HIPAA Compliance News Archives

Are your Vendors Putting your Practice at Risk?

Suze Shaffer November 3, 2026November 3, 2026

Vendors and business associates increasingly expose healthcare organizations to cybersecurity threats. Meanwhile, OCR continues to focus on familiar compliance failures. Healthcare data breaches continue at a rapid pace in 2026. Hacking and IT incidents dominate reports to the HHS Office for Civil Rights (OCR). Large breaches affect 500 or more individuals. Reports of these breaches have declined slightly from 2025’s record, but third-party risks have intensified.

The Landscape So Far

Organizations reported 397 large healthcare breaches to OCR during the first half of 2026. Those breaches affected approximately 33.8 million individuals, fewer than during the same period last year. Business associates played a role in approximately 43% of those reports, exceeding historical averages. Hacking and IT incidents accounted for most cases.

Several 2026 incidents illustrate these risks.

DentaQuest – A May cyber incident affected approximately 15 million individuals at DentaQuest, a Sun Life subsidiary. The ShinyHunters extortion group claimed responsibility. Attackers stole names, addresses, Social Security numbers, and Medicaid or Medicare identifiers. They also obtained dental or vision information, including diagnoses, treatment details, and billing records. DentaQuest began notifications in July after the group leaked information following failed negotiations.

iRhythm Technologies – A June incident affected approximately 8.18 million people. Attackers used social engineering to access business applications that a third party hosted. The incident did not involve clinical systems or medical devices. Exposed information included names, contact details, birth dates, insurance numbers, account or serial numbers, and service dates. The company began notifications in October. At that time, iRhythm reported no evidence of identity theft.

Blueberry Pediatrics – Attackers exploited a vulnerability in Metabase, a business intelligence and reporting tool. The incident affected approximately 341,000 individuals, including children. A related incident involving prescription partner Photon involved the same vulnerability. Exposed information included names, birth dates, health-plan details, and certain medical and billing information. Blueberry Pediatrics discovered the incident in August and began notifications in October.

Earlier Breaches Continue to Carry Consequences

Conduent’s 2024–2025 breach affected approximately 62.2 million records, making it the third-largest reported incident. The incident recently prompted an $80 million class-action settlement agreement.

Change Healthcare’s 2024 ransomware attack remains the largest reported healthcare breach, affecting approximately 192.7 million individuals.

Enforcement Priorities Remain Consistent

OCR continues its Risk Analysis Initiative. Nearly every recent settlement identifies failures involving an accurate and thorough risk analysis. The HIPAA Security Rule establishes this requirement under 45 CFR § 164.308(a)(1)(ii)(A).

Several 2026 settlements illustrate OCR’s priorities.

Ambry Genetics agreed to a $700,000 settlement following a phishing incident affecting approximately 225,000 people. OCR also identified concerns involving access termination and unique user identifiers.

OSF Healthcare System agreed to a $552,250 settlement involving a ransomware incident affecting approximately 54,000 individuals. OCR identified potential violations involving risk analysis, impermissible disclosures, and breach notifications.

Spencer Gifts agreed to a $450,000 settlement involving its employer-sponsored health plan following a ransomware attack. The case demonstrates that HIPAA obligations can extend beyond traditional healthcare providers.

Patient Access Still Drives Enforcement

OCR also continues its Right of Access Initiative. A recent $140,000 settlement with Pennsylvania dental practice Shen Smiles addressed delayed patient access and related Privacy Rule concerns. The case reinforces that organizations can face enforcement without experiencing a cyberattack.

What These Trends Mean for Organizations

Vendors expand your exposure. Business associates, software platforms, reporting tools, and revenue-cycle partners create additional opportunities for attackers. Healthcare organizations must address vendor relationships within their HIPAA compliance programs.

Risk analysis supports effective security.

OCR repeatedly identifies incomplete or outdated risk analyses during breach investigations. Organizations should document risks across their operations and update their analyses as threats and systems change. Analyses should address phishing, social engineering, third-party applications, and ransomware.

Notifications and contracts require attention.

Enforcement findings frequently address delayed notifications to affected individuals and OCR. Clear business associate agreements help establish reporting duties and other responsibilities. Organizations should understand these obligations before an incident occurs.

Financial consequences extend beyond regulatory payments.

Organizations may also face class actions, state enforcement, forensic investigations, notification expenses, and credit-monitoring costs. Operational disruptions and lost patient trust can increase the damage.

Actionable Steps

Update your organization-wide risk analysis to address third-party systems and current threats.
Inventory vendors and prioritize those with significant access to sensitive information.
Request evidence of vendor security controls and verify their effectiveness where appropriate.
Test incident response procedures, including notification timelines and decisions involving third-party incidents.
Document patient record requests and confirm that staff consistently follow access procedures.
Review cybersecurity insurance coverage, including exclusions involving vendor incidents.

OCR Continues to Examine Core Safeguards

Attackers exploit weaknesses across healthcare organizations and their vendors. OCR continues to examine how organizations implement core HIPAA Security Rule requirements. Treat risk analysis, vendor oversight, and incident response as ongoing responsibilities. Regular reviews and documented improvements help organizations respond as threats evolve.

When was the last time your organization reviewed your Business Associates?

HIPAA compliance isn’t a one-time project; it’s an ongoing process. At Aris Medical Solutions, our HIPAA Keeper™ system simplifies compliance with a cloud-based platform that walks you through each requirement, step by step. From risk analyses, risk management, policies to employee training, and required documentation, you’ll have everything needed to remain compliant.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Your Trusted Partner for HIPAA Compliance since 2009

Healthcare Data Breaches Remain High as New Risks Emerge

Suze Shaffer November 2, 2026November 3, 2026

Healthcare organizations continue to face significant data protection challenges in 2026, despite occasional monthly declines in breach reports. Through August, organizations reported approximately 593 large breaches to the HHS Office for Civil Rights (OCR). These breaches affected 500 or more individuals each and represented a 6.7% increase compared with the previous year. The incidents exposed protected health information (PHI) belonging to approximately 78.6 million people. That figure increased 14.8% compared with the same period in 2025.

