HIPAA Compliance Support for Northern Indiana Practices

Yes. The Security Rule applies to every covered entity regardless of size, and the risk analysis is its foundational requirement. It is also the first thing the Office for Civil Rights asks for after a breach complaint, and the item most often missing in enforcement actions against small practices. There is no small-practice exemption.

The assessment is the diagnosis: where PHI is, what threatens it, how likely and how bad. Compliance is the ongoing program that follows — the safeguards you put in place, the policies that say how you operate, the training you give staff, the reviews you repeat. Nobody is compliant because of a document; a practice is compliant because it keeps doing the things the document says.

Encryption is technically addressable rather than required under the Security Rule, which in practice means you must either do it or document why you didn't and what you did instead. The practical answer is yes: a lost unencrypted laptop with PHI on it is a reportable breach; a lost encrypted one generally isn't. We encrypt every device that holds PHI and configure encrypted email for anything containing it.

Any vendor that creates, receives, maintains or transmits PHI on your behalf: your EHR and practice-management vendor, imaging software, cloud backup, email platform, IT provider, billing service, clearinghouse, answering service, shredding company, and any marketing or patient-communication tool that sees patient names. We inventory them and track which agreements are in place.

HIPAA requires training for every workforce member on the practice's policies, at hire and periodically afterward, with records kept. We provide short, practical training — phishing, passwords, handling PHI, what to do if something goes wrong — annually and for new hires, and we keep the attendance records that prove it happened.

You must assess whether PHI was compromised, and if so notify affected patients without unreasonable delay and within 60 days, notify HHS, and for breaches affecting 500 or more people notify the media and HHS immediately. The assessment and the clock start the moment you discover it. Having a written incident-response plan and an IT partner who can tell you what was actually accessed is the difference between a manageable event and a catastrophic one.

No. The vendor's compliance covers their systems under your BAA. Your workstations, email, network, staff practices, devices and policies are still your responsibility, and that is where most small-practice breaches originate.

The initial risk assessment is a fixed-price engagement. The ongoing program — annual reassessment, policy maintenance, training, access reviews, BAA tracking — is included in our healthcare managed IT agreements. Remediation projects identified by the assessment are quoted separately as fixed prices.