal laws may apply, such as:

  • 42 CFR Part 2 for certain substance use disorder treatment records.
  • Federal protections for certain research records.
  • Privacy requirements related to employment or occupational health records.

Federal Trade Commission (FTC) Health Breach Notification Rule

The FTC Health Breach Notification Rule may apply to certain health apps, telehealth providers, and businesses that are not covered by HIPAA if they experience a breach of individually identifiable health information

Federal Trade Commission (FTC) Act

The Federal Trade Commission can investigate businesses that:

  • Misrepresent their privacy practices.
  • Fail to safeguard consumer information after promising to do so (this includes posting a HIPAA Compliant Seal on a website).
  • Engage in unfair or deceptive acts involving personal information.

State Privacy Laws Fill the Gap

  • Govern how long records must be retained (varies: 5–10+ years by state)
  • Define patient rights to access and amend their records
  • Authorized disclosures
  • Apply to all providers regardless of insurance billing status
  • Civil penalties for unauthorized disclosures
  • Protection of electronic health records

These laws often apply regardless of whether the provider accepts insurance.

State Medical or Dental Practice Licensing Boards
State licensing boards generally require licensed healthcare providers to:

  • Maintain confidential patient records.
  • Secure electronic records.
  • Maintain complete and accurate documentation.
  • Retain records for the required period.
  • Protect patient information from unauthorized access.

Failure to do so can result in disciplinary action, including license suspension or revocation.

State Consumer Health Privacy Laws
Several states have enacted broader health privacy laws that apply beyond HIPAA. Examples include:

  • California (CMIA) – California Confidentiality of Medical Information Act applies broadly, including to providers not covered by HIPAA. California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).
  • Colorado – Outlines five key rights for Colorado consumers, right to access, right to correction, right to delete, right to data portability, right to opt out.
  • Connecticut – The Connecticut Data Privacy Act (CTDPA) includes stronger data protections for children.
  • Florida, Texas, New York – each have specific statutes governing patient records, breach notification, and consent requirements.
  • Washington My Health MY Data Act (2023) – extends beyond HIPAA to cover consumer health data broadly.

Most states have implemented similar state privacy laws, some are more stringent, while others apply to larger entities. Keep in mind, these laws may apply even when HIPAA does not.

State Data Breach Notification Laws
All 50 states have breach notification laws. If an EHR containing patient information is accessed, stolen, or compromised, the provider may have to notify:

  • Affected patients.
  • The state attorney general (in some states).
  • Consumer reporting agencies (for large breaches).

The notification requirements vary by state.

Contracts with the EHR Vendor
Nearly every EHR agreement requires the practice to:

  • Maintain account security.
  • Control user access.
  • Protect passwords.
  • Report security incidents.
  • Use the software appropriately.

Violating these contractual obligations can create liability.

Does using an EHR create security obligations?

Even if HIPAA does not apply, using an EHR means the practice should implement reasonable safeguards such as:

  • Unique user accounts
  • Strong passwords or passkeys
  • Multi-factor authentication, when available
  • Encryption of devices and backups
  • Automatic screen locking
  • Audit logs
  • Routine software updates
  • Staff confidentiality training
  • Procedures for responding to security incidents

These measures are often considered evidence of reasonable care if a privacy dispute or data breach occurs.

Class Action Lawsuits

Medical data breaches carry significant class action lawsuit risk, as a single incident can expose personal health information. Plaintiffs’ attorneys have increasingly targeted healthcare providers, insurers, and their vendors following breaches, alleging failures to implement reasonable and appropriate security measures, violations of state privacy statutes, and in some cases HIPAA-adjacent state law claims. Even cash-pay practices that fall outside HIPAA’s reach are not immune: state consumer protection laws, medical records statutes, and common law negligence theories can all support class action claims when patient data is compromised. Courts have become more receptive to standing arguments in data breach cases, and the cost of defending, let alone settling a class action, can be devastating for a and size of practice. Inadequate data security is not just a regulatory risk; it’s a litigation risk that no practice can afford to ignore.

