A Small Clinic Walkthrough: From Risk Analysis to Written Policies, with Sample Policies

Rule versions described: the HIPAA Privacy, Security and Breach Notification Rules at 45 CFR Parts 160 and 164, as amended by the 2013 Omnibus Rule (78 FR 5566) and the 2024 Privacy Rule amendments, current eCFR and Cornell LII text read Oct. 28, 2026; the proposed Security Rule update (90 FR 898, Jan. 6, 2025), which is still a proposal, with final action projected for July 2027; Idaho Code Title 28, Chapter 51 as read Oct. 28, 2026; HHS and CISA tools and guidance at the versions named in the text. Rules, tools and penalty amounts change. Check the regulator's current text before relying on any point.

Most HIPAA writing explains the rules one at a time. Owners and managers of small practices usually need something else: a sequence. What do we do on Monday, and what do we do in month seven? This lesson answers that with one worked example, a clinic built to look like hundreds of real rural practices, and walks it from "we have never done a risk analysis" to a documented, tested program at the end of a year.

The example is invented. Snake River Family Medicine does not exist. Its staff, vendors, findings and decisions are made up for teaching, and any resemblance to a real practice is coincidence. Everything else is real: the rule citations, the free government tools, the enforcement cases and the Idaho law. Where the clinic makes a choice, the lesson says which rule or official guide the choice follows, so you can see the reasoning and make a different choice where your own risks differ.

This lesson builds on the rest of the module rather than repeating it. The method for the risk analysis is in lesson 4, The Risk Analysis. Breach decisions and notice deadlines are in lesson 5, Breach Notification. Vendor contracts are in lesson 6, Business Associates, Cloud and AI Vendors. Medical devices are in lesson 7, and the cases OCR has brought are in lesson 8. For the general small business version of a policy set and a 90-day plan, without the HIPAA layer, see Small Business Data Security, lesson 11. For running a privacy and security program as an ongoing management job, see Running the Program and People, Policies and Training in course 73. If HIPAA itself is new to you, start with the overview in Health Privacy: HIPAA and Beyond.

Meet the clinic (an invented example)

Snake River Family Medicine sits on the main street of a farm town of about 4,000 people in southern Idaho. It has been open for 22 years. One of the founding physicians still owns the practice. The nearest hospital is a critical access hospital 25 minutes away, and the nearest large health system is more than an hour's drive.

The people

The clinic has 3 providers and 9 staff, 12 people in all:

• Providers: the owner physician (family medicine), a second physician who joined four years ago, and a nurse practitioner.
• Clinical staff: one registered nurse and three medical assistants who room patients, run the EKG and spirometry, give vaccines and handle refill calls.
• Front office: two front desk staff who check patients in, scan insurance cards and IDs, schedule and answer phones.
• Back office: one billing coordinator who works with the outside billing company and handles prior authorizations, and one practice manager who runs payroll, purchasing, HR and "the computers."

No one on staff is an IT professional. The practice manager has been the de facto security person for years, mostly by being the one who calls the IT company when something breaks. That is the normal situation in a practice this size. The 405(d) program's small-organization volume describes exactly this audience: small practices, often ambulatory, without dedicated IT or security staff, that often rely on an outside managed IT service provider.¹

The systems and vendors

Like most small practices today, the clinic owns very little of its own technology. Most of what matters sits in vendors' clouds. That does not move the risk out of the building; it moves it into contracts, accounts and passwords.

Two items on that list are easy to miss. The phone system's voicemail transcription turns spoken patient information into stored text in someone else's cloud; and the vaccine sensor vendor needs a careful look before anyone decides it is outside HIPAA, because the answer depends on what data it actually receives. The definition of business associate in 45 CFR 160.103 turns on whether a person creates, receives, maintains or transmits protected health information on behalf of the covered entity, not on what the vendor calls itself.²

The patients and the payers

About a third of the clinic's patients are on Medicare, about a quarter are on Idaho Medicaid, and the rest have employer or marketplace coverage or pay cash. That mix matters to security in three ways. First, the clinic bills electronically, which is what makes a provider a HIPAA covered entity under 45 CFR 160.103.² Second, the clinic's records hold Medicare and Medicaid member numbers, which criminals value for billing fraud. Third, a long outage hurts the practice's cash flow quickly because claims stop. For how Idaho Medicaid works for providers, including managed care and the coming work requirements, see the Idaho Medicaid course.

The clinic does not run a specialized substance use disorder treatment program. Its providers do treat some patients for addiction as part of primary care. Whether federal rules at 42 CFR Part 2 apply turns on whether the clinic is a federally assisted program that holds itself out as providing substance use disorder diagnosis, treatment or referral; general primary care practices often are not, but the answer is fact-specific. The clinic writes down its conclusion and the reasons in its compliance file. Lesson 2 covers Part 2 in detail.

Which rules apply to this clinic

• HIPAA Privacy Rule (45 CFR Part 164, Subpart E): uses and disclosures, patient rights, the Notice of Privacy Practices, and administrative requirements such as a privacy official, training, sanctions and documentation (45 CFR 164.530).³
• HIPAA Security Rule (45 CFR Part 164, Subpart C): administrative, physical and technical safeguards for electronic protected health information (ePHI), plus written policies and documentation.⁴
• HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414): what to do when unsecured PHI is compromised.⁵
• Idaho's breach notice law (Idaho Code 28-51-104 to 28-51-107): applies when the clinic's computerized data includes a name plus a Social Security number, driver's license or Idaho ID number, or a financial account or card number with its access code, that data is illegally acquired, and the clinic's investigation finds that misuse has occurred or is reasonably likely. Medical information is not one of the listed elements, so Idaho's law and HIPAA's overlap only partly.⁶

The Security Rule has not changed since the 2013 Omnibus Rule. HHS proposed a major update on January 6, 2025 (90 FR 898). As of October 28, 2026, that update is still a proposal. HHS's own regulatory agenda lists it as a long-term action with final action projected for July 2027.⁷ The clinic must follow the rule in force today. It can still use the proposal as a free list of what regulators think good practice looks like, and this lesson flags where the clinic's plan already meets the proposal.

The 12-month plan at a glance

The clinic's owner set one rule at the start: the plan has to fit a practice that sees patients every weekday. Nothing is allowed to depend on closing the clinic, and no single month carries more than a few hours of work for any one person besides the security official. That is why the year is split into a dense 90-day start, which deals with the risks most likely to shut the clinic down, and a lighter nine months that turn quick fixes into a lasting program.

Days 1 to 30: own it and see it

The clinic's program starts with a short meeting, not a purchase. The owner, the practice manager and the account manager from the IT company sit down for an hour. The owner says out loud that security is now a clinic priority with a named owner, a calendar and a small budget. That sounds like ceremony. It is not. OCR's announced cases against small entities show a recurring pattern: a risk analysis that was never done or never finished, access nobody reviewed and backups nobody checked, which is what tends to happen when nobody is clearly responsible.

Appoint the privacy and security officials

HIPAA requires two named roles. The Security Rule requires the covered entity to "identify the security official who is responsible for the development and implementation of the policies and procedures" the Security Rule requires (45 CFR 164.308(a)(2), assigned security responsibility).⁸ The Privacy Rule separately requires a designated privacy official responsible for privacy policies and procedures, and a contact person or office to receive complaints (45 CFR 164.530(a)).³ One person may hold both roles in a small practice. The rules do not require a credential or a full-time job.

Snake River makes these choices:

• Security official: the practice manager. She knows every system and vendor and already manages the IT company. She will get about four hours a week for the first 90 days and about two hours a week after that, written into her job description.
• Privacy official and complaint contact: the registered nurse, who already handles records requests and knows the clinical workflow. The front desk staff route every privacy question and complaint to her.
• Executive sponsor: the owner physician, who signs the policies, approves the budget and hears a short report every quarter.
• Outside support: the IT company is not the security official. It carries out technical work under a written scope. Handing the security official role to a vendor is allowed in the sense that a covered entity can get help from anyone, but responsibility stays with the covered entity, and an MSP that is also grading its own work is a weak check.

The designation goes in writing: a one-page memo signed by the owner, dated, naming each person and what they are responsible for, filed in a "HIPAA program" folder that will hold every document produced over the year. Under 45 CFR 164.316(b)(2), documentation required by the Security Rule must be kept for six years from the date it was created or the date it was last in effect, whichever is later.⁹ The Privacy Rule has a parallel six-year rule at 164.530(j).³ Day one is the day to create the folder.

Build the inventory

You cannot protect or assess what you have not listed. HICP Technical Volume 1's asset management practice for small organizations (sub-practices 5.S.A to 5.S.C) recommends a complete inventory, which can be a spreadsheet, covering every device that touches the network including medical devices, tagged with unique IDs at purchase and tracked through secure disposal.¹ The HHS Cybersecurity Performance Goals list asset inventory as an "enhanced" goal.¹⁰ The proposed Security Rule update would make a written technology asset inventory and network map mandatory, reviewed at least every 12 months.¹¹ The clinic builds one now because the risk analysis depends on it.