Hacking and IT incidents continue to dominate breach reports. However, attackers and workforce members increasingly expose information through different pathways. Third-party vendors and business associates account for a growing share of reports. Unauthorized AI use also creates risks alongside ransomware and phishing.

Recent Incidents and Settlements

iRhythm Technologies reported a June 2026 incident involving business applications that a third party hosted. Attackers used social engineering to gain unauthorized access. OCR portal filings identify more than 8.1 million affected individuals. Compromised information included names, contact details, birth dates, insurance numbers, account or device serial numbers, and service dates. According to reports, the incident did not affect clinical systems or devices.

AdaptHealth disclosed a hacking incident that exposed information belonging to more than 4.1 million individuals. The incident ranks among the year’s larger breach reports.

Lehigh Valley Health Network agreed to an $800,000 OCR settlement involving a 2023 ransomware incident. The attack affected 248,359 individuals. The settlement marked OCR’s 22nd ransomware enforcement action. OCR identified potential failures involving risk analysis, system activity reviews, and timely notifications to individuals and HHS. The organization also agreed to a $65 million settlement resolving related class-action litigation. Attackers stole sensitive clinical information, including some images of patients undergoing treatment.

Ambry Genetics agreed to a $700,000 settlement following a phishing attack affecting approximately 225,000 individuals. OCR identified deficiencies involving risk analysis, access termination, and unique user identification.

Patient Access Remains an Enforcement Priority

OCR continues to pursue complaints involving delayed patient access to medical records. Pennsylvania dental practice Shen Smiles paid $140,000, while Azul Vision paid $50,000. Both cases involved delays in providing patients with their records. These settlements reinforce OCR’s continued focus on patient access rights.

Emerging Risk: Unauthorized AI Use

A Johns Hopkins Bayview Medical Center staff member uploaded a spreadsheet to an unapproved public AI tool. The spreadsheet contained information about 3,182 patients who received admissions or treatments between May and September 2026. The information may have included names, medical record numbers, account numbers, admission dates, departments, medications, and provider names. The hospital reported that the information excluded Social Security numbers and financial account details. The hospital discovered the issue that same day. It directed deletion of the prompt and file, contacted the vendor, and began notifying patients. The hospital also offered credit monitoring.

This incident highlights the risks employees create when they use unauthorized AI tools for analysis or summarization. Uploading PHI outside approved systems can trigger breach assessments, notification obligations, and regulatory scrutiny. Organizations must also determine whether vendors retain copies after users delete uploaded information.

Common Gaps in OCR Investigations

OCR settlements repeatedly identify foundational weaknesses.

Organizations often fail to:

Complete thorough risk analyses and update them as circumstances change.
Implement effective access controls and audit logging.
Notify affected individuals and regulators promptly.
Establish clear policies for workforce use of new technologies.

Third-party involvement also remains a significant concern across recent large breaches.

Practical Steps for Healthcare Leaders

Keep risk analysis current. Document findings and maintain a risk management plan that addresses identified vulnerabilities.
Establish clear AI rules. Identify approved tools, restrict PHI uploads, and explain the risks of public platforms.
Strengthen vendor oversight. Request evidence of risk assessments, establish incident reporting expectations, and maintain appropriate contractual safeguards.
Improve notification procedures. Assign responsibilities, track deadlines, and address reporting requirements during incident response planning.
Monitor patient access requests. Train staff, document requests, and resolve delays before they generate complaints.

Build Ongoing Accountability

The volume of incidents and affected individuals remains high even as monthly counts fluctuate. Organizations that invest in continuous risk assessment, clear technology governance (especially around AI), and disciplined vendor management are better positioned to reduce both the likelihood of incidents and the severity of regulatory and litigation outcomes when they occur.

When did your organization last review and update its HIPAA Security Risk Analysis?

At Aris Medical Solutions, our HIPAA Keeper™ cloud-based platform makes HIPAA compliance simple. It guides your organization through every requirement with a clear, step-by-step process. From risk analyses, risk management, policies to employee training, and required documentation, you’ll have everything needed to remain compliant, protected, and audit-ready. Best of all, your HIPAA Compliance Officer is never on their own. Every client has access to a Certified HIPAA Security Analyst who provides expert guidance, answers questions, and helps ensure your compliance program is implemented correctly.

Schedule your HIPAA compliance review today and protect your organization from the next data breach.

Your Trusted Partner for HIPAA Compliance since 2009

Have you Updated your Asset List Lately?

Suze Shaffer November 1, 2026November 3, 2026

Who is responsible for updating every device connected to your network?

Most organizations assume their IT provider handles cybersecurity updates. However, that assumption can create serious security vulnerabilities.

Consider this example… a specialty medical practice with an imaging workstation that had not received security updates in over a year. The workstation wasn’t hidden, and hackers hadn’t compromised it. It simply remained connected to the network without necessary security patches. The manufacturer had released a fix more than twelve months earlier. Yet nobody had installed it. Why? Because everyone assumed someone else was responsible.

When IT and Medical Equipment Vendors Assume Someone Else Is Responsible

The practice’s IT provider assumed the medical equipment vendor handled updates for imaging devices. Meanwhile, the equipment vendor assumed the IT provider managed security updates for network-connected systems. Neither organization intentionally ignored the vulnerability. Unfortunately, neither organization accepted responsibility for fixing it. The workstation remained vulnerable because nobody clearly defined who managed its security.

This situation highlights a common cybersecurity problem: Unclear responsibilities can leave your organization exposed to unnecessary risks. This example was a medical practice, however, business associates have the same responsibilities within their own network.

Medical Devices Can Create Hidden Cybersecurity Risks

Medical practices rely on more than desktop computers and electronic health record systems. Many medical devices connect directly to the practice’s network and may store, process, or transmit electronic Protected Health Information (ePHI).

