HIPAA

Most physicians know the basic cybersecurity risks: ransomware, phishing emails, stolen passwords and hackers trying to gain access to patient information. Artificial intelligence is adding a new risk. Recent incidents involving AI agents have shown that these systems can do more than answer questions. Some can interact with websites and computer systems, search for information and take actions on their own.

When a security incident occurs, one of the first questions a medical practice needs to answer is: What happened? Audit logs can help provide that answer. They create a record of activity on your computers, network, and software systems, including systems that contain or use electronic protected health information (ePHI).

Rising Cybersecurity Threats Put Healthcare at Greater Risk

When a healthcare organization experiences a cyberattack, the immediate impacts are obvious: systems go offline, appointments are delayed, and staff revert to manual processes. But the effects often extend far beyond IT, impacting patient trust, operations, and even creating opportunities for scammers.

If your office relies on Microsoft products to manage email, patient records, documents, collaboration, or daily business operations, newly identified cybersecurity vulnerabilities could put your organization at risk. Microsoft has recently addressed multiple security flaws affecting widely used products, including Windows, Microsoft Office, Exchange Server, SharePoint Server, Azure, Microsoft Defender, and developer tools.

Keeping Your Software Up to Date Is a HIPAA Security Requirement One of the most overlooked aspects of HIPAA compliance is ensuring that the software and programs used throughout your practice are kept up to date. Cybercriminals are constantly searching for vulnerabilities in commonly used applications, and software vendors regularly release security patches to fix these weaknesses. Failing to install these updates can leave your practice exposed to cyberattacks, data breaches, and potential HIPAA violations.

Many healthcare organizations focus on securing computers, servers, and electronic health record systems. However, one often-overlooked device may also contain sensitive information: your office copier. Many healthcare organizations focus on securing computers, servers, and electronic health record systems. However, one often-overlooked device may also contain sensitive information: your office copier. This device, if not properly secured, can be the cause of a large HIPAA breach for your practice

A New Era for Health Information Privacy and Cybersecurity Oversight? The U.S. Department of Health and Human Services (HHS) announced a significant restructuring of its Office for Civil Rights (OCR) on May 18, creating three dedicated divisions: • Conscience and Religious Freedom Division • Civil Rights Division • Health Information Privacy, Data, and Cybersecurity Division While the reorganization does not directly change HIPAA requirements, it may signal a heightened federal focus on healthcare privacy, cybersecurity, and data protection.

With the inception of the world wide web and storing patient information electronically, offices have had to trust software vendors, cloud services, and third-party partners with their most sensitive information — ePHI. But trust alone is not a control.

Over the years, we’ve published several articles explaining what constitutes a breach and the steps to take if one occurs in your practice. Today, we’re focusing on “Safe Harbor” provisions—specifically, when an incident may not be considered a reportable breach.