The practice manager and the MSP technician spend one afternoon walking the building with a laptop, and a second session going through the MSP's management console and the clinic's Microsoft 365 admin pages. Their spreadsheet has one row per asset and these columns:

1. Asset tag and name (for example "SRFM-014, exam room 3 workstation").
2. Type: workstation, laptop, phone, tablet, printer or scanner, network device, clinical device, cloud service, or paper store.
3. Location or vendor, including where data is stored if it is a cloud service.
4. Owner: the person who answers for it.
5. Does it create, receive, store or send ePHI? Yes, no or unknown. Unknown means "find out."
6. Operating system and version, and whether the maker still supports it.
7. Encrypted at rest? Yes, no, or not applicable.
8. Who can sign in, and whether sign-in uses multi-factor authentication.
9. Backed up? And where.
10. Business associate agreement on file? For vendors.

The walk-through turns up what these walk-throughs usually turn up. The clinic has 16 computers, not the 12 everyone thought: two retired workstations are still plugged in under a desk in storage and one old laptop is in a provider's car "for home charting." The spirometer laptop runs an operating system version its maker stopped supporting. A USB drive in the billing office holds two years of exported patient balance reports. The front desk scanner saves a copy of every scanned insurance card to its own internal storage. And a provider forwards the e-fax inbox to a personal email account so she can read referrals at home.

None of these is a crime. Every one of them is a risk that would have been invisible to a policy-first approach.

List every business associate and collect the agreements

A covered entity may let a business associate create, receive, maintain or transmit ePHI on its behalf only if it has satisfactory assurances, in a written contract, that the business associate will safeguard the information (45 CFR 164.308(b)(1) and 164.502(e)). The contract must contain the elements listed at 164.504(e) and, for ePHI, 164.314(a).¹² The security official pulls every vendor from the inventory into a separate list and asks one question for each: "Do we have a signed business associate agreement, and where is it?"

Snake River's answers are typical. The EHR vendor's BAA is part of the master subscription agreement, accepted with a click by a former office manager seven years ago; nobody has a copy, but the vendor can provide one. The billing company's BAA is signed and on file. The IT company has no BAA at all, because "they are just IT." The e-fax service's BAA exists only on a higher-priced plan, which the clinic is not on. The phone vendor's terms say nothing about health information. The shredding company has a signed BAA from 2016.

Two follow-ups go on the list for days 61 to 90: sign a BAA with the IT company, which can reach every record in the clinic and is plainly a business associate; and move the e-fax account to the plan that includes a BAA, or switch vendors. OCR's cloud computing guidance makes the general point that a cloud service provider that creates, receives, maintains or transmits ePHI is a business associate even if it says it cannot see the data; in OCR's words, "lacking an encryption key does not exempt a CSP from business associate status."¹³ Lesson 6 covers BAA content in depth, including AI tools such as ambient scribes and chat assistants, which the clinic's providers are already asking about.

The emergency quick wins

Two things cannot wait for the risk analysis, because they are the most common way small practices are shut down and both are cheap to check:

• Multi-factor authentication (MFA) on email. MFA means a second proof of identity beyond the password, such as a code from an app or a hardware key. The clinic's Microsoft 365 tenant had MFA available but not required. The MSP turns it on for every account in week two, starting with the owner and the practice manager, using an authenticator app. HICP Technical Volume 1 recommends MFA for web and local email access for small organizations, and avoiding older mail protocols that cannot use it.¹ Multifactor authentication is one of the ten "essential" HHS Cybersecurity Performance Goals.¹⁰
• A real backup check. The practice manager asks the MSP two questions in writing: "Where is our latest backup that ransomware on our network could not reach or delete?" and "When did we last restore something from it, and did it work?" The answers are a cloud backup of the file shares that uses the same administrator account as everything else, and no restore test in at least a year. The EHR itself is backed up by the EHR vendor under its contract, but the clinic has never seen evidence of that. Both items go to the top of the risk list.

A third quick win costs nothing: the practice manager prints a one-page emergency contact sheet and tapes a copy inside a cabinet at the front desk and at her home. It lists the IT company's after-hours number, the EHR vendor's support line and account number, the billing company, the cyber insurer's claims line and policy number, the FBI's Salt Lake City field office (which covers Idaho through resident agencies in Boise, Pocatello, Coeur d'Alene and Lewiston), the internet provider, and the owner's cell number.¹⁴ When ransomware locks every computer in a building, the contact list stored on those computers is gone with them.

Days 31 to 60: the risk analysis

The Security Rule requires every covered entity to "conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information" it holds (45 CFR 164.308(a)(1)(ii)(A)), and then to implement security measures sufficient to reduce those risks to a reasonable and appropriate level (164.308(a)(1)(ii)(B), risk management).⁸ Both are "required" implementation specifications. Neither has a fixed format. The method, including scoping, threat and vulnerability identification, likelihood and impact, and documentation, is taught in lesson 4; this section shows how one small clinic actually ran it.

Why the risk analysis comes before the policies

OCR treats the risk analysis as the foundation of Security Rule compliance and has said so in enforcement for years. It launched a Risk Analysis Initiative in fall 2024; the first action under it was announced October 31, 2024, against Bryan County Ambulance Authority in Oklahoma ($90,000, after a 2021 ransomware attack affecting about 14,273 people, with a three-year corrective action plan).¹⁵ By April 23, 2026, OCR said it had completed 13 Risk Analysis Initiative investigations; the 14th, announced June 18, 2026, was a $450,000 settlement with the Spencer Gifts employee health plans.¹⁶¹⁷ Several were resolved for small amounts: the 12th, MMG Fusion, a Maryland software company acting as a business associate, settled for $10,000 after OCR considered its financial condition, and Northeast Surgical Group settled for $10,000 in January 2025.¹⁸¹⁹ The dollar amounts are small. The corrective action plans, which run two or three years and require OCR's review of the entity's risk analysis and policies, are not.

The practical reason is more persuasive than the legal one. Policies are supposed to describe how the clinic manages its actual risks. A clinic that buys a binder of policies first ends up with a document that promises encrypted laptops it does not have and access reviews nobody performs, and a written promise you do not keep is worse in an investigation than no promise at all.

Setting up the HHS SRA Tool

The clinic uses the free Security Risk Assessment (SRA) Tool from HHS's Assistant Secretary for Technology Policy (formerly ONC) and OCR. As of October 28, 2026, the current version is 3.7, with the download page last updated September 18, 2026. It runs as a 64-bit Windows desktop application or as an Excel workbook, and the data stays on the user's computer, not with HHS. Version 3.7 added questions on remote access and telework and a scoping question about every location where ePHI is handled. HHS describes the tool as aimed at small and medium providers, says it "may not be appropriate for larger organizations," and states that using it does not guarantee compliance.²⁰

Setup decisions the clinic makes:

1. Install on one encrypted workstation in the practice manager's office, not on a shared computer. The finished assessment is a detailed map of the clinic's weaknesses and is itself sensitive.
2. Fill in the practice information and the asset and vendor sections from the inventory spreadsheet, rather than from memory.
3. Schedule four 90-minute sessions over three weeks, each with a different group: the practice manager and MSP technician (technical questions), the RN and one medical assistant (clinical workflow and devices), the billing coordinator (billing, faxes, vendors), and the owner (governance, budget and the final ratings).
4. Answer honestly and write notes in the comment fields. "Yes, we have a policy" is the wrong answer if the policy is a template nobody follows. The tool's value is in its "no" answers.
5. Keep a separate list of follow-up questions for vendors, such as "what are your backup and restore times?" for the EHR vendor.

The SRA Tool is one way to meet the requirement, not the only one. NIST Special Publication 800-66 Revision 2 (February 14, 2024) walks through a risk assessment process scaled to organizations of different sizes and maps each Security Rule standard to NIST resources; NIST SP 800-30 Revision 1 (September 2012) is the underlying federal risk assessment method.²¹²² OCR's 2010 guidance on risk analysis lists the elements OCR expects to see regardless of method: scope, data collection, threats and vulnerabilities, current security measures, likelihood, impact, level of risk, documentation, and periodic review.²³

What the clinic found

Over the four sessions the tool generates a long list of gaps. The security official groups them by asset and threat, using the five threats HICP identifies for health care: social engineering (including phishing), ransomware, loss or theft of equipment or data, insider data loss (accidental or malicious), and attacks against network-connected medical devices that may affect patient safety.²⁴ The clinic's top findings, all invented for this example, look like this:

Two findings on that list match failures OCR cited in a real 2026 case. In Ambry Genetics (September 17, 2026, $700,000, a 2020 phishing attack affecting 225,370 people), OCR cited an inadequate risk analysis, failure to terminate access and lack of unique user identification.²⁵ Shared logins and slow access removal are not paperwork problems. They are why investigators cannot tell who did what, and why former employees and stolen credentials keep working.

Ranking the risks and writing the risk management plan

A risk analysis without a risk management plan fails the second required specification. The clinic writes a one-page plan that lists each high or critical risk, the chosen response, an owner, a target date and an estimated cost driver (staff time, licenses, hardware or vendor hours). It uses four response choices: reduce (add a control), avoid (stop the activity, as with forwarding faxes to personal email), transfer (insurance or a contract term, which shifts money but not the patients' harm), or accept (a documented decision by the owner that a low risk is tolerable for now). Every acceptance is signed and dated.

The plan is not a promise to fix everything this year. It is a written order of work. Under 45 CFR 164.306(b), the clinic may take into account its size, complexity and capabilities, its technical infrastructure, the costs of security measures, and the probability and criticality of potential risks.²⁶ What it may not do is ignore a risk it has identified.