These devices may include:

Imaging workstations and diagnostic equipment
Digital X-ray machines
Ultrasound systems
Laboratory analyzers
Patient monitoring equipment
Network-connected printers and scanners
Medical equipment using embedded operating systems

Each connected device can introduce cybersecurity risks when organizations fail to maintain appropriate safeguards. Some medical devices also use outdated operating systems that manufacturers no longer support. Others require manufacturer approval before installing security patches. These restrictions make clearly assigned security responsibilities even more important.

HIPAA does not explicitly require every device to receive every available patch.

However, organizations must evaluate known vulnerabilities and determine appropriate security measures. A medical device containing ePHI cannot simply fall outside the practice’s security program because a vendor manages it. The practice must understand its risks and document appropriate protections.

Medical practices and business associates should take several important steps to identify and address vulnerabilities.

1. Maintain a Complete Asset Inventory

Identify every device connected to the network, including medical equipment, workstations, servers, printers, and wireless devices. Document operating systems, software, and vendors.

2. Assign Responsibility for Security Updates

Clearly identify who manages security updates for each device. Document whether the responsibility belongs to IT, the equipment manufacturer, another vendor, or the practice.

3. Review Vendor Agreements

Determine whether existing contracts address software updates, vulnerability management, security monitoring, and incident reporting. Never assume a vendor provides services that the agreement does not include.

4. Address Devices That Cannot Receive Updates

Some medical equipment cannot safely accept standard security patches. Organizations should evaluate compensating safeguards, including network segmentation, restricted access, and additional monitoring. Coordinate these protections with the manufacturer when necessary.

5. Document Findings and Corrective Actions

Record identified vulnerabilities, assigned responsibilities, planned safeguards, and remediation progress. Include unresolved risks in the practice’s Risk Management Plan. Review these records regularly and whenever significant changes occur.

The Real Problem Isn’t the Missing Patch

A missing patch creates vulnerability. However, unclear responsibilities can allow vulnerabilities to remain unresolved. Neither the IT provider nor the equipment vendor deliberately neglects the device. Both assumed someone else handled it. This simple misunderstanding can expose patient information and disrupt essential medical services.

Every device needs an owner, and every security responsibility needs clear documentation.

Ask your IT provider one important question:

“Who handles security updates for every device on our network, including medical equipment?”

Then ask your vendors the same question.

If their answers differ, your practice may have an important security gap.

Identifying these gaps now can help prevent costly security incidents later.

When was the last time your organization updated the asset list?

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Your Trusted Partner for HIPAA Compliance since 2009

What are the Identified Risks in Healthcare Data Breaches?

Suze Shaffer October 29, 2026November 2, 2026

Vendor Risk Is the New Front Line

Healthcare organizations continue to report substantial data breaches in 2026. Hacking and IT incidents dominate reports to the HHS Office for Civil Rights (OCR). Large breach reports have eased slightly compared with 2025. However, third-party vendors and business associates continue to concentrate risk across healthcare.

The Healthcare Breach Landscape

During the first half of 2026, organizations reported 397 large healthcare breaches to OCR. These incidents affected approximately 33.8 million individuals. Although those figures declined from the previous year’s first half, they still represent substantial exposure.

Business associates played a role in approximately 43% of large breach reports. Hacking and IT incidents accounted for most cases. Several incidents illustrate how vendors, applications, and shared technology can expose patient information.

Notable 2026 examples illustrate the pattern:

DentaQuest

A May 2026 cyber incident affected approximately 15 million individuals connected to DentaQuest, a Sun Life subsidiary. The ShinyHunters extortion group claimed responsibility for the incident. The compromised information included names, addresses, Social Security numbers, and Medicare or Medicaid identifiers. It also included dental or vision information, such as diagnoses, treatment details, and billing records. DentaQuest began notifying individuals in July after the group reportedly leaked data following failed negotiations.

iRhythm Technologies

A June 2026 incident affected approximately 8.18 million people connected to iRhythm Technologies. Attackers used social engineering to access business applications hosted by third parties. The incident did not involve clinical systems or medical devices. The exposed information included names, contact details, birth dates, insurance numbers, account identifiers, serial numbers, and service dates. The company began notifications in October. At that time, it reported no evidence of identity theft.

Blueberry Pediatrics

An incident involving Blueberry Pediatrics affected approximately 341,000 individuals, including children. Attackers exploited a vulnerability in Metabase, a business intelligence and reporting tool. A related incident involving prescription partner Photon stemmed from the same vulnerability. The exposed information included names, birth dates, health plan details, and certain medical and billing information. Blueberry Pediatrics discovered the incident in August 2026 and began notifications in October.

Earlier Breaches Continue to Create Financial Consequences

Conduent’s 2024–2025 breach affected approximately 62.2 million individuals. The incident recently prompted an $80 million class-action settlement agreement.

Change Healthcare’s 2024 ransomware attack remains the largest reported healthcare breach, affecting approximately 192.7 million individuals.

These incidents show how one organization’s security failures can affect patients and healthcare partners nationwide.

OCR Continues to Prioritize Risk Analysis

OCR continues its Risk Analysis Initiative. Recent settlements repeatedly identify failures to conduct accurate and thorough risk analyses under the HIPAA Security Rule. The requirement appears at 45 CFR § 164.308(a)(1)(ii)(A). Several 2026 settlements highlight these recurring weaknesses.

Ambry Genetics

OSF HealthCare System

OSF HealthCare System agreed to a $552,250 settlement involving a ransomware incident affecting approximately 54,000 individuals. OCR identified failures involving risk analysis, impermissible disclosures, and breach notification.

Spencer Gifts LLC

Spencer Gifts LLC agreed to a $450,000 settlement involving its employer-sponsored health plan after a ransomware attack. The case demonstrates that HIPAA obligations can extend beyond traditional healthcare providers.

Patient Access Still Drives Enforcement

OCR also continues its Right of Access Initiative. Shen Smiles, a Pennsylvania dental practice, agreed to a $140,000 settlement involving delayed patient access to records. OCR also identified related Privacy Rule deficiencies. The case reinforces a critical point: organizations can face HIPAA enforcement without experiencing a cyberattack.

What These Cases Mean for Healthcare Organizations

Vendor oversight requires ongoing attention.