Smart practice even if not required:
Many cash-pay providers voluntarily adopt HIPAA-like privacy practices because:

  • It builds patient trust.
  • It provides a defensible compliance standard.
  • State laws often parallel HIPAA requirements anyway.
  • It simplifies operations if the practice ever accepts insurance later.

Protect Your Organization Before It’s Too Late

HIPAA compliance isn’t a one-time project, it’s an ongoing process. At Aris Medical Solutions, our HIPAA Keeper™ system simplifies compliance with a cloud-based platform that walks you through each requirement, step by step. From risk analysis to training and documentation, you’ll have everything you need to stay protected, compliant, and audit ready.

Protect your practice — and your patients.


Schedule a free HIPAA checkup today at Aris Medical Solutions. Your HIPAA Compliance Officer will have a HIPAA security analyst to guide and assist them every step of the way.

Class Action Lawsuits and Healthcare Providers

Posted bySuze Shaffer

HIPAA itself does not provide individuals with a “private right of action,” meaning patients generally cannot sue a Covered Entity or Business Associate directly under HIPAA for a violation. Enforcement authority belongs to the U.S. Department of Health and Human Services Office for Civil Rights (OCR), which investigates complaints and may impose corrective actions, settlements, or civil monetary penalties.

Class Action vs HIPAA

However, while patients may not sue “under HIPAA,” class action lawsuits are becoming more prevalent following healthcare data breaches or privacy incidents. Plaintiffs’ attorneys often use alleged HIPAA failures as evidence of negligence, inadequate security practices, breach of fiduciary duty, or violations of state consumer protection and privacy laws. In many cases, lawsuits focus on claims such as emotional distress, identity theft risk, financial harm, or failure to properly safeguard sensitive information. As healthcare breaches continue to increase and state privacy laws expand, organizations are facing growing litigation exposure even when OCR does not issue a HIPAA fine.

Class Action Lawsuits

For example, American Multispecialty Group, which does business as Esse Health, a Missouri-based independent physician group serving the greater St. Louis area, experienced a cyberattack and data breach in April 2025. Following the incident, Esse Health became the target of multiple class action lawsuits related to the breach. Those lawsuits were later consolidated, and the organization recently agreed to a $2,525,000 settlement to resolve the claims.

Other class action lawsuits include Ascension, BJC Healthcare, HCA Healthcare, Hypertension Nephology Associates, and Shields Heath Care Group that settled for $15,300,000.

These lawsuits commonly allege:

  • Failure to conduct an accurate and thorough risk analysis
  • Failure to implement reasonable security safeguards
  • Negligent cybersecurity practices
  • Delayed breach notification
  • Failure to properly monitor systems
  • Increased risk of identity theft and medical fraud

This trend demonstrates that even though HIPAA itself does not create a private right of action, plaintiffs are increasingly using state negligence laws, consumer protection laws, breach of implied contract claims, and privacy torts to pursue class action litigation after healthcare data breaches.

Protect Your Organization Before It’s Too Late

HIPAA compliance isn’t a one-time project, it’s an ongoing process. At Aris Medical Solutions, our HIPAA Keeper™ system simplifies compliance with a cloud-based platform that walks you through each requirement, step by step. From risk analysis to training and documentation, you’ll have everything you need to stay protected, compliant, and audit ready.

Protect your practice — and your patients.


Schedule a free HIPAA checkup today at Aris Medical Solutions. Your HIPAA Compliance Officer will have a HIPAA security analyst to guide and assist them every step of the way.

©2026 Aris Medical Solutions – HIPAA Risk Management | HIPAA Compliance Consultants | All Rights Reserved | Terms and Conditions | Privacy Policy
The content and images on this website is owned by Aris Medical Solutions and their owners. Do not copy any content or images without our consent.
Powered by Bandwise LLC