Days 61 to 90: fix the top risks first

The clinic now has a ranked list. For the fixes, it relies on two free HHS sources written for exactly this situation. The first is HICP Technical Volume 1, "Cybersecurity Practices for Small Health Care Organizations" (2023 edition), produced under section 405(d) of the Cybersecurity Act of 2015.¹ The second is the HHS Healthcare and Public Health (HPH) Cybersecurity Performance Goals (CPGs), released January 24, 2024: ten voluntary "essential" goals and ten "enhanced" goals.¹⁰

These are not just good ideas. Since January 5, 2021, federal law (Pub. L. 116-321, codified at 42 U.S.C. 17941) requires HHS to consider whether a covered entity or business associate had "recognized security practices" in place for at least the previous 12 months when it decides fines, audit outcomes and other remedies. The statute names approaches developed under section 405(d) of the Cybersecurity Act of 2015, which is HICP, along with the NIST Cybersecurity Framework.²⁷ A clinic that can show a year of HICP practices, in writing, is in a better position after an incident than one that cannot.

Security Rule citations above are to the current text of 45 CFR 164.308, 164.310 and 164.312 as read Oct. 28, 2026.⁸²⁸²⁹ Many of these specifications are "addressable." Under 164.306(d), addressable does not mean optional: the clinic must assess whether each one is reasonable and appropriate, implement it if so, and if not, document why and put in place an equivalent alternative measure if that is reasonable.²⁶⁴

Fix 1: backups that ransomware cannot reach, tested

Backups come first because they are the difference between a bad week and a closed practice. Ransomware groups look for backups and try to delete or encrypt them before they launch. CISA's #StopRansomware Guide (September 2023 edition) tells organizations to "maintain offline, encrypted backups of critical data" and to test them regularly in a recovery scenario.³⁰ HICP Technical Volume 1 tells small practices to require their MSP to set up offline, offsite, encrypted backups of essential data, to make sure a BAA covers any cloud backup, and to ask vendors for proof of backups and test reports.¹

What Snake River does:

• Two independent copies. The MSP moves the file-share and Microsoft 365 backups to a backup service with immutable storage (copies that cannot be changed or deleted for a set retention period, even by an administrator), under separate credentials protected by MFA that are not used for anything else. A second copy goes weekly to an encrypted external drive that is disconnected after each run and taken off site by the practice manager in rotation with a second drive.
• A restore test, on the calendar. In month three, the MSP restores a sample of files and one full workstation image to a spare machine while the practice manager watches and times it. It takes six hours. That number goes into the contingency plan.
• Evidence from the EHR vendor. The security official asks the EHR vendor in writing for its backup and disaster recovery summary, its stated recovery time and recovery point, and its most recent independent security report. The vendor sends a summary and a third-party attestation report. The clinic files them and notes in the risk analysis that EHR availability depends on the vendor.
• A paper fallback. The RN assembles a "downtime kit": printed blank encounter forms, a printed current medication list template, a paper appointment schedule printed each evening for the next day, and instructions for when to start using it. Backups restore data; downtime procedures keep seeing patients while you wait.

Fix 2: MFA everywhere a password reaches patient data

Email MFA went on in month one. In this phase the clinic extends it:

• EHR and patient portal admin accounts: the EHR supports MFA; the clinic requires it for every user, which takes one setting and a 10-minute help session per person.
• Remote access: the provider who charts from home now uses a clinic laptop with an encrypted disk that signs in to the cloud EHR with MFA, instead of the personal computer she used before.
• Billing company access: the open remote desktop port on the billing workstation is closed. The billing company works in the EHR's billing module under its own named accounts with MFA, which the EHR supports.
• Admin and MSP accounts: every administrator account requires MFA, and where the tools allow it, phishing-resistant MFA such as hardware security keys.

The stakes are well documented. In the 2024 Change Healthcare attack, the largest health data breach ever reported to OCR at about 192.7 million people as of July 31, 2025, UnitedHealth Group's chief executive testified to Congress in May 2024 that the attackers first got in through a remote access portal that did not have MFA.³¹ Small clinics are not Change Healthcare, but the method is the same: a stolen password on a login page that asks for nothing else.

Fix 3: patching and unsupported systems

"Mitigate known vulnerabilities" is the first essential HPH goal.¹⁰ HICP Technical Volume 1 recommends turning on automatic patching where possible, patching at least monthly, and removing end-of-life operating systems and software.¹ The MSP sets workstations and laptops to install operating system and browser updates automatically within days of release, reports monthly on any machine more than 30 days behind, and patches the firewall and Wi-Fi equipment on a schedule. The two retired workstations in storage are removed from the network and queued for secure disposal (see the disposal policy below).

The spirometer laptop is harder. Its maker supports the testing software only on the older operating system version. The clinic does not try to upgrade it. Instead, the security official asks the device maker in writing whether a supported configuration exists, and in the meantime the MSP moves the laptop to the separate clinical device network, removes web browsing and email from it, and exports results through a single approved path. That is what the risk analysis calls a compensating control, and it is written down as one.

Fix 4: endpoint protection and email filtering

The clinic already had basic antivirus. The MSP replaces it with a managed endpoint detection and response product that the MSP monitors, and turns on Microsoft 365's built-in protections: filtering of malicious attachments and links, a banner marking messages from outside the clinic, and blocking of older sign-in methods that cannot use MFA. HICP Technical Volume 1 lists these for small organizations, and also recommends against using free consumer email for clinical work and in favor of email encryption for messages carrying PHI.¹ The provider who forwarded e-fax to her personal account stops, and the forwarding rule is removed and blocked tenant-wide.

Fix 5: least privilege and unique logins

Everyone at the clinic had been signing in to Windows as a local administrator, because some years ago a label printer driver needed it. The MSP removes local administrator rights from every daily account, creates separate named administrator accounts for its technicians and for the practice manager, and fixes the label printer. HICP calls for separate admin accounts and removal of unnecessary admin rights, and "separate user and privileged accounts" is an essential HPH goal.¹¹⁰

The shared front desk EHR login ends the same week. Unique user identification is a required specification at 164.312(a)(2)(i).²⁹ The front desk staff get their own accounts with fast user switching and a short automatic lock time, which answers the complaint that drove the shared account in the first place. The EHR's role settings are tightened so the front desk sees demographics, scheduling and insurance, not clinical notes, which supports the Privacy Rule's minimum necessary standard as well (164.502(b) and 164.514(d)).

Fix 6: vendor remote access under control

Vendor remote access is the door that small practices most often leave open, because it was set up once to solve a problem and never revisited. The MSP's remote support tool had a single shared technician login with no MFA and was always on. Under the clinic's new remote and vendor access policy (sample 10 below), the MSP:

• gives each technician a named account in the remote tool, with MFA;
• sets the tool so that sessions on clinic workstations during business hours must be accepted by the person at the keyboard;
• keeps session logs for at least a year and sends the practice manager a monthly list of sessions;
• signs the BAA it did not have; and
• agrees in writing to tell the clinic within a set number of hours if its own systems or remote tools are compromised.

The IT company is the clinic's most important business associate, because a compromise of the MSP's tools is a compromise of every client at once. Ransomware attacks that come in through MSP remote management tools are a well-known pattern, and OCR has settled with business associates hit by ransomware, including BST and Co. CPAs, a New York accounting and consulting firm that received PHI from a covered entity client ($175,000, announced August 18, 2025).³²

Fix 7: logging, encryption and the loose ends

• Logging. The Security Rule requires audit controls (164.312(b)) and regular review of records of system activity such as audit logs, access reports and security incident tracking reports (164.308(a)(1)(ii)(D)).²⁹⁸ The MSP turns on Microsoft 365 audit logging and sign-in alerts, sends firewall and endpoint alerts to its monitoring console, and gives the practice manager a 15-minute monthly review routine: unusual sign-ins, new forwarding rules, new admin accounts, failed backup jobs. The EHR's access log is reviewed for a random sample of charts each month and for any VIP or staff-member patient.
• Encryption. Both laptops get full-disk encryption. The unencrypted USB drive is copied to the clinic's protected file share and then wiped and destroyed; USB storage is blocked on workstations except for one encrypted, inventoried drive for the offline backup. Encryption matters twice: it protects the data, and under HHS breach guidance, PHI encrypted consistently with NIST guidance, with the key not compromised, is not "unsecured PHI," so loss of an encrypted laptop is generally not a reportable breach.³³
• Network segmentation. The MSP separates the network into staff, clinical device and guest segments, as in the diagram above. HICP sub-practice 6.S.A recommends segmentation for small organizations, and the proposed Security Rule update would require it.¹¹¹
• The scanner and copier. The front desk scanner's internal storage is cleared and its "save a copy" setting turned off. The copier lease now includes a clause that the hard drive is wiped or kept at lease end.
• E-fax. The clinic moves to the e-fax plan that comes with a BAA and restricts the web inbox to named users with MFA.

By day 90, the first eight of the twelve findings are closed or have compensating controls in place, and the remaining four are on the plan with dates. The security official updates the risk analysis to show the new ratings. That updated version, not the first one, is what the clinic would show an investigator.