Business associates, cloud applications, reporting tools, and billing partners create additional opportunities for unauthorized access. Identify which vendors create, receive, maintain, or transmit protected health information. Evaluate their safeguards and document your oversight. Address your organization’s HIPAA responsibilities when vendors handle patient information.

Risk analysis must reflect actual operations

An incomplete or outdated assessment can overlook significant threats. Include third-party applications, connected devices, remote access, and every location that stores or processes electronic protected health information. Evaluate phishing, social engineering, ransomware, and vendor vulnerabilities. Document identified risks, assign responsibility, and track corrective actions.

Contracts and notification procedures need clear ownership

Business associate agreements should clearly define incident reporting duties and applicable responsibilities. Organizations must also understand their own patient and OCR notification obligations. Practice your response before an incident forces urgent decisions.

Financial consequences extend beyond regulatory settlements

Breaches can trigger class action lawsuits, state investigations, operational disruptions, and substantial recovery expenses. Organizations may also pay for forensic investigations, notifications, monitoring, and system restoration. Patient trust can take much longer to rebuild.

Five Actions to Take Now

Update your risk analysis. Include third-party systems, current threats, and changes in your operations.
Review high-risk vendors. Request meaningful evidence of security controls and evaluate how those safeguards protect your information.
Test your incident response procedures. Confirm reporting contacts, notification timelines, decision responsibilities, and procedures for vendor incidents.
Strengthen patient access procedures. Train staff to recognize requests, track deadlines, document responses, and escalate delays.
Review cyber insurance. Examine coverage limits, vendor-related incidents, exclusions, and policy conditions with your insurance professional.

Attackers exploit weaknesses throughout the healthcare ecosystem. OCR continues to evaluate organizations against core HIPAA requirements.

Organizations that treat risk analysis, vendor management, and incident response as continuous disciplines, not annual checkboxes, will be better positioned as these trends evolve.

This article is for informational purposes only and does not constitute legal advice. Organizations should consult qualified counsel regarding specific compliance obligations.

When was the last time your organization updated its HIPAA security risk analysis?

Aris Medical Solutions can help you identify compliance gaps and prevent costly data breaches.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Your Trusted Partner for HIPAA Compliance since 2009

Is Your Medical Practice Prepared for the Cybersecurity Threats that are Increasing?

Suze Shaffer October 28, 2026October 28, 2026

New cybersecurity statistics reveal why healthcare organizations must strengthen their security safeguards.

Cybercriminals continue to target healthcare organizations, regardless of their size. Small medical practices, dental offices, and business associates face many of the same threats as larger healthcare systems.

The 2026 Verizon Data Breach Investigations Report highlights growing cybersecurity risks and the importance of basic security safeguards. The report analyzed more than 31,000 security incidents and 22,000 confirmed data breaches worldwide. These findings demonstrate why healthcare organizations must take cybersecurity seriously.

31% of Data Breaches Begin with Exploited Vulnerabilities

Cybercriminals frequently exploit weaknesses in software, networks, and security configurations. Verizon reports that vulnerability exploitation accounted for 31% of breaches in its 2026 analysis. This finding reinforces the importance of identifying and correcting security weaknesses before attackers exploit them. Healthcare organizations should conduct regular vulnerability assessments, install security patches, and review system configurations. However, vulnerability assessments alone do not satisfy HIPAA’s Security Risk Analysis requirements. Organizations must evaluate threats, vulnerabilities, existing safeguards, and potential risks to patient information. A comprehensive HIPAA Security Risk Analysis helps organizations identify risks to electronic Protected Health Information (ePHI).

48% of Data Breaches Involve Ransomware

Ransomware remains one of the most serious cybersecurity threats facing healthcare organizations. Verizon found ransomware involvement in 48% of confirmed breaches analyzed in its 2026 report. These attacks can encrypt medical records, interrupt patient care, and disrupt daily operations. Healthcare organizations must prepare for more than restoring computer systems. They need documented contingency plans that address emergency operations, data recovery, and system restoration. Regular backups, recovery testing, and employee training help organizations prepare for ransomware attacks. A disaster recovery plan should identify critical systems, recovery priorities, and responsible personnel. A written plan provides little protection unless the organization tests it and maintains it.

Only 26% of Known Exploited Vulnerabilities Were Fully Remediated

Identifying security weaknesses represents only the first step toward protecting patient information. Verizon reported that organizations fully remediated only 26% of tracked, known exploited vulnerabilities during 2025. The median time to resolve these vulnerabilities increased from 32 days to 43 days. These findings highlight a dangerous gap between identifying security risks and correcting them. Medical practices should maintain documented procedures for identifying, prioritizing, and correcting security vulnerabilities.

A Risk Management Plan helps organizations assign responsibilities, establish deadlines, and track corrective actions. HIPAA compliance requires organizations to address identified risks, not simply document their existence.

48% of Data Breaches Involve Third Parties

Healthcare organizations depend on outside vendors to manage technology, billing, records, and other essential services. Unfortunately, these relationships can introduce additional cybersecurity risks. Verizon found that third parties played a role in 48% of breaches analyzed in its 2026 report. Third-party breach involvement also increased significantly compared with the previous reporting period. Medical practices should evaluate the security practices of vendors that access, process, or store patient information.

A signed Business Associate Agreement establishes important legal responsibilities, but it does not guarantee adequate cybersecurity protection. Organizations should review vendor safeguards, incident reporting procedures, access controls, and subcontractor relationships. Regular vendor oversight helps identify weaknesses before they expose patient information.

Artificial Intelligence Creates New Security Challenges

Artificial intelligence offers healthcare organizations opportunities to improve efficiency and streamline administrative tasks. However, unauthorized AI tools can introduce significant privacy and security risks. Verizon reported that regular employee AI use on corporate devices increased from 15% to 45%. This figure includes authorized and unauthorized AI use. The report also identified unauthorized AI activity as a growing source of potential data exposure. Employees may unknowingly expose confidential information by entering sensitive data into unapproved AI applications. Healthcare organizations should establish clear AI policies and train employees on acceptable use. They should also evaluate AI vendors before allowing access to patient information. When applicable, organizations must obtain Business Associate Agreements and implement appropriate safeguards.

