How the Security Rule plays out for different regulated entities, using HHS guidance and OCR enforcement cases: small practices, hospitals and health systems, health plans and their administrators, and imaging and diagnostic providers.
What the Security Rule realistically asks of a small practice: scalability, the free SRA Tool, HHS's small provider paper and HICP Volume 1, working with an MSP, and small-practice enforcement cases and amounts.
Security Rule issues OCR finds at hospitals and health systems: ransomware with data theft, insider access to records, activity review and audit controls, HICP practices for large organizations, and the 2024 to 2025 audits focused on hacking and ransomware.
Security Rule duties for health plans, group health plans and third-party administrators: plan document requirements for sponsors, the plan sponsor exception, and OCR cases against an employer plan, a public health plan and a plan administrator.
Security Rule risks in imaging and diagnostics shown by OCR cases: Internet-exposed PACS servers, ransomware on medical records systems, late breach notification, and the risk analysis and transmission security controls involved.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.