The clinical devices: EKG cart, spirometer and fridge sensors

Medical device security is covered in lesson 7. A small clinic's version of it is modest but real. HICP's ninth practice covers network-connected medical devices, and the small-organization sub-practice 9.S.A starts with the same thing as everything else: know what the devices are, who supports them and how they connect.¹ Since March 29, 2023, section 524B of the Federal Food, Drug, and Cosmetic Act requires makers of new "cyber devices" to have a plan to monitor and address postmarket vulnerabilities, to provide updates and patches, and to provide a software bill of materials, which means a buyer can and should ask for that information.³⁴

For each device, Snake River's security official records the maker and model, the software version, who supplies updates and how, whether the device stores patient identifiers, how it connects (Wi-Fi, wired, USB export, or not at all), and the maker's support contact. Then:

• EKG cart. It stores recent tracings with names and birth dates and sends them to the EHR over the network. The clinic asks the maker for its security documentation and update process, confirms the cart sits on the clinical device network, and adds it to the disposal policy so that its storage is wiped by the maker or a certified vendor when it is replaced.
• Spirometer. As above: isolated on the device network, no email or browsing, a written request to the maker for a supported configuration, and a documented compensating control in the risk analysis.
• Vaccine fridge sensors. They send temperatures to the sensor vendor's cloud and text alerts to staff phones. The security official confirms with the vendor in writing that no patient information is sent or stored, and records that conclusion; if that were to change, the vendor would need a BAA. The sensors go on the device network so they cannot be used as a foothold to reach staff computers. The vaccine inventory itself is a patient safety issue: if the sensors fail, the manual twice-daily temperature log the clinic already keeps under its vaccine program rules continues.

Months 4 to 6: write the policies and train the staff

With the biggest risks reduced, the clinic writes down how it works. The Security Rule requires a covered entity to "implement reasonable and appropriate policies and procedures" to comply with the standards, to keep them in written (which may be electronic) form, to keep a written record of every action, activity or assessment the rule requires to be documented, to make the documentation available to the people who carry out the procedures, and to review and update it periodically and when environmental or operational changes affect ePHI security (45 CFR 164.316).⁹ The Privacy Rule has parallel requirements at 164.530(i) and (j).³

How the clinic writes its policies

The privacy and security officials write the policy set over about six weeks, one or two policies at a time, using these rules of their own:

1. Short master policy, specific procedures. One information security policy of two pages states who is responsible and what the clinic commits to. Each topic policy says what staff actually do, step by step.
2. Describe what is real. Every sentence in a policy must be true on the day it is signed. If a control is planned but not done, the policy says "by [date]" and the risk management plan tracks it.
3. Cite the rule. Each policy names the Security Rule or Privacy Rule section it implements. That makes the evaluation in month 10 and any OCR data request much easier.
4. Name roles, not people. "The security official" survives staff turnover; "Jenny" does not.
5. Version, sign and date. Each policy has a version number, an effective date, the owner's signature and a review date. Old versions go into an archive folder and are kept for six years after they stop being in effect.
6. Write for the reader. Front desk staff should be able to read the policies that apply to them in a few minutes. Technical detail for the MSP goes in procedures or the MSP's statement of work.

Snake River's set is the ten samples later in this lesson, plus a handful of Privacy Rule policies the privacy official adapts separately: uses and disclosures, minimum necessary, patient rights (access, amendment, accounting, restrictions and confidential communications), the Notice of Privacy Practices, complaints, and verification of identity. HHS publishes model Notices of Privacy Practices, updated for the February 16, 2026 compliance date of the 2024 rule changes.³⁵ For a general small-business policy set without the HIPAA layer, see Small Business Data Security, lesson 11; for managing policies as part of an ongoing program, see People, Policies and Training.

Training every workforce member

The Security Rule requires a security awareness and training program for all members of the workforce, including management (164.308(a)(5)(i)), with addressable specifications for periodic security reminders, protection from malicious software, log-in monitoring and password management.⁸ The Privacy Rule requires training on privacy policies and procedures for each workforce member within a reasonable period after joining and whenever material changes take effect, and documentation that the training happened (164.530(b)).³ "Workforce" under 160.103 includes employees, volunteers, trainees and others whose conduct is under the clinic's direct control, paid or not, so the student nurse who shadows on Tuesdays counts.²

The clinic's training plan:

• A 45-minute all-staff session at the monthly staff meeting in month four, led by the two officials, covering the five HICP threats, the new MFA and login rules, how to report a suspicious email or a lost device, misdirected faxes, the sanctions policy, and the downtime kit.
• HHS Knowledge on Demand videos. The HHS 405(d) program's free Knowledge on Demand platform offers "Five Threats" training videos aligned to the HICP threats, tailored for clinical staff, security teams and front-line departments, with a downloadable quiz, plus 2 to 3 minute "Quick Shots" videos explaining terms.³⁶ Each staff member watches the video for their role and takes the quiz; the scores go in the training file.
• Phishing practice. The MSP runs a simple simulated phishing message every other month. Clicks lead to a one-page lesson, not a reprimand. HICP sub-practice 1.S.C recommends phishing simulations for small organizations.¹
• Monthly reminders. A two-minute item at each staff meeting: one recent real-world scam, one reminder.
• New hire and departure checklists tie training and account setup together, and account removal to the last day of work.

Sanctions that are written and applied

The Security Rule requires a sanction policy: "apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures" (164.308(a)(1)(ii)(C), required).⁸ The Privacy Rule requires sanctions too and requires the clinic to document any sanctions it applies (164.530(e)).³ The clinic's sample sanctions policy below separates honest mistakes from carelessness and from intentional misuse, and protects people who report problems. Sanctions are not meant to punish the person who clicked a convincing phishing link and reported it at once. They are for the employee who looks up a neighbor's chart out of curiosity. In Idaho, an Eastern Idaho Public Health employee who accessed patient clinic notes without authorization led the agency to report an insider breach affecting 759 people, reported in January 2025.³⁷

Months 7 to 9: test the plan

A plan that has never been tested is a guess. The Security Rule's contingency plan standard includes testing and revision procedures (164.308(a)(7)(ii)(D), addressable), and its security incident procedures standard requires the clinic to identify and respond to suspected or known incidents, mitigate harmful effects to the extent practicable, and document incidents and outcomes (164.308(a)(6)(ii), required).⁸ The clinic runs two tabletop exercises, 90 minutes each, at lunch, with pizza.

Tabletop 1: ransomware on a Tuesday morning

CISA publishes free Tabletop Exercise Packages (CTEPs) with scenario templates, discussion questions and after-action templates, including health care and ransomware scenarios.³⁸ HICP Technical Volume 1 points small organizations to these CISA packages as a way to practice and test an incident response plan.¹ The security official adapts a CTEP scenario:

At 7:40 a.m. the first medical assistant in turns on the exam room 2 computer and sees a note saying the clinic's files are encrypted and patient data has been stolen. The front desk computers show the same note. The EHR in the browser still works on one provider's laptop. The phones work. Eighteen patients are scheduled for the morning, including two Medicare annual wellness visits and a child due for vaccines.

The facilitator moves the clock forward in steps (8:00, 10:00, end of day, day 3, day 10) and asks each role what they do. The exercise exposes real gaps:

• Nobody was sure whether to shut computers down or unplug them from the network. (The plan now says: disconnect from the network, do not power off unless the MSP says so, and do not wipe anything, so that evidence is preserved.)
• The front desk did not know where the downtime kit was.
• The owner wanted to know whether to pay. The group learned that the U.S. Treasury's Office of Foreign Assets Control warned in a September 21, 2021 advisory that facilitating ransomware payments can violate sanctions rules under a strict liability standard, that the government strongly discourages payment, and that prompt reporting to law enforcement or CISA and cooperation are significant mitigating factors.³⁹ The clinic's plan now says the decision belongs to the owner, made with the cyber insurer and qualified incident response professionals, and never on day one.
• The billing coordinator pointed out that if claims stopped for two weeks, payroll would be at risk. The plan now includes a call to the billing company on day one about paper or alternate submission, and the owner opened a line of credit as a financial contingency.
• Everyone assumed the EHR vendor would know. It would not, unless told; the vendor's security contact went on the emergency sheet.
• Nobody had thought about breach notice. OCR's July 11, 2016 ransomware fact sheet says that when ransomware encrypts ePHI, a breach is presumed, because the data was "acquired," unless the entity can show a low probability that the PHI was compromised through the four-factor risk assessment.⁴⁰ The plan now starts the breach clock and the four-factor assessment on day one.

Tabletop 2: the misdirected fax

Ransomware gets the headlines, but most small-practice privacy incidents are quieter. The second scenario:

A medical assistant faxes a 14-page referral packet for a patient with a new cancer diagnosis, including her medication list, insurance card, driver's license and visit notes, to a specialist. Two days later a hardware store in the next county calls: it received the fax. The specialist's fax number had changed and the clinic's contact list was out of date.

The group works through it with the breach procedure (sample 6). Was there an impermissible disclosure? Yes. Does an exception at 164.402 apply? No; the hardware store is not part of the clinic or authorized to receive PHI. Then the four factors: the nature and extent of the PHI (sensitive diagnosis plus a driver's license number), the unauthorized recipient (a business, not a health care entity), whether the PHI was actually viewed (the store's employee read enough to call), and mitigation (the clinic can ask the store to return or destroy the pages and sign a short attestation).⁵ The group discusses whether a signed attestation from a cooperative recipient gets the clinic to "low probability of compromise." The privacy official's view, which the group adopts for the exercise, is that it might for some facts, but with a driver's license number and a cancer diagnosis read by a stranger, the clinic would document its analysis and notify the patient. The driver's license number also brings Idaho's breach statute into the discussion, because it is a listed element in Idaho Code 28-51-104 if the data was computerized; whether a received paper fax counts is a question the clinic writes down for review.⁶

The fix that came out of the exercise was simple: preprogrammed fax numbers for the 30 most-used referral destinations, a verification call before faxing to any new number, and a fax cover sheet that asks a wrong recipient to call the clinic.

