Data, privacy and safety · Module 109
🏥 Healthcare Cybersecurity and HIPAA™
For people who run, staff, advise, report on or advocate around clinics, hospitals, health plans and their vendors: 9 long lessons on who HIPAA covers, the Privacy Rule and 42 CFR Part 2, the Security Rule safeguards and the status of the proposed Security Rule update, how to do the risk analysis OCR expects, the Breach Notification Rule and the HHS breach portal, business associate agreements with cloud and AI vendors, medical device cybersecurity under FDA rules, OCR enforcement and hospital ransomware cases, and a small-clinic walkthrough from risk analysis to written policies, with sample policies. Rules stated as of October 28, 2026.
Read this first
This module is general education about health privacy and security rules and practices. It is not legal, compliance, audit, medical, insurance or engineering advice, and reading it creates no attorney-client, consulting or audit relationship. Reading or using any part of it, including the sample policies, does not make an organization compliant with HIPAA, 42 CFR Part 2, FDA rules or any standard. Rules, penalty amounts and deadlines change: every lesson states the rule version and the date it was checked, and you should check the regulator's current text (eCFR, the Federal Register, HHS and FDA) before relying on any point.
Safety: never change a clinical system, a medical device or a production network because of a web lesson. Involve the device maker, your clinical engineering or biomedical staff, your security lead and qualified engineers. Defensive content only: nothing here explains how to attack a system.
The high level view
Who this affects. Every health plan, health care clearinghouse and provider that bills electronically (from a one-doctor clinic to a hospital system and the state Medicaid program), and every vendor that handles patient information for them: billing companies, IT providers, cloud and backup services, transcription and AI scribe vendors, shredding companies. Patients are affected most of all: the 2024 Change Healthcare attack alone reached about 192.7 million people and stalled claims and prescriptions across the country.
The main rules, as of October 28, 2026.
- The HIPAA Privacy Rule (45 CFR Part 164, Subpart E): who may see and share health information, and patients' rights to their own records.
- The HIPAA Security Rule (45 CFR Part 164, Subpart C): administrative, physical and technical safeguards for electronic health information, starting with a written risk analysis. A major update was proposed on January 6, 2025 (90 FR 898); it is still only a proposal, listed by HHS as a long-term action with final action projected for July 2027.
- The Breach Notification Rule (45 CFR 164.400 to 164.414): notice to patients without unreasonable delay and within 60 days of discovery, plus HHS and, for large breaches, the media.
- 42 CFR Part 2 for substance use disorder treatment records, revised February 16, 2024, with compliance required since February 16, 2026.
- FDA's device cybersecurity law, section 524B of the Food, Drug, and Cosmetic Act, in effect since March 29, 2023, for connected medical devices.
- Enforcement by the HHS Office for Civil Rights (OCR) and state attorneys general, with civil penalties of up to $2,190,294 per calendar year for each violated requirement at the 2025 inflation-adjusted amounts.
The five things to do first.
- Do a real, written, organization-wide risk analysis, and act on what it finds (lesson 4). Its absence is one of the failures OCR cites most often.
- Turn on multi-factor authentication for email, remote access and the electronic health record, starting with any internet-facing login (lessons 3 and 9).
- Keep backups that ransomware cannot reach, and test restoring them (lessons 3 and 9).
- List every vendor that touches patient data, sign a business associate agreement with each, and control their remote access (lesson 6).
- Write down who does what in the first hour of a ransomware attack or a misdirected disclosure, and practice it, so the 60-day breach clock is met (lessons 5 and 9).