Basic Cybersecurity Safeguards Make a Difference

Healthcare organizations do not need to wait for a cyberattack to strengthen their defenses. They can reduce cybersecurity risks by implementing and maintaining essential safeguards.

These safeguards include:

Conducting comprehensive Security Risk Analyses.
Developing and updating Risk Management Plans.
Maintaining an asset list and include how data flows through your network.
Performing vulnerability assessments and applying security patches.
Implementing multifactor authentication and appropriate encryption.
Maintaining secure system configurations and access controls.
Training employees to recognize phishing and other cyber threats.
Reviewing Business Associate and vendor security practices.
Developing and testing contingency and disaster recovery plans.
Monitoring system activity and investigating suspicious behavior.
Establishing policies for artificial intelligence and sensitive information.

These actions help organizations protect patient information and maintain essential healthcare operations.

HIPAA Compliance Is More Than Checking a Box

Many healthcare organizations mistakenly believe that purchasing cybersecurity software satisfies their HIPAA obligations. However, technology represents only one component of an effective HIPAA compliance program. Organizations must also establish policies, train employees, evaluate risks, and document corrective actions.

A comprehensive compliance program combines administrative, physical, and technical safeguards. The HIPAA Security Rule requires covered entities and business associates to protect electronic patient information. These requirements apply regardless of an organization’s size.

Small practices cannot assume that cybercriminals will overlook them.

The Bottom Line: Prevention Costs Less Than Recovery

A cybersecurity incident can create significant financial, operational, and reputational consequences. Medical practices may face business interruptions, recovery expenses, regulatory investigations, and damaged patient trust.

Although no security program can eliminate every threat, proactive safeguards can significantly reduce risks. Healthcare organizations should focus on preventing incidents while preparing to respond when something goes wrong.

Protecting patient information is not a one-time project. It requires continuous attention, documented safeguards, and ongoing risk management.

The question is not whether your organization can afford cybersecurity.

The question is whether your organization can afford the consequences of inadequate protection.

When was the last time your organization updated its HIPAA security risk analysis?

At Aris Medical Solutions, our HIPAA Keeper™ cloud-based platform makes HIPAA compliance simple. It guides your organization through every requirement with a clear, step-by-step process. From risk analyses, risk management, policies to employee training and required documentation, you’ll have everything needed to remain compliant, protected, and audit-ready. Best of all, your HIPAA Compliance Officer is never on their own. Every client has access to a Certified HIPAA Security Analyst who provides expert guidance, answers questions, and helps ensure your compliance program is implemented correctly.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Your Trusted Partner for HIPAA Compliance since 2009

Sources

Verizon, 2026 Data Breach Investigations Report.
Verizon, 2026 DBIR Healthcare Industry Snapshot.
Center for Internet Security, CIS Controls and MS-ISAC Insights Featured in Verizon’s 2026 Data Breach Investigations Report.

Note: The reported percentages reflect different datasets and measures. They do not represent breach rates for all medical practices.

OIG Exclusion List vs. CMS Preclusion List: What Medical Practices Need to Know

Suze Shaffer October 26, 2026October 26, 2026

Medical practices must understand the differences between the OIG Exclusion List and the CMS Preclusion List. Both programs help protect federal healthcare programs from fraud, abuse, and improper payments. However, each program serves a different purpose and carries different consequences.

Understanding the OIG Exclusion List

The Department of Health and Human Services (HHS) Office of Inspector General (OIG) maintains the List of Excluded Individuals/Entities (LEIE).

The OIG uses this list to identify individuals and organizations excluded from participating in federal healthcare programs. These programs include Medicare, Medicaid, and other federally funded healthcare programs.

The list may include physicians, nurses, administrative employees, contractors, vendors, and healthcare organizations.

The OIG may exclude individuals or organizations for several reasons, including:

Healthcare fraud and certain criminal convictions.
Patient abuse or neglect.
Certain professional licensing violations.
Other violations that qualify for exclusion under federal law.

Federal healthcare programs generally cannot pay for services or items furnished by excluded individuals or entities.

Medical practices can search the OIG database to verify exclusion status. Practices should screen employees, providers, and relevant contractors before engagement and monthly thereafter.

Monthly screening helps practices identify exclusions and reduce financial and regulatory risks.

Understanding the CMS Preclusion List

The Centers for Medicare & Medicaid Services (CMS) maintains the CMS Preclusion List.

CMS uses this list to identify providers and prescribers who meet specific Medicare preclusion criteria.

The list primarily affects Medicare Advantage (Part C) and Medicare Part D prescription drug coverage.

CMS may place providers or prescribers on the list for several reasons, including:

Revocation of Medicare enrollment under qualifying circumstances.
Certain felony convictions.
Conduct that meets CMS preclusion criteria.

Medicare Advantage plans generally cannot pay for healthcare items or services furnished by providers on the Preclusion List. Medicare Part D plans must also reject covered prescriptions from precluded prescribers, subject to applicable requirements.

Unlike the OIG database, CMS does not provide a publicly searchable Preclusion List.

Instead, CMS distributes the list to applicable Medicare Advantage and Part D organizations. These organizations must review the list and apply the required payment restrictions.

Why Medical Practices Must Understand Both Lists

The OIG Exclusion List affects participation and payments across multiple federal healthcare programs. The CMS Preclusion List focuses primarily on Medicare Advantage payments and Medicare Part D prescriptions.

An individual may appear on one list without appearing on the other.

Medical practices should establish screening procedures that address applicable federal and state requirements.

Regular screening helps practices identify potential compliance concerns before they create costly problems.

Protecting your practice requires more than checking employee credentials.

It also requires verifying eligibility to participate in federal healthcare programs.

By understanding both lists, medical practices can strengthen compliance efforts, reduce financial risks, and protect their organizations.

Does your organization have a process in place to manage your documentation?

Aris Medical Solutions can help you identify compliance gaps and prepare for upcoming changes.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Your Trusted Partner for HIPAA Compliance since 2009

HIPAA Security Rule Updates: Postponed, But Not Canceled!