Setting the breach response

After the tabletops, the privacy official finalizes the breach procedure. The full rules are in lesson 5. The anchor points the clinic puts on one page:

• An impermissible use or disclosure of PHI is presumed to be a breach unless a documented four-factor risk assessment shows a low probability that the PHI has been compromised, or one of three narrow exceptions applies (164.402).⁵
• Individuals must be notified without unreasonable delay and in no case later than 60 calendar days after discovery. Discovery is the first day the breach is known, or would have been known with reasonable diligence, to any workforce member other than the person who committed it (164.404).⁴¹ Sixty days is an outer limit, not a target.
• For 500 or more people, HHS must be notified at the same time as individuals, and prominent media must be notified if more than 500 residents of a state are affected. Breaches of fewer than 500 are logged and reported to HHS within 60 days after the end of the calendar year (164.406 and 164.408).⁴²
• Business associates must report breaches to the clinic without unreasonable delay and within 60 days (164.410); the clinic's BAAs ask for much faster notice.⁴³
• Idaho's statute requires notice "in the most expedient time possible and without unreasonable delay" when its listed data elements were illegally acquired and the investigation finds that misuse has occurred or is reasonably likely; HIPAA's 60-day outer limit does not extend it. Idaho deems compliant an entity that follows its own notice procedures as part of an information security policy, consistent with the statute's timing, or that follows the procedures of its primary or functional federal regulator (Idaho Code 28-51-105 and 28-51-106).⁶⁴⁴
• The clinic, not a vendor, bears the burden of proving it gave notice or that an incident was not a breach, and it must keep that documentation (164.414(b) and 164.530(j)).⁵³

Reviewing the business associate agreements

In month eight, the security official reviews every BAA against the checklist in sample 8 and the required contents at 164.504(e)(2) and 164.314(a).¹² HHS's Sample Business Associate Agreement Provisions (January 25, 2013) are a free model; HHS notes that using them is not required.⁴⁵ The review finds the EHR vendor's BAA allows it 60 days to report a breach and is silent on ransomware and backups; the clinic cannot renegotiate a large vendor's paper, so it documents the gap in the risk analysis and relies on its own offline backup for continuity. The billing company's BAA does not mention its clearinghouse subcontractor; the billing company confirms in writing that its subcontractor has a BAA with it, as 164.504(e)(2)(ii)(D), 164.314(a)(2)(i)(B) and 164.314(a)(2)(iii) require. Lesson 6 discusses what is negotiable with large vendors and what is not.

Free outside scanning from CISA

Also in month eight, the security official enrolls the clinic in CISA's free Cyber Hygiene Vulnerability Scanning. CISA scans an organization's internet-facing static IPv4 addresses and sends weekly reports, with ad hoc alerts for urgent findings; it also offers web application scanning with monthly reports. Public and private critical infrastructure organizations are eligible, and health care is a critical infrastructure sector. Enrollment is by email to vulnerability@cisa.dhs.gov with the subject line "Requesting Cyber Hygiene Services." CISA says organizations typically reduce their risk and exposure by 40 percent within the first 12 months.⁴⁶ The clinic's first report finds one item: the old remote desktop port, closed in month three, was still open on a second internet address the internet provider had assigned years ago. The MSP closes it. That is exactly what an outside scan is for.

CISA's Region 10 office in Seattle covers Idaho, Alaska, Oregon and Washington and has cybersecurity advisors who offer outreach, assessments and exercises; its regional email is CISARegion10@cisa.dhs.gov.⁴⁷

Months 10 to 12: evaluate, document and plan year two

The evaluation

The Security Rule requires a periodic technical and nontechnical evaluation, first based on the rule's standards and then in response to environmental or operational changes, establishing how well the clinic's policies and procedures meet the rule (164.308(a)(8), required).⁸ The rule does not set a frequency. The clinic sets a yearly evaluation in month ten and after any major change, which matches what the proposed update would require (a compliance audit at least every 12 months) without waiting for it.¹¹

The security official walks through each Security Rule standard with three questions: Do we have a policy? Is it being followed (with evidence)? Did anything change this year that the policy does not cover? Evidence means things like the access review sign-offs, the backup restore test record, the training roster, the monthly log review checklist and the tabletop after-action notes. Where the answer is no, it becomes a year two item.

Update the risk analysis

The clinic reruns the SRA Tool in month eleven, starting from last year's file. Three things changed during the year: two providers began using an AI note-taking tool on a trial basis (which needs its own BAA review and risk entry; see lesson 6), the clinic added a telehealth option, and the EHR vendor moved the patient portal to a new platform. Each change is a reason, under 164.316(b)(2)(iii), to update documentation.⁹

Keep the records for six years

The "HIPAA program" folder started on day one now holds the year's work. It is organized by year and topic and stored in the clinic's protected file share, included in both backups. The clinic's retention list, built from 164.316(b)(2) and 164.530(j):

• officials' designation memos;
• every version of every policy and procedure, with dates in effect;
• the risk analysis and risk management plan for each year;
• asset inventories and network diagrams;
• BAAs and vendor security evidence;
• training materials, rosters and quiz results;
• sanctions applied;
• access reviews, log review checklists and audit reports;
• contingency plan tests and tabletop after-action reports;
• security incident reports, breach risk assessments, notices sent and the breach log;
• device and media disposal records;
• the annual evaluation.

Each item is kept for six years from creation or from the date it was last in effect, whichever is later. Medical records retention is a separate question governed by Idaho law, payer rules and licensing boards, not by the HIPAA documentation rule.

The year two plan

The owner's year-end report is one page: what was fixed, what remains, what it cost in staff hours and vendor fees, what the tabletops found, and what is planned. Year two adds phishing-resistant MFA for all staff, a check of the clinic's cyber insurance against the HICP small-organization guidance on insurance (sub-practice 10.S.D), a second-year restore test of a full EHR export, and a review of how the proposed Security Rule changes would affect the clinic if they become final.¹

A gap check against the proposed rule

The proposed update is not law, but it is a useful checklist. The table compares a few of its main proposals (from the HHS fact sheet issued December 27, 2024) with where Snake River stands at the end of year one.¹¹

Budget and cost drivers

Readers always ask what this costs. This lesson does not give dollar ranges for the clinic's program, because there is no current, authoritative public source that states what a 12-person practice should expect to spend, and vendor pricing varies by region, contract and the existing state of the systems. HHS did estimate the cost of the proposed Security Rule update across all regulated entities at about $9.3 billion in the first year and about $6 billion a year in years two through five, as widely reported from its regulatory impact analysis, but that national figure says little about any single practice.¹¹ What can be said is what drives the cost:

• Staff time. The largest cost in year one is the security official's hours (in this example, about four hours a week for three months, then two) and the staff time for training and tabletops.
• The state of the hardware. Unsupported operating systems and old firewalls mean replacement purchases. A clinic that has kept equipment current spends much less.
• Licensing tier. Many protections (MFA, attachment filtering, audit logging, device management) are included in or added to the email and office software the clinic already pays for; the cost depends on the license level.
• MSP scope. Managed endpoint detection, monitoring, backup with immutability and regular reporting are usually per-device or per-user monthly fees. A clear written statement of work keeps them predictable.
• Vendor plan upgrades. As with the e-fax service, a BAA sometimes comes only with a more expensive plan.
• Outside testing. Penetration testing and independent assessments are optional today but are the main new cost the proposed rule would add for small practices.
• Insurance. Cyber insurance premiums and the controls insurers require (often MFA, backups and endpoint detection) interact; a clinic that has the controls tends to find coverage easier to obtain.
• The cost of not doing it. Some of OCR's recent small-entity settlements have been as low as $10,000 to $25,000, plus two to three years of monitored corrective action, but the operational cost of a ransomware outage, lost billing and patient notices is usually far larger for a small practice.¹⁹⁴⁸

The free resources below cut the cost of the analysis, training and scanning to staff time.

Free resources for small practices

Health-ISAC figures are from its membership page as read on Oct. 28, 2026, and its offers change.⁴⁹ CISA's newer cross-sector Cybersecurity Performance Goals 2.0, released December 10, 2025, add a governance component and align with the current NIST Cybersecurity Framework; the HHS health-sector CPGs remain the more specific list for clinics.⁵⁰

Sample policies

The ten samples below were written for this lesson. They are not copied from any vendor, association or government template, and they are deliberately short so the structure is visible. Each one names the HIPAA sections it follows, as those sections read in the current eCFR text on Oct. 28, 2026, and uses [square brackets] for the details you must fill in. Each is written for a clinic like Snake River: a small covered entity with a cloud EHR, an outside IT provider and no in-house security staff. A hospital, health plan or business associate would need different and longer documents.

