One Guy Consulting offers a HIPAA compliance and cybersecurity SaaS that helps healthcare practices meet regulations and protect patient data. This blog gives practical HIPAA compliance and cybersecurity guidance for practice managers and clinicians with actionable steps to reduce risk.
Find the gaps before OCR does.
Book your free 30-minute review205 articles published
11 min read
Some med spas must follow HIPAA and some do not. The test is electronic insurance transactions, not Botox, a medical director or cash.
A medical spa compliance program starts with one test: HIPAA covers a med spa only if it sends health data electronically for a covered transaction.
8 min read
Abyde, Accountable and One Guy Consulting compared for dental offices: what each includes and what each costs, checked November 3, 2026.
15 min read
A fax can be intercepted at the phone line, the VoIP connection, the e-fax server and the receiving tray. Here is what each point takes to reach, which HIPAA rule applies, and what to fix first.
Can faxes be intercepted? Yes, at four points. Where a fax is exposed, which HIPAA rule applies to it, and what to fix first.
9 min read
A vulnerability scan lists known flaws; a penetration test proves which ones can be used. What each delivers, what it asks of your office, and which a small practice should do first.
8 min read
Outdated browsers, old Office builds, end-of-life Windows and forgotten remote access tools turn up again and again. Here is what each means and the order to fix them.
9 min read
Old, unpatched software is one of the easiest ways into a practice. What the Security Rule says, what OCR has said in its own words, and a patch routine a small office can keep.
9 min read
HIPAA does not name vulnerability scans yet, but your risk analysis needs proof. What the rule says now, what the 2025 proposal adds, what to keep.
A HIPAA vulnerability scan is not required yet. The proposed Security Rule would require scans every six months, annual penetration tests, and MFA.
14 min read
Business email can be used for client information when the provider signs a BAA and you set it up. Here is how a therapist tells which applies, and where to go if not.
HIPAA compliant email for therapists starts with one question: will your provider sign a BAA that covers mail? If not, switch. If so, configure it.
10 min read
Attackers posted Concord Eye Center's name on October 12, and attorneys were seeking patients a day later. Here is what to have ready before day one.
The Concord Eye Center breach moved faster than the investigation: a leak-site post one day, attorneys the next. Three things to have ready before your day one.
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
HIPAA (the Health Insurance Portability and Accountability Act) protects PHI (protected health information). The HHS Office for Civil Rights (HHS OCR) enforces it, and NIST and ONC (HealthIT.gov) publish the security guidance most posts cite.
A risk assessment (a documented review of where electronic PHI lives and what could compromise it) is required by 45 CFR 164.308(a)(1)(ii)(A).
Written policies are required and must be kept six years (164.316(b)(2)(i)). A BAA (Business Associate Agreement) is the contract every PHI vendor signs.
Breach reporting runs on a federal clock: patients within 60 calendar days of discovery, and HHS at the same time when 500 or more people are affected (164.404(b), 164.408).
"Except as provided in § 164.412, a covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach."
(HHS, 45 CFR 164.404(b))
Every workforce member must be trained, management included (164.530(b), 164.308(a)(5)(i)).
Access control (unique logins and role-based limits on who can open which records, 164.312(a)(1)) and encryption decide whether a common tool is safe for PHI.
Penalty ceiling: civil money penalties reach $2,190,294 per calendar year for identical violations under the 2025 inflation adjustment (45 CFR 102.3).
The HIPAA start-here guide walks a practice through the first steps, beginning with the risk assessment.
HHS proposed major HIPAA Security Rule changes, with a final rule targeted for July 2027 (proposed, not final). Take the free 2-minute 2027 readiness check and get your results by email.
HIPAA policy templates for small practices and the policy templates overview.
HIPAA audit-proof checklist, the HIPAA glossary (with a free PDF edition), and the HHS model business associate agreement provisions.
Book a free 30-minute intro call. Case example: a health group with more than 100 offices lifted take-up of its compliance program by about 17% (case 03).
One Guy Consulting offers a HIPAA compliance and cybersecurity SaaS solution for healthcare entities.
Practice managers, office managers, and clinicians seeking compliance and cyber guidance.
Contact One Guy Consulting or use the blog's 'Getting started' guides to request a demo.
Posts cite official guidance such as HHS OCR and NIST.
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.