Suze Shaffer October 19, 2026October 20, 2026

Healthcare practices have more time to prepare, but HIPAA enforcement has not stopped.

The proposed HIPAA Security Rule updates remain on hold until July 2027, giving healthcare organizations additional time to strengthen their cybersecurity safeguards. This date is still tentative, but organizations should use this time wisely.

However, delays do not eliminate existing HIPAA requirements or reduce an organization’s responsibility to protect patient information.

The Department of Health and Human Services (HHS) continues to enforce the current HIPAA Security Rule.

Medical practices, dental offices, and business associates should use this additional time wisely.

Waiting for the final rule could leave your organization vulnerable to cyberattacks, data breaches, and costly enforcement actions.

What Is Changing Under the Proposed Security Rule?

HHS proposed significant changes to strengthen cybersecurity protections across the healthcare industry.

The proposed updates would remove the distinction between “required” and “addressable” implementation specifications and make all implementation specifications with specific security requirements and reduce flexibility in certain areas.

Although these changes are not final, they provide a clear picture of federal cybersecurity priorities.

1. Multifactor Authentication (MFA)

The proposal would require multifactor authentication for accessing systems containing electronic protected health information (ePHI), with limited exceptions. MFA adds another layer of protection when criminals steal or compromise passwords. Organizations should prioritize MFA for email, remote access, administrative accounts, and systems containing patient information.

2. Stronger Encryption Requirements

The proposal would generally require encryption of ePHI at rest and during transmission, subject to limited exceptions. Encryption helps protect sensitive information when criminals steal devices or intercept electronic communications. Organizations should review encryption settings across computers, servers, mobile devices, cloud platforms, and backup systems.

3. Technology Asset Inventories and Network Maps

The proposed updates would require organizations to maintain technology asset inventories and network maps and review and update at least every 12 months. These documents would identify systems, devices, applications, and connections involving ePHI. Accurate inventories help organizations identify vulnerabilities, unauthorized connections, and outdated technology. Network maps should also identify third-party connections and systems that process patient information, including AI.

4. More Comprehensive Security Risk Analyses

The current Security Rule already requires organizations to conduct an accurate and thorough security risk analysis. The proposal would establish more detailed requirements for identifying threats, vulnerabilities, and potential risks to ePHI. Organizations must also address identified risks through appropriate security measures. A completed questionnaire alone does not demonstrate that an organization has addressed its security vulnerabilities.

5. Enhanced Audit Controls and Monitoring

The proposed updates would strengthen requirements for monitoring electronic systems and reviewing activity involving ePHI. Organizations should maintain audit logs that help identify unauthorized access, suspicious activity, and potential security incidents. Regular reviews can reveal unusual behavior before a minor incident becomes a significant breach.

6. Vulnerability Scanning and Penetration Testing

The proposal would establish specific vulnerability scanning and penetration testing requirements. Vulnerability scanning helps identify weaknesses in software, devices, and network configurations. Penetration testing evaluates whether attackers could exploit security weaknesses. Organizations should already evaluate their exposure to cybersecurity threats and implement appropriate safeguards. Require regulated entities to conduct a compliance audit at least once every 12 months to ensure their compliance with the Security Rule requirements.

7. Stronger Backup and Disaster Recovery Protections

The proposed updates would strengthen contingency planning, backup verification, and recovery testing requirements. Healthcare organizations must prepare for ransomware attacks, system failures, natural disasters, and other emergencies. Regular testing helps confirm that organizations can restore critical information and continue essential operations. Establish written procedures to restore the loss of certain relevant electronic information systems and data within 72 hours.

8. Greater Oversight of Business Associates

Business associates already have direct HIPAA Security Rule responsibilities when handling ePHI. The proposal would add specific requirements involving written verification of technical safeguards. Covered entities should verify that vendors maintain appropriate security protections rather than relying solely on signed agreements. A qualified subject expert must review relevant electronic information systems to confirm that required safeguards protect ePHI. The business associate or subcontractor must provide written certification confirming the expert completed an accurate analysis. Business associates must provide this verification to covered entities, while subcontractors must provide it to their business associates. This includes IT providers, billing companies, cloud vendors, and other organizations accessing patient information. The proposed Security Rule would require business associates and their subcontractors to verify their technical safeguards at least annually.

The current HIPAA Security Rule remains enforceable, regardless of the proposed updates.

What Medical Practices and Business Associates Must Do Today

Organizations must continue implementing appropriate administrative, physical, and technical safeguards.

These responsibilities include:

Conducting accurate and thorough security risk analyses.
Implementing risk management measures to address identified vulnerabilities.
Maintaining current HIPAA policies and procedures.
Training employees on their security responsibilities.
Establishing appropriate access controls and audit controls.
Protecting workstations, devices, networks, and electronic patient information.
Maintaining security incident response and contingency plans.
Evaluating business associates and maintaining required agreements.
Reviewing security safeguards when systems, technology, or business operations change.

Organizations must document their compliance efforts and maintain evidence supporting their security decisions.

Why Waiting Could Cost Your Organization

Cybercriminals do not wait for federal regulations to become final. They continue targeting healthcare organizations through phishing, ransomware, compromised credentials, and vulnerable systems.

Smaller medical and dental practices are not immune to these threats. Business associates are also targeted to gain access to a medical practice.

A single security incident can interrupt patient care, expose sensitive information, and create significant financial consequences.

A postponed regulation does not mean postponed responsibility.

Organizations that prepare now can reduce risks while avoiding rushed compliance efforts when new requirements take effect.

**How the HIPAA Keeper™ Helps You Prepare**

At Aris Medical Solutions, we believe HIPAA compliance should be manageable, organized, and ongoing. Our HIPAA Keeper™ platform helps medical practices and business associates maintain essential compliance documentation.

The platform includes security risk analyses, risk management plans, policies, employee training, business associate agreements, and incident response documentation. Our program also helps organizations track compliance activities and prepare documentation for regulatory reviews.