Read them as worked examples of what a policy needs to say, not as forms to sign. A policy that is adopted without the risk analysis behind it, or that describes controls you do not have, can hurt you in an investigation. OCR's resolution agreements regularly require entities to develop, revise and train on policies under OCR review, which is a sign of how often the policies on file did not match reality.⁴⁸

Official templates and guides to use with the samples

HHS does not publish a single official packet of sample HIPAA policies.⁵¹ The closest official materials, all free, are:

• HHS Security Risk Assessment Tool, version 3.7, with its user guide: the questions, threat library and reports are effectively a risk analysis template.²⁰
• HICP 2023 edition, including the main document and Technical Volume 1 for small organizations, from the HHS 405(d) program on the HHS Cyber Gateway.²⁴¹ The Health Sector Coordinating Council also posts the original HICP materials.
• HPH Cybersecurity Performance Goals (HHS, January 2024) and CISA's cross-sector CPG 2.0 (December 2025).¹⁰⁵⁰
• NIST SP 800-66 Rev. 2, Implementing the HIPAA Security Rule (February 2024), which lists resources and sample questions for each standard.²¹
• HHS Sample Business Associate Agreement Provisions (January 25, 2013).⁴⁵
• OCR Guidance on Risk Analysis Requirements (July 14, 2010).²³
• HHS model Notices of Privacy Practices, linked from the HHS Part 2 page.³⁵
• CISA #StopRansomware Guide (September 2023) and CISA Tabletop Exercise Packages.³⁰³⁸
• HHS guidance on rendering PHI unusable, unreadable or indecipherable (encryption and destruction) and NIST SP 800-88 Rev. 2 for media sanitization.³³⁵²

Common mistakes, from real OCR cases

The clinic's year is a success story because it is invented. Real cases show what happens when the same steps are skipped. Each mistake below is drawn from OCR resolutions announced from 2024 to 2026 or from OCR's own breach reports.

No real risk analysis, or one that left systems out

This is the finding in almost every recent OCR ransomware and hacking case. In the April 23, 2026 package of four ransomware settlements (Regional Women's Health Group, doing business as Axia Women's Health, $320,000; Assured Imaging, $375,000, 244,813 people; Consociate Health, a business associate, $225,000; and the Star Group health benefits plan, $245,000), OCR cited risk analysis failures, and it said hacking and ransomware are the most frequent type of large breach reported to it.¹⁶ OSF HealthCare's $552,250 settlement on July 29, 2026, OCR's 21st ransomware action, followed a 2021 attack that exfiltrated PHI of 53,907 people.⁵³

Phishing with no MFA and weak follow-through

Top of the World Ranch Treatment Center, an Illinois substance use disorder provider, settled for $103,000 on February 19, 2026 after a phishing attack affecting 1,980 patients; it was the 11th Risk Analysis Initiative action.⁵⁴ Ambry Genetics' $700,000 settlement in September 2026 followed a phishing attack and cited failures to terminate access and to use unique user IDs.²⁵

Not knowing a breach happened

MMG Fusion, a business associate, settled for $10,000 in March 2026 over a December 2020 intrusion affecting about 15 million people; OCR said it learned of the matter through a complaint and a posting on the dark web.¹⁸ Logging and monthly review exist to prevent exactly this.

Assuming small means exempt

Northeast Surgical Group ($10,000, January 2025), Guam Memorial Hospital Authority ($25,000, April 2025) and Bryan County Ambulance Authority ($90,000, October 2024) show that OCR brings cases against small and public entities, adjusting money amounts for size and finances but still imposing multi-year corrective action plans.¹⁹⁴⁸¹⁵

Ignoring the patient's right of access

Security is not the only enforcement risk for a small practice. OCR announced its 55th Right of Access enforcement action on August 27, 2026 (Azul Vision, $50,000, where a patient requested records in January 2023 and received them in January 2025), and on October 8, 2026 a Pennsylvania dental practice, Shen Smiles, paid $140,000 after OCR found it had no right of access policies.⁵⁵⁵⁶ Snake River's privacy policy set includes a written access procedure with a 30-day clock for that reason.

Vendors without contracts or oversight

In CY 2024, OCR's breach report to Congress counted 106 large breach reports involving business associates (16 percent of reports) that affected 206,921,071 people (85 percent of all individuals affected).⁵⁷ A small clinic's biggest exposures often sit with its vendors.

Questions people ask

Our EHR is in the cloud. Do we still need our own risk analysis?

Yes. The requirement at 164.308(a)(1)(ii)(A) applies to the covered entity for all ePHI it holds, and the clinic still holds ePHI in email, faxes, file shares, laptops, devices and paper, and controls who signs in to the cloud EHR and how.⁸ The vendor's own security program covers the vendor's side; the clinic's analysis should record what it relies on the vendor for and what evidence it has.

Is completing the HHS SRA Tool enough by itself?

HHS says using the tool does not guarantee compliance.²⁰ The tool helps you ask the right questions and produce a report. What makes it a real risk analysis is honest answers, coverage of every place ePHI lives, a risk management plan that follows from it, and evidence that the plan was carried out. A completed tool report with nothing done afterward is the pattern OCR keeps citing.

Can our IT company be our security official?

The rule requires the covered entity to identify the official responsible for its security policies and procedures; it does not forbid outside help.⁸ The safer arrangement for a small practice is an internal security official who directs and checks the IT provider's work, so the same company is not both doing and grading the work.

Encryption is "addressable." Can we skip it?

No, not without a documented reason and an equivalent alternative. Under 164.306(d), the clinic must assess whether encryption is reasonable and appropriate; for laptops and portable media in a modern practice it almost always is, and encryption also keeps a lost device from being a reportable breach under HHS's guidance on unsecured PHI.²⁶³³ The proposed rule would make encryption required with limited exceptions, but that proposal is not final.¹¹

How often do we have to redo all of this?

The current rule says "periodic" for review and evaluation and requires updates when the environment or operations change; it does not set a fixed calendar.⁹⁸ Annual review of the risk analysis, policies and evaluation, plus a review after any major change, is the common practice and matches the 12-month cycles in the proposed rule.

Can we buy a set of policies instead of writing them?

You can start from a purchased or free template, but the policies must describe your actual safeguards, roles and procedures. A template that promises controls you do not have creates a gap between paper and practice that investigators look for. Use templates for structure, then rewrite every section to match your risk analysis.

Providers want to use AI scribes and chat tools. Where does that fit?

Treat each one as a new system in the inventory and, if it handles PHI for the clinic, as a business associate that needs a BAA, a risk analysis entry and a decision on whether clinic data may be used to train the vendor's models. No OCR guidance specific to AI vendors and BAAs had been issued as of October 28, 2026; the general business associate definition and the cloud computing guidance apply.²¹³ Lesson 6 covers this.

If we follow HICP, are we protected from penalties?

Not protected, but better placed. Under 42 U.S.C. 17941, HHS must consider recognized security practices in place for the previous 12 months when deciding fines and other remedies; the statute does not create immunity.²⁷ Keep dated evidence of each practice so you can show the 12 months.

What are the HIPAA penalty amounts right now?

The 2025 inflation-adjusted amounts, published January 28, 2026 (91 FR 3665), remain in effect because HHS announced on October 21, 2026 that there would be no 2026 adjustment. Per-violation amounts range from a $145 minimum in the lowest tier to a $2,190,294 maximum, with a calendar-year cap of $2,190,294 for identical violations under 45 CFR 160.404; HHS's 2019 notice of enforcement discretion applies lower annual caps to the lower culpability tiers.⁵⁸ Lesson 8 has the full table.

Hard questions

Should the Security Rule require MFA and encryption for every practice?

The case for a mandate: the current rule's flexibility has produced two decades of inconsistent practice, and the attacks that cause the largest harm keep exploiting the same missing basics. Change Healthcare's initial access through a portal without MFA is the best-known example.³¹ HHS's proposal would make MFA and encryption required, with limited exceptions, arguing that clear minimums are easier to follow and enforce.¹¹ The case against, or for going slower: small and rural providers say the full proposal carries costs and documentation burdens that fall hardest on practices with thin margins, and HHS's own estimate of about $9.3 billion in the first year was widely reported.¹¹ Some clinical devices and legacy systems cannot support MFA or encryption without replacement. What the evidence shows: MFA and encryption are among the HHS essential CPGs and HICP small-practice practices, so there is little dispute about whether they are good practice; the dispute is about mandates, deadlines, exceptions and who pays. HHS moved the final action to a projected July 2027, which gives small practices time to adopt the controls voluntarily.⁷

Is OCR enforcement against small practices fair, or does it miss the big players?

One view: OCR's recent actions include many small entities paying $10,000 to $25,000, while the largest breach in history, Change Healthcare at about 192.7 million people, had produced no announced OCR enforcement action as of October 28, 2026.³¹ The other view: small entities are where basic failures are most common, the money amounts are scaled to finances, and corrective action plans fix practices that would otherwise stay broken; investigations of large entities take longer. What the evidence shows: OCR reported only 22 resolutions with money in CY 2024, totaling $9,944,612, and said it initiated no audits in 2024 for lack of financial resources.⁵⁹ Enforcement capacity is limited at every size, which is an argument for small practices to protect themselves rather than count on the odds.

Should a clinic ever pay a ransom?

For paying, in rare cases: when backups have failed and patients cannot be cared for, owners say paying may be the fastest way to restore care. Against: payment funds criminal groups, does not guarantee recovery or deletion of stolen data, may violate sanctions rules, and does not end HIPAA breach obligations. The federal government strongly discourages payment.³⁹ What the evidence shows: the real decision is made long before the attack, by whether the clinic has backups an attacker cannot reach and a tested way to keep seeing patients. A clinic with both rarely has to consider paying.

