HIPAA
How to Run a Tabletop Exercise for Breach Notification
A breach-notification tabletop should test roles, facts, evidence, risk assessment, communications, recovery, and post-exercise actions…
Blog
Healthcare technology guides
Practical guidance on HIPAA, cloud infrastructure, secure booking, privacy, and attribution.
HIPAA
Proposed HIPAA Security Rule Changes for Incident Plans
As of August 15, 2026, distinguish the HIPAA Security Rule currently in effect from proposed modifications. Prepare incident,…
HIPAA
HIPAA Contingency Plans: Backup, Restore, and Testing
A HIPAA contingency plan should cover backup, disaster recovery, emergency mode, restore testing, recovery objectives, and evidence. The…
HIPAA
Security Monitoring Alerts for Protected Booking Data
Security monitoring alerts for protected booking data should focus on access, privilege, exports, failures, queues, backups, and…
HIPAA
Least Privilege, MFA, and Break-Glass Access Controls
Least privilege, multi-factor authentication, and break-glass access should work as one control system. Ordinary users receive only the…
HIPAA
Encryption at Rest and in Transit: What to Verify
Verify encryption at rest and in transit by checking the actual algorithm, key custody, endpoint, configuration, backup path, client…
HIPAA
How to Perform a HIPAA Breach Risk Assessment
A HIPAA breach risk assessment asks whether an impermissible use or disclosure of unsecured protected health information poses a…
HIPAA
Healthcare Incident Response Runbook: First 24 Hours
A healthcare incident response runbook should sequence detection, triage, containment, evidence preservation, risk assessment,…
HIPAA
Cross-Border Support Access Risk Register for Health Data
A cross-border support risk register should record the access country, actor, purpose, vendor, tool, data class, legal mechanism,…
HIPAA
AWS and Google Cloud Region Choices for US EU Brazil
AWS and Google Cloud region choices should be made from the tenant’s workload, service availability, contract, latency, backup, support,…
HIPAA
How Backups and Keys Follow a Tenant Home Region
Backups and encryption keys follow a tenant home region only when the architecture makes that rule explicit and tests it. Map primary…
HIPAA
Control Plane vs PHI Plane in a Regional Architecture
A regional architecture should separate a small global control plane from a regional protected-records plane. The control plane may contain…