- 1Who HIPAA Covers: Covered Entities, Business Associates and Protected Health InformationHIPAA follows the organization, not the data. This lesson explains why the 1996 law ties coverage to electronic billing, who counts as a health plan, clearinghouse or covered provider, when a vendor becomes a directly liable business associate, what protected health information is and how it is de-identified, what HIPAA leaves out, and who enforces it, with worked examples from rural Idaho clinics to state Medicaid.70 min
- 2The Privacy Rule in Practice: Permitted Uses, Minimum Necessary, Patient Rights and 42 CFR Part 2How the HIPAA Privacy Rule works as a permission system and how it turns into access controls, release workflows and logs: treatment, payment and operations, the 12 public interest permissions, minimum necessary and role-based access, authorizations, the Notice of Privacy Practices and each patient right with its deadline. Then 42 CFR Part 2 for substance use disorder records after the February 16, 2026 compliance date, including OCR's September 2026 guidance on Medicaid work requirement verification.70 min
- 3The Security Rule: Safeguards, Required and Addressable Specifications, and the Proposed UpdateA section-by-section guide to the HIPAA Security Rule as enforced today, with every standard and implementation specification in one table, what "addressable" really requires, and how the 2021 recognized security practices law works. It then covers the January 2025 proposed rewrite in depth: what it would require, what HHS estimated it would cost, the comment fight, and its status as of October 28, 2026 (still proposed, final action projected July 2027).60 min
- 4The Risk Analysis: What OCR Expects, How to Do One, and Why Organizations FailThe HIPAA risk analysis is the document OCR asks for first and finds missing most often. This lesson explains what 45 CFR 164.308(a)(1) requires, OCR's nine elements, the NIST SP 800-30 and SP 800-66 Rev. 2 methods, the free HHS SRA Tool, a worked risk register for a 12-person clinic, and what OCR's Risk Analysis Initiative cases show about why organizations fail.60 min
- 5The Breach Notification Rule: The Four-Factor Test, the 60-Day Clock and the HHS Breach PortalHow the HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414) decides whether an incident is a reportable breach, how the four-factor risk assessment and the encryption safe harbor work on real situations, and how the 60-day clock, the notice letters, media notice and HHS reporting fit together. It also shows how to read the HHS breach portal, how the FTC rule covers health apps, and how Idaho's breach law runs alongside HIPAA.60 min
- 6Business Associate Agreements and Vendors: Cloud, IT Providers and AI ToolsWhen a vendor is a HIPAA business associate, what a business associate agreement must contain under 45 CFR 164.504(e) and 164.314(a), and what the HHS sample provisions leave out. How to check health care vendors, why IT providers, remote access tools and website tracking pixels are top risks, and how the ordinary rules apply to AI scribes, chatbots and coding tools, with a decision chart, a lifecycle graphic and a BAA checklist.60 min
- 7Medical Devices and Clinical Technology: FDA Cybersecurity Rules, Legacy Devices and SegmentationHow connected medical devices differ from office IT, what FDA's section 524B and its 2016 and 2026 cybersecurity guidance require of device makers, and what hospitals and clinics do on their side: inventory, segmentation, MDS2 forms, SBOMs, procurement terms and vulnerability management with makers. Real cases from Abbott pacemakers to Contec patient monitors are stated from FDA and CISA sources, with a strong safety warning against changing clinical systems based on a web lesson.60 min
- 8Enforcement and Real Cases: OCR Penalties, Settlements and Hospital RansomwareHow the HHS Office for Civil Rights enforces HIPAA, from complaints and breach reports to resolution agreements, civil money penalties and appeals, with the current penalty amounts as of October 28, 2026. The lesson covers the MD Anderson court loss, criminal and state attorney general enforcement, OCR's ransomware, risk analysis and right of access cases through October 2026, and the hospital ransomware attacks behind them, from Change Healthcare to Idaho hospitals.60 min
- 9A Small Clinic Walkthrough: From Risk Analysis to Written Policies, with Sample PoliciesA guided case: an invented rural Idaho family practice with 3 providers and 9 staff builds a HIPAA security program over 12 months, from naming its officials and running the free HHS SRA Tool to fixing its top risks with HICP and the HHS Cybersecurity Performance Goals, writing policies, training staff and testing with tabletop exercises. Includes ten original sample policies and worksheets, each tied to the Security, Privacy and Breach Notification Rule sections it follows, as those rules stood on October 28, 2026.85 min
Related courses (linked, not repeated)
- Privacy and Data Security Laws, lesson 3: Health Privacy: HIPAA and Beyond: the overview of HIPAA, health data outside HIPAA and state health data laws; start there if HIPAA is new to you.
- Privacy and Data Security Laws, lesson 9: Breach Notification Laws in All 50 States: the state breach laws that apply alongside HIPAA.
- Privacy and Data Security Laws, lesson 10: Idaho Privacy Law Up Close: Idaho's breach notice statute and other Idaho privacy law.
- Home Computer Security: the plain-language base: updates, passwords and two-step sign-in, scams, backups.
- Small Business Data Security: the plain-language base for a small office: accounts, backups, email, Wi-Fi, scams aimed at businesses and a 90-day plan.
- Privacy and Security for Small and Medium Businesses: the management program: risk assessment, NIST CSF, CIS, ISO 27001, SOC 2, vendors, people, incident response, insurance and board reporting.
- Idaho Medicaid: how Idaho Medicaid works, managed care, the 2027 work requirements and how to report on it.
How this module was made
Every lesson was written from the regulations, Federal Register notices, HHS, OCR, FDA, NIST and CISA publications and court records, cited in numbered notes. Each lesson was then checked by an independent checker who did not write it, against the primary text, with the HIPAA and other regulatory citations checked a second time. Points that could not be confirmed are listed at the end of each lesson under "Still being checked". Government documents used are public domain; photographs are public domain or freely licensed, with the license in each caption. Infographics are original drawings.