Could one overlooked vendor put your kids’ college fund at risk? HIPAA Compliance
- Rusty McCurdy
- 6 days ago
- 3 min read
Last month, a small three-provider dermatology office in Ohio paid $1.25 million to settle an OCR investigation. Why? They failed to vet a billing company properly — and when that vendor’s outdated system was breached, patient records (and the practice’s reputation) were shattered overnight. The administrator who managed that office? She’s now looking for a new job.
As a practice administrator, you shoulder enormous responsibility. You’re the air traffic controller for every appointment, claim, and chart — and you’re the first to answer when something goes wrong.
HIPAA compliance isn’t a paperwork drill. It’s the thin line between your thriving family practice and financial catastrophe that could follow you personally.
So if your week is jam-packed with chasing authorizations, smoothing out billing errors, and trying to get home before your kid’s soccer game, take three minutes to tackle these 5 essential HIPAA priorities. Your job — and your practice — depend on them.
1. Run a REAL Security Risk Analysis — not just a checklist
HIPAA’s Security Rule requires you to do a comprehensive Security Risk Analysis (SRA) every year. Not a generic template. Not a quick once-over.
According to Reuters, 2024 saw a 264% rise in ransomware attacks on healthcare — and OCR is responding by aggressively auditing small practices (Reuters, 2025).
✔ Action for you:
Document every system that touches ePHI: EHR, billing, appointment reminders.
Check for weak spots (like staff still using “Summer2022!” as a password).
Record what you’re doing to fix them — encryption, MFA, device updates.
2. Update your tech safeguards before OCR does it for you
HIPAA’s new proposed rules for 2025 are pushing toward mandatory encryption, multi-factor authentication, and auto patch management. Even if they aren’t yet final law, OCR will expect you to keep pace with “reasonable security practices.”
✔ Action for you:
Enable encryption on ALL devices with PHI — laptops, tablets, even staff phones.
Set up multi-factor authentication on your EHR & billing portals.
Work with IT to make sure every machine is set to auto-update.
3. Dust off that Notice of Privacy Practices & train for “minimum necessary”
Your Notice of Privacy Practices (NPP) shouldn’t be a stale document from 2015. It needs to reflect how your practice actually operates — and be updated every time you change vendors, patient portal tools, or telehealth workflows.
Plus, your staff must only access PHI that’s truly necessary. OCR penalties for snooping (like looking up a neighbor’s chart) can be crushing.
✔ Action for you:
Review & update your NPP annually.
Hold a 15-minute team huddle on “minimum necessary” access next week.
4. Vet every vendor — your liability doesn’t end at your door
Imagine this: your billing vendor stores PHI on a server running Windows 8. They get hacked. Patients sue your practice, not just them.
HIPAA is crystal clear: you must have signed Business Associate Agreements (BAAs) and do due diligence on every partner who handles PHI — from your shredding service to your telehealth platform.
✔ Action for you:
Audit your vendor list. Is there a signed BAA for every one?
Ask them to show you their last security risk assessment.
5. Run phishing drills & prep for the worst
Most breaches start with a simple phishing email — a front desk staffer clicks, ransomware downloads, and your office grinds to a halt.
Under the new OCR push, you’re expected to have formal incident response plans and do social engineering training regularly (Reuters, 2025).
✔ Action for you:
Simulate a phishing email this quarter.
Walk your team through what happens step by step if there’s a breach.
The bottom line for you & your family
Keeping your practice HIPAA-compliant isn’t just about avoiding a $1.5 million fine. It’s about safeguarding the trust your patients put in you, protecting the jobs of your staff — and making sure your own financial security (and those college savings) aren’t on the line.
So, even if today’s schedule is packed with no-shows, referrals, and insurance callbacks, carve out 30 minutes this week. Use it to patch vulnerabilities and tighten your compliance. It’s the best investment you can make in your future.
✅ Want a simple weekly HIPAA checklist sent to your inbox? Drop your email below — we’ll make sure your next OCR audit is just another Tuesday.
Kommentare