As regulations evolve, we help clients understand new requirements and update their compliance programs.

HIPAA compliance is not a one-time project. It requires continuous attention, documentation, and improvement.

Don’t Wait for the Final Rule!

The proposed HIPAA Security Rule updates may be postponed, but the need for stronger cybersecurity protections remains.

Use this additional time to evaluate your safeguards, address vulnerabilities, and strengthen your compliance documentation.

When was the last time your organization updated its HIPAA security risk analysis?

Aris Medical Solutions can help you identify compliance gaps and prepare for upcoming changes.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Your Trusted Partner for HIPAA Compliance since 2009

Regulatory sources

For publication, these official references support the article:

FTC $20M Fine Highlights the Risk of Using AI without Verification

Suze Shaffer October 9, 2026October 10, 2026

$20 Million Settlement Highlights Risks of False Medical Billing and AI-Generated Documentation

DOJ Settlement: $20 Million, Including $10 Million in Restitution

The U.S. Department of Justice (DOJ) announced a $20 million settlement involving Heal 360 urgent-care and primary-care clinics. The settlement resolves allegations that the clinics submitted fraudulent claims for COVID-19 testing services.

The DOJ alleged that Heal 360 billed a federal COVID-19 program for medical services the clinics never performed.

Patients reportedly received only COVID-19 specimen collection services. However, the clinics billed higher-level evaluation and management (E/M) codes, including 99203, 99204, 99213, and 99214.

These codes represented more extensive medical services than patients allegedly received.

How Medical Documentation Contributed to the Alleged Fraud

The DOJ identified several practices that raised serious concerns about billing accuracy and medical record integrity.

According to the allegations:

False Medical Records: Staff used electronic templates to document examinations and medical services that never occurred.
Remote Scribes: Overseas remote scribes entered information into patient records, including documentation supporting services the clinics allegedly never provided.
Incorrect Rendering Providers: The clinics identified a physician as the rendering provider on most claims, despite no patient examination or treatment.
Improper Billing: The clinics submitted hundreds of thousands of claims using higher-level E/M codes instead of appropriate collection codes.

These allegations highlight the importance of accurate medical documentation, proper coding, and provider oversight.

What This Means for Healthcare Providers

This settlement raises important concerns for medical practices, urgent-care centers, billing companies, coding vendors, and remote-scribe services.

Organizations using electronic templates or AI-assisted documentation should pay particular attention.

Technology can simplify medical documentation, but providers must verify that every record accurately reflects the services performed.

AI-generated notes and automated templates do not eliminate the provider’s responsibility for accurate documentation and billing.

Steps Healthcare Organizations Should Take Now

Healthcare organizations should review their documentation and billing procedures to reduce compliance risks.

Verify Billing Accuracy: Compare billed E/M codes against the services performed and documented.
Audit Medical Records: Review templated and copied notes for examinations, patient histories, or medical decisions that never occurred.
Confirm Provider Responsibility: Require rendering providers to review and authenticate documentation supporting their claims.
Review AI and Remote-Scribe Documentation: Verify the accuracy of AI-generated notes and information entered by remote scribes.
Monitor Billing Vendors: Ensure billing companies select codes based on documented services, not automatically populated template fields.
Address Overpayments: Investigate potential billing errors and promptly correct and return identified overpayments when required.
Maintain Audit Trails: Preserve records identifying who created, reviewed, modified, and authenticated each medical note.

AI Documentation Creates New Compliance Responsibilities

Healthcare organizations increasingly rely on AI, remote scribes, and electronic templates to improve efficiency.

These technologies can reduce administrative workloads, but they also introduce documentation and compliance risks.

Providers must ensure that automated records accurately reflect each patient’s encounter.

A completed medical record does not prove that a documented service actually occurred.

Organizations should establish clear policies for reviewing AI-generated documentation, verifying clinical accuracy, and maintaining accountability.

The Bottom Line

This settlement does not prohibit healthcare organizations from using remote scribes, electronic templates, or AI-assisted documentation.

However, electronically generated records can become evidence in False Claims Act investigations when they misrepresent services.

Healthcare providers must maintain accurate records, verify billing codes, and ensure that documentation supports every submitted claim.

Remember: Technology can assist with documentation, but it cannot replace provider accountability.

The defendants deny the allegations, and the settlement does not establish liability.

Source: U.S. Department of Justice – Heal 360 $20 Million Settlement

Contact Aris Medical Solutions for a complimentary HIPAA compliance consultation.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Hurricane Preparedness

Suze Shaffer October 8, 2026October 10, 2026

For those of you in the path of this storm here are some guidelines to prepare for a hurricane.

Prep your office

Print your Contingency Plan or have it available in an alternate location. Make sure you have your emergency contact list that includes vendors you may need.
Take your inventory list with you, if possible, take pictures of all equipment with serial and model numbers. You may need this for an insurance claim.
If necessary, create a backup and take it with you. Secure it if it is not encrypted.
Print out patient schedules, in case of internet outage.
Print out your manual forms/procedures in case systems are down. Place in plastic tubs.
Shut down servers and workstations properly and disconnect power (contact your IT vendor to advise them you are shutting down). This includes firewalls / switches / printers / scanners, etc. Place equipment on a desk and cover with plastic bags or place them in plastic tubs if you are not taking them with you. If you have a rack system, place large garage bags over the racks and secure.
Remove laptops / external hard drives / software installation disks / operating system disks. There is nothing worse than trying to reload a server or workstations operating system and software and not be able to find the discs. Be sure to label them before removing them so you know where to return them to. Be sure to shut laptops down to engage encryption (if encryption is activated). Secure external hard drive and media. Be sure the person taking the equipment is not in the path of the storm, or travel as far inland as possible.
Move any equipment away from windows if possible. If you are expecting a storm surge, it is recommended to take as much of your equipment with you as possible. It would be a good idea to identify who carries servers like yours and note the lead times in case you have to buy a new one.
Move anything of value OFF the floor in case of flooding. Place it in plastic tubs.
It may be necessary to turn off the main breaker as well.