Should Idaho add medical information to its breach law?

For: Idaho's definition of personal information covers names with Social Security, driver's license, Idaho ID or financial account numbers, not medical information, so a breach of health data alone at an entity outside HIPAA may trigger no Idaho notice duty.⁶ Some other states include medical or health insurance information. Against: HIPAA already covers clinics, hospitals and plans, and adding a second, differently worded notice duty creates overlap and cost for covered entities. What the evidence shows: for HIPAA covered entities, the gap is small because HIPAA notice applies anyway; the gap is real for health data held by entities outside HIPAA, such as apps, which is a policy question for the Legislature.

Where to go next

• HHS Security Risk Assessment Tool (v3.7): Free Windows app or Excel workbook from HHS for small and medium providers. Download it, fill in your assets and vendors first, then answer the questions honestly over several short sessions; data stays on your computer.
• HICP Technical Volume 1 for small health care organizations: Free HHS 405(d) guide written for practices without IT staff. Use the sub-practices (1.S.A and onward) as a checklist with your IT provider, and keep dated evidence to show recognized security practices.
• HPH Cybersecurity Performance Goals: Free one-page list of 10 essential and 10 enhanced goals from HHS. Good for a quick self-check and for owners and boards.
• HHS Knowledge on Demand: Free HHS training videos on the five health care cyber threats, by role, with quizzes. Use them for annual workforce training and keep the quiz results.
• CISA Cyber Hygiene Services: Free weekly external vulnerability scanning for critical infrastructure organizations, including health care. Enroll by emailing vulnerability@cisa.dhs.gov with the subject Requesting Cyber Hygiene Services.
• CISA Tabletop Exercise Packages: Downloadable scenario kits from CISA, including health care and ransomware scenarios, with facilitator and after-action templates. Adapt one for a 90-minute staff exercise.
• NIST SP 800-66 Rev. 2: Free NIST guide that maps each Security Rule standard to activities and resources. Useful for writing policies and for the annual evaluation; more detailed than most small practices need, so use it as a reference.
• HHS Sample Business Associate Agreement Provisions: Free HHS model language for the required BAA terms. Compare each vendor's agreement against it; use is not required.

Still being checked (9 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• Snake River Family Medicine, its staff, vendors, findings, times and decisions are invented for teaching; they are not facts about any real practice.
• No current authoritative public source was found stating what a 12-person practice should expect to spend on a HIPAA security program, so the lesson describes cost drivers rather than dollar ranges.
• HHS's estimate of about $9.3 billion in the first year and about $6 billion a year in years two to five for the proposed Security Rule update is as widely reported from the NPRM's regulatory impact analysis; the HHS press release did not load during research.
• HHS does not appear to publish a single official packet of sample HIPAA policies; none was found as of October 28, 2026.
• The exact release date of SRA Tool version 3.7 is not stated on the HHS page, which shows only a last-updated date of September 18, 2026.
• No OCR guidance specific to AI vendors and business associate agreements was found; the lesson applies the general business associate definition and the 2016 cloud computing guidance.
• The Risk Analysis Initiative count after June 18, 2026 is not stated in later OCR releases, so the lesson says at least 14.
• Health-ISAC membership prices and its 60-day no-cost trial are as shown on its website on October 28, 2026 and may change.
• No OCR enforcement action against Change Healthcare or UnitedHealth Group was found as of October 28, 2026; this is absence of evidence from the OCR newsroom and resolution agreements list, not a statement from OCR.

