The HIPAA Security Rule: Yes, It's Your Problem

Why This Topic Matters

It helps readers understand that HIPAA security obligations apply directly to their organization and that implementation, not just written policy, is central to compliance. The topic is especially relevant for practices trying to assess risk, allocate resources, and avoid penalties, audits, and reputation damage.

Article Sections

1. The big mix-up: HIPAA compliance is two-fold

   Introduces the relationship between HIPAA’s major rule sets and why confusion between them can leave organizations with incomplete compliance coverage. It also notes the security-focused framework discussed later in the article.

2. Policy vs. implementation

   Discusses the difference between having written policies and actually carrying out the associated operational measures. The section emphasizes that the article’s examples are meant to illustrate the broader implementation gap.

3. You have a lot to lose

   Reviews the potential consequences of noncompliance, including regulatory, financial, and reputational impacts. It also references public breach reporting and enforcement-related concerns.

4. Why would anyone steal from me?

   Addresses why smaller organizations can still be targets and why security lapses may go unnoticed. The section focuses on the threat environment and the vulnerability of electronic information.

5. Best practices

   Outlines broad steps small covered entities can consider when organizing a security program. The section covers advisory support, responsibility assignment, budgeting, documentation review, technology evaluation, and gap remediation at a high level.

6. Delaying HIPAA means more work

   Concludes with the challenge of postponing compliance efforts and the growing complexity that can come with delay. It reinforces the importance of addressing both privacy and security obligations.