Prep your home

Make extra ice or fill empty containers and freeze them. This can be used to keep your refrigerator and/or freezer cooler longer.
Fill the cooler with ice. If you lose power, put the items that you use the most to prevent opening your refrigerator.
Make sure all devices and portable chargers are charged.
Have battery powered lights or flashlights on hand (extra batteries as well).
Important papers, including insurance policies should be stored in the cloud or in a waterproof container.
Have a container ready with medications, water, and food for at least 3-5 days.
If you have a generator, be sure to test it and have additional fuel on hand.
Heavy items and furniture, such as a patio table, may be turned on their sides or upside down to help prevent it from being caught by the wind and tossed about the patio.
Potted plants – even small pots can become dangerous projectiles in hurricane strength winds; therefore, they should be removed.
Patio umbrellas – close them and remove them from stands and/or patio tables. A gust of wind can send an open umbrella flying through your screen enclosure.
Flagpoles – remove flags, and lower or remove pole, if possible.
Decorative items – store them safely inside your home or garage to ensure protection from water damage.
Enclosed swimming pool – Pool builders recommend leaving water in your pool during a hurricane or strong storm but adding more chlorine to reduce storm water contamination. Your pool may overflow but will be less likely to be damaged by the storm and/or debris that may fall into it. Most importantly, cover outdoor electrical devices with appropriate waterproof material to reduce the risk of damage.

This should be reviewed each year

Overhanging trees, cut back limbs, remove decaying branches, trim off weak limbs and loose leaves. Pay extra attention to any trees or shrubs that are close to your home and especially your patio area and screen enclosure or pool.

Stay safe and watch for downed power lines. These can be deadly!

NIST OCR conference highlights

Suze Shaffer September 4, 2026

HIPAA Risk Analysis Is More Than a Checklist

The message from the NIST OCR conference was clear: a HIPAA risk analysis is not a checklist. It must be comprehensive, accurate, and specific to your organization. Once a thorough and accurate risk analysis is completed, then the mitigation process must be documented. Again, not simply a checklist.

Where is ePHI?

The risk analysis must identify every location where electronic protected health information (ePHI) is created, received, maintained, or transmitted. This includes EHR systems, email, mobile devices, cloud applications, medical equipment, patient portals, billing platforms, databases, websites, backups, and third-party vendors.

Medical practices must map how ePHI flows into, throughout, and outside their systems. This data-flow mapping helps identify unauthorized access, transmission, storage, and disclosure risks that a simple checklist may overlook.

Risk Management

Identifying vulnerabilities is only the beginning. The practice must maintain a documented risk management plan that:

Prioritizes identified risks
Lists the corrective actions taken
Assigns responsibility
Establishes completion dates
Demonstrates how each vulnerability was mitigated
Documents any remaining risk the organization accepts

What is NOT a Risk Analysis?

Several security assessments can support the process, but they do not replace an SRA:

A penetration test is useful, but it is not an SRA.
A vulnerability scan is useful, but it is not an SRA.
A gap analysis is helpful, but it is not an SRA.
Completing the HHS SRA Tool does not create a compliant risk analysis if questions are unanswered or marked “Don’t Know.”

Another common problem is leaving the physical safeguards section incomplete. An SRA must evaluate administrative, physical, and technical safeguards and not just cybersecurity controls.

Integrating AI

Before adding an AI tool to a medical practice, the organization should complete the proper privacy, security, and compliance review. Determine whether the AI vendor will access, store, or transmit ePHI. Understand where the data is stored and whether it is used to train AI models. Update the organization’s risk analysis and data-flow map. Establish user access controls, authentication, encryption, and audit logging. Whether ePHI will be shared with third party vendors. Create policies for appropriate AI use and human review. Once this is outlined, then the organization must:

Develop procedures for errors, security incidents, and potential breaches
Train employees on privacy risks and prohibited uses
Obtain a Business Associate Agreement
Address patient consent and state-law requirements when applicable

AI can improve efficiency, but it should not be integrated until the practice understands how patient information will be handled and has documented safeguards in place.

Breach Notification

The breach notification clock starts when the breach is discovered, not when the investigation is completed. An organization should not delay the required notification solely because the final number of affected individuals is unknown. File the initial breach report within the applicable deadline using the best information available, and submit an addendum when the investigation confirms the affected-record count or provides additional details. Be sure to follow state law requirement if they are more stringent.

FTC and HIPAA

The FTC does not enforce HIPAA. That responsibility belongs to HHS’s Office for Civil Rights (OCR). However, the FTC can intervene when a healthcare organization’s conduct involves an unfair or deceptive business practice under the FTC Act. A provider could face FTC scrutiny if it misrepresents how patient information is protected. For example, the practice has a “Seal of HIPAA Compliance” on their website and fails to use reasonable security safeguards. The use of online trackers may be sharing health information with advertising or tracking companies contrary to their privacy promises. Therefore, HIPAA compliance does not automatically protect an organization from FTC enforcement. The FTC’s separate Health Breach Notification Rule (HBNR) generally applies to health apps, personal health-record vendors, and related businesses that are not regulated by HIPAA; in some situations, an organization with both HIPAA-regulated and consumer-facing operations may have obligations under both regulatory frameworks.

Summary

The NIST OCR conference clarified the HIPAA compliance requirements. It is crystal clear that more enforcement in on the way due to the increased data breach activity and the lack of documented compliance efforts. They even specifically mentioned that even small providers are required to implement reasonable and appropriate safeguards. No provider is immune from investigations and enforcement.

Protect Your Organization and Your Patients Before It’s Too Late

At Aris Medical Solutions, our HIPAA Keeper™ cloud-based platform makes HIPAA compliance simple. It guides your organization through every requirement with a clear, step-by-step process. From risk analyses and policies to employee training and required documentation, you’ll have everything needed to remain compliant, protected, and audit-ready. Best of all, your HIPAA Compliance Officer is never on their own. Every client has access to a Certified HIPAA Security Analyst who provides expert guidance, answers questions, and helps ensure your compliance program is implemented correctly.

Schedule a free HIPAA checkup today at Aris Medical Solutions.