Last verified October 28, 2026. General education, not legal, compliance or medical advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. HHS 405(d) Program, Technical Volume 1: Cybersecurity Practices for Small Health Care Organizations, Health Industry Cybersecurity Practices (HICP) 2023 Edition, sub-practices 1.S.A to 10.S.D, including email configuration, endpoint protection, access management, data protection and backup guidance, asset management, network segmentation, vulnerability management, incident response and medical device security (read Oct. 28, 2026). Read it online. ↩
2. 45 CFR 160.103, definitions of covered entity, business associate, subcontractor, workforce and protected health information, current text via Cornell Legal Information Institute (read Oct. 28, 2026). Read it online. ↩
3. 45 CFR 164.530, Privacy Rule administrative requirements: (a) personnel designations, (b) training, (e) sanctions, (f) mitigation, (g) refraining from retaliatory acts, (i) policies and procedures, (j) documentation and six-year retention, current text via Cornell LII (read Oct. 28, 2026). Read it online. ↩
4. HHS Office for Civil Rights, Summary of the HIPAA Security Rule, including the explanation of required and addressable implementation specifications (read Oct. 28, 2026). Read it online. ↩
5. 45 CFR 164.402, definitions of breach and unsecured protected health information, including the three exceptions, the presumption of breach and the four-factor risk assessment; see also 164.414 (burden of proof). Breach Notification Rule, 45 CFR 164.400 to 164.414, as amended by the 2013 Omnibus Rule (78 FR 5566), current text via Cornell LII (read Oct. 28, 2026). Read it online. ↩
6. Idaho Code 28-51-104 (definitions of breach of the security of the system and personal information) and 28-51-105 (investigation and notice; public agency notice to the Attorney General within 24 hours), Idaho Legislature (read Oct. 28, 2026). Section 28-51-105 is at https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-105/. Read it online. ↩
7. HHS OCR, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 90 FR 898 (Jan. 6, 2025), RIN 0945-AA22; the Unified Agenda entry (publication ID 202510) lists it as a long-term action with final action projected 07/2027, at https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22 (both read Oct. 28, 2026). Read it online. ↩
8. 45 CFR 164.308, administrative safeguards, including (a)(1) security management process, (a)(2) assigned security responsibility, (a)(3) workforce security, (a)(4) information access management, (a)(5) security awareness and training, (a)(6) security incident procedures, (a)(7) contingency plan, (a)(8) evaluation and (b) business associate contracts, as amended by the 2013 Omnibus Rule, current text via Cornell LII (read Oct. 28, 2026). Read it online. ↩
9. 45 CFR 164.316, policies and procedures and documentation requirements, including (b)(2)(i) six-year retention, (b)(2)(ii) availability and (b)(2)(iii) updates, current text via Cornell LII (read Oct. 28, 2026). Read it online. ↩
10. HHS, Healthcare and Public Health (HPH) Cybersecurity Performance Goals, 10 essential and 10 enhanced voluntary goals, released Jan. 24, 2024, HHS Cyber Gateway (read Oct. 28, 2026). Read it online. ↩
11. HHS OCR, fact sheet on the HIPAA Security Rule Notice of Proposed Rulemaking (issued Dec. 27, 2024), listing proposals including asset inventory and network map, MFA, encryption, 72-hour restoration procedures, vulnerability scanning every six months, annual penetration testing, network segmentation, annual compliance audits and business associate verification (read Oct. 28, 2026). The cost estimate of about $9.3 billion in the first year and about $6 billion a year in years two to five is as widely reported from the NPRM's regulatory impact analysis. Read it online. ↩
12. 45 CFR 164.504(e), business associate contract requirements; see also 164.308(b), 164.314(a) and 164.502(e), current text via Cornell LII (read Oct. 28, 2026). Read it online. ↩
13. HHS OCR, Guidance on HIPAA and Cloud Computing, published Oct. 6, 2016, last reviewed Dec. 23, 2022 (read Oct. 28, 2026). Read it online. ↩
14. Federal Bureau of Investigation, Salt Lake City Field Office, About page, listing coverage of Utah, Idaho and Montana and Idaho resident agencies in Boise, Pocatello, Coeur d'Alene and Lewiston (read Oct. 28, 2026). Read it online. ↩
15. HHS OCR, Resolution Agreement and Corrective Action Plan with Bryan County Ambulance Authority, $90,000, announced Oct. 31, 2024, the first Risk Analysis Initiative action (read Oct. 28, 2026). Read it online. ↩
16. HHS press release, OCR settles four ransomware investigations (Regional Women's Health Group, Assured Imaging, Consociate Health, Star Group L.P. Health Benefits Plan), Apr. 23, 2026, stating 13 completed Risk Analysis Initiative investigations and 19 ransomware investigations (read Oct. 28, 2026). Read it online. ↩
17. HHS press release, OCR settles ransomware investigation with Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans, $450,000, June 18, 2026, the 14th Risk Analysis Initiative action (read Oct. 28, 2026). Read it online. ↩
18. HHS press release, OCR settlement with MMG Fusion, LLC, $10,000, Mar. 5, 2026, the 12th Risk Analysis Initiative action (read Oct. 28, 2026). Read it online. ↩
19. HHS OCR, Resolution Agreement and Corrective Action Plan with Northeast Surgical Group, $10,000, Jan. 15, 2025 (amount as listed on the OCR resolution agreements page, read Oct. 28, 2026). Read it online. ↩
20. HHS Assistant Secretary for Technology Policy and OCR, Security Risk Assessment Tool, version 3.7, page last updated Sept. 18, 2026 (read Oct. 28, 2026). Read it online. ↩
21. NIST Special Publication 800-66 Revision 2, Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide, Feb. 14, 2024 (read Oct. 28, 2026). Read it online. ↩
22. NIST Special Publication 800-30 Revision 1, Guide for Conducting Risk Assessments, September 2012 (read Oct. 28, 2026). Read it online. ↩
23. HHS OCR, Guidance on Risk Analysis Requirements under the HIPAA Security Rule, July 14, 2010, page last reviewed Aug. 12, 2026 (read Oct. 28, 2026). Read it online. ↩
24. HHS 405(d) Program, Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients, 2023 Edition, describing five threats and ten practices (read Oct. 28, 2026). Read it online. ↩
25. HHS press release, OCR settles HIPAA investigation with Ambry Genetics over a phishing attack affecting about 225,000 individuals, $700,000, Sept. 17, 2026 (read Oct. 28, 2026). Read it online. ↩
26. 45 CFR 164.306, security standards general rules, including (b) flexibility of approach and (d) required and addressable implementation specifications, current text via Cornell LII (read Oct. 28, 2026). Read it online. ↩
27. 42 U.S.C. 17941, recognized security practices, added by Pub. L. 116-321 (Jan. 5, 2021), via Cornell LII (read Oct. 28, 2026). Read it online. ↩
28. 45 CFR 164.310, physical safeguards, including (a) facility access controls, (b) workstation use, (c) workstation security and (d) device and media controls, current text via Cornell LII (read Oct. 28, 2026). Read it online. ↩
29. 45 CFR 164.312, technical safeguards, including (a) access control with unique user identification, emergency access, automatic logoff and encryption, (b) audit controls, (c) integrity, (d) person or entity authentication and (e) transmission security, current text via Cornell LII (read Oct. 28, 2026). Read it online. ↩
30. CISA and partners, #StopRansomware Guide, September 2023 edition (read Oct. 28, 2026). Read it online. ↩
31. HHS OCR, Change Healthcare Cybersecurity Incident Frequently Asked Questions, last reviewed Aug. 13, 2025, reporting about 192.7 million individuals affected as of July 31, 2025 (read Oct. 28, 2026); on the testimony that the initial access point lacked MFA, Associated Press, Change Healthcare cyberattack was due to a lack of multifactor authentication, UnitedHealth CEO says, May 1, 2024. No OCR enforcement action against Change Healthcare had been announced as of Oct. 28, 2026. Read it online. ↩
32. HHS press release, OCR settles ransomware investigation with BST and Co. CPAs, LLP, $175,000 and a two-year corrective action plan, Aug. 18, 2025 (read Oct. 28, 2026). Read it online. ↩
33. HHS OCR, Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals, originally 74 FR 19006 (Apr. 27, 2009), encryption and destruction methods (read Oct. 28, 2026). Read it online. ↩
34. Federal Food, Drug, and Cosmetic Act section 524B, Ensuring Cybersecurity of Devices, 21 U.S.C. 360n-2, added by the Consolidated Appropriations Act, 2023 (Pub. L. 117-328), effective Mar. 29, 2023; see also FDA, Cybersecurity (medical devices) page, last modified July 6, 2026, at https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity (read Oct. 28, 2026). Read it online. ↩
35. HHS, Confidentiality of Substance Use Disorder Patient Records (Part 2) page, with links to model Notices of Privacy Practices updated for the Feb. 16, 2026 compliance date, last reviewed Sept. 29, 2026 (read Oct. 28, 2026). Read it online. ↩
36. HHS 405(d) Program, Knowledge on Demand, free training including Five Threats videos and Quick Shots, HHS Cyber Gateway (read Oct. 28, 2026). Read it online. ↩
37. HIPAA Journal, Eastern Idaho Public Health discovers insider data breach, Jan. 9, 2025, reporting 759 people on the HHS breach portal; agency press release at https://eiph.id.gov/pressrelease/eastern-idaho-public-health-hipaa-data-breach/ (read Oct. 28, 2026). Read it online. ↩
38. CISA, CISA Tabletop Exercise Packages, including sector scenarios for health care and threat vectors including ransomware (read Oct. 28, 2026). Read it online. ↩
39. U.S. Department of the Treasury, Office of Foreign Assets Control, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments, Sept. 21, 2021 (read Oct. 28, 2026). Read it online. ↩
40. HHS OCR, Fact Sheet: Ransomware and HIPAA, July 11, 2016 (read Oct. 28, 2026). Read it online. ↩
41. 45 CFR 164.404, notification to individuals, current text via Cornell LII (read Oct. 28, 2026). Read it online. ↩
42. 45 CFR 164.408, notification to the Secretary, and 164.406, notification to the media (https://www.law.cornell.edu/cfr/text/45/164.406), current text via Cornell LII (read Oct. 28, 2026). Read it online. ↩
43. 45 CFR 164.410, notification by a business associate, current text via Cornell LII (read Oct. 28, 2026). Read it online. ↩
44. Idaho Code 28-51-106 (procedures deemed in compliance, https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-106/) and 28-51-107 (violations); Idaho Office of the Attorney General, Security Breaches list of notices received, including Minidoka Memorial Hospital filings dated 8/6/2026 and 9/28/2026 (read Oct. 28, 2026). Read it online. ↩
45. HHS, Sample Business Associate Agreement Provisions, Jan. 25, 2013 (read Oct. 28, 2026). Read it online. ↩
46. CISA, Cyber Hygiene Services, vulnerability scanning and web application scanning, eligibility and enrollment (read Oct. 28, 2026). Read it online. ↩
47. CISA, Region 10 page (Alaska, Idaho, Oregon, Washington; Seattle regional office) (read Oct. 28, 2026). Read it online. ↩
48. HHS OCR, Resolution Agreements and Civil Money Penalties list, including Guam Memorial Hospital Authority ($25,000, Apr. 17, 2025) and Northeast Surgical Group ($10,000, Jan. 15, 2025) (read Oct. 28, 2026). Read it online. ↩
49. Health-ISAC, Join Health-ISAC membership page (Tier 1, annual revenue under $100 million, $2,400 a year) and 60-day no-cost membership page at https://health-isac.org/60-day-n0-cost-health-isac-membership (both read Oct. 28, 2026). Read it online. ↩
50. CISA, Cybersecurity Performance Goals 2.0, released Dec. 10, 2025, per CISA bulletin at https://content.govdelivery.com/accounts/USDHSCISA/bulletins/3ff7850 (read Oct. 28, 2026). Read it online. ↩
51. No single HHS packet of sample HIPAA policies was found as of Oct. 28, 2026; the HICP materials and the SRA Tool reports are the closest HHS-provided templates. The Health Sector Coordinating Council posts the original 2019 HICP materials (read Oct. 28, 2026). Read it online. ↩
52. NIST Special Publication 800-88 Revision 2, Guidelines for Media Sanitization, September 2025, superseding Rev. 1 (Dec. 17, 2014) (read Oct. 28, 2026). Read it online. ↩
53. HHS press release, OCR settles ransomware investigation with OSF HealthCare System, $552,250, July 29, 2026, OCR's 21st ransomware enforcement action (read Oct. 28, 2026). Read it online. ↩
54. HHS press release, OCR settles HIPAA Security Rule investigation with Top of the World Ranch Treatment Center, $103,000, Feb. 19, 2026, the 11th Risk Analysis Initiative action (read Oct. 28, 2026). Read it online. ↩
55. HHS press release, OCR settles HIPAA investigation with Azul Vision, Inc., $50,000, Aug. 27, 2026, the 55th Right of Access enforcement action (read Oct. 28, 2026). Read it online. ↩
56. HHS press release, OCR settles HIPAA Privacy Rule investigation with Dr. Linda L. Shen d/b/a Shen Smiles, P.C., $140,000, Oct. 8, 2026 (read Oct. 28, 2026). Read it online. ↩
57. HHS OCR, Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2024 (read Oct. 28, 2026). Read it online. ↩
58. HHS, Annual Civil Monetary Penalties Inflation Adjustment, 91 FR 3665 (Jan. 28, 2026), 2025 amounts; HHS notice of no 2026 adjustment, FR Doc. 2026-21524, 91 FR 66566 (Oct. 21, 2026), https://www.govinfo.gov/content/pkg/FR-2026-10-21/pdf/2026-21524.pdf; Notification of Enforcement Discretion, 84 FR 18151 (Apr. 30, 2019) (all read Oct. 28, 2026). Read it online. ↩
59. HHS OCR, Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance for Calendar Year 2024 (read Oct. 28, 2026). Read it online. ↩
60. HHS OCR, Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information (breaches affecting 500 or more individuals), live database (read Oct. 28, 2026). Read it online. ↩
61. HIPAA Journal, Minidoka Memorial Hospital cyberattack, Apr. 22, 2026, reporting an Easter 2026 attack reported to OCR as affecting up to 22,000 patients (read Oct. 28, 2026). Read it online. ↩
62. SecurityWeek, 460K impacted by Kootenai Health ransomware attack, 2024, reporting 464,088 people per a Maine Attorney General filing and a claim by the 3AM group (read Oct. 28, 2026). Read it online. ↩
63. HIPAA Journal, Weiser Memorial Hospital data breach, May 15, 2025, reporting 59,990 people (read Oct. 28, 2026). Read it online. ↩
64. HIPAA Journal, July 2026 healthcare data breach report, Oct. 15, 2026, listing Boundary Regional Community Health Center (Kaniksu Community Health), 88,000 people, via business associate Aesto Health (read Oct. 28, 2026). Read it online. ↩
65. KTVB, Data breach at Idaho Department of Health and Welfare, 2023, reporting unauthorized access to a Medicaid provider's payment account on Apr. 18, 2023 affecting 2,501 Medicaid members (read Oct. 28, 2026). Read it online. ↩