In January 2021, the U.S. Department of Health and Human Services (HHS) published a Notice of Proposed Rulemaking (NPRM) proposing updates to the HIPAA Privacy Rule. The proposal was intended to remove barriers to coordinated care, improve individuals’ access to their health information, reduce unnecessary administrative burden, and strengthen certain patient rights while continuing to protect the privacy of protected health information (PHI).

The proposal has remained under federal review for several years. If a final rule is published, it may adopt some, all, or none of the originally proposed changes. 

When Could This Happen? 

While HHS has not announced an official publication date, the final rule is widely expected to be published as early as August 2026 based on the federal regulatory agenda.

If finalized, organizations will not be expected to comply immediately. Historically, HIPAA rules have become effective 60 days after publication, with compliance required approximately 180 days later. The final rule will establish the official effective and compliance dates. 

What Was Included in the Proposal? 

The proposed rule included several notable changes, including but not limited to: 

Patient Access and Individual Rights 

• Proposing to reduce the time to respond to an individual’s request for access to PHI from 30 calendar days to 15 calendar days  

• Proposing to strengthen an individual’s right to inspect PHI in person, including the ability to take notes and photographs  

• Proposing changes to certain fees for copies of PHI, including additional transparency through website fee schedules, individualized fee estimates, and itemized bills  

• Creating a pathway for individuals to direct electronic PHI maintained in an electronic health record (EHR) to another covered healthcare provider or health plan  

Care Coordination and Permitted Disclosures 

• Expanding and clarifying certain permitted uses and disclosures of PHI to improve care coordination and case management  

• Proposing changes affecting disclosures to social service agencies and community-based organizations involved in an individual’s care  

• Proposing updates to certain standards governing disclosures to family members and caregivers in specific situations  

• Proposing to replace the current “serious and imminent threat” standard with a “serious and reasonably foreseeable threat” standard for certain disclosures made to prevent or lessen a threat to health or safety. 

• Clarifying the application of the minimum necessary standard for certain disclosures and requests for PHI to reduce unnecessary barriers to care while maintaining privacy protections  

Notice of Privacy Practices (NPP) 

• Proposing revisions to the Notice of Privacy Practices (NPP), including eliminating the requirement to obtain a patient’s written acknowledgment of receipt while retaining the requirement to provide the notice  

• Proposing changes to the required content and format of the NPP to better inform individuals of their privacy rights  

Administrative and Operational Changes 

• Clarifying several administrative provisions intended to reduce unnecessary regulatory burden while maintaining privacy protections 

While the proposal covers many topics, its primary focus is improving patient access, supporting care coordination, reducing administrative burden, and updating the Notice of Privacy Practices. These changes remain proposals until a final rule is published.
 

What Could This Mean for Covered Entities and Business Associates and What Should They Do Now? 

Covered entities are expected to be most directly affected by many of the proposed operational changes. Business associates should also review the final rule to determine whether any contractual, operational, or policy updates may be necessary.

Depending on the final rule, organizations may need to evaluate: 

• HIPAA policies and procedures 

• Patient access request workflows 

• Notice of Privacy Practices 

• Workforce training 

• Forms and documentation 

• Business associate agreements and operational processes that support HIPAA compliance 

The final requirements, effective date, and compliance deadlines will not be known until HHS publishes the final rule.

Now is a good time to: 

• Stay informed about the publication of the final rule 

• Begin identifying policies and workflows that could be affected if the proposed changes are adopted 

• Plan time and resources to review and implement any new requirements once the final rule is published 

The post A HIPAA Privacy Rule Update Could Arrive as Early as August 2026. Here’s What Covered Entities and Business Associates Should Know appeared first on HIPAA Secure Now!.

The proposed updates to the HIPAA Security Rule are expected to move forward in 2027, and if the rule is finalized as proposed, healthcare organizations could have as little as 180 days to demonstrate compliance. 

While six months may sound like plenty of time, the reality is different for many healthcare practices. Budget planning often happens only once a year, and significant security improvements can take time to evaluate, purchase, implement, and document. 

That is why now is the right time to start the conversation. 

Budgeting Today Can Prevent Scrambling Tomorrow 

Preparing for the proposed rule does not mean you need to invest in every security solution immediately. Instead, think of this year’s budgeting process as an opportunity to identify potential gaps, prioritize future investments, and create a roadmap that aligns with your organization’s needs. 

Many of the safeguards highlighted in the proposed rule are already considered cybersecurity best practices and can strengthen your organization’s security regardless of when the final rule is published. 

As you build your 2027 budget, consider planning for investments such as: 

• Multi-factor authentication (MFA) 

• Encryption 

• Technology asset inventories 

• Vulnerability scanning and remediation 

• Backup and disaster recovery testing 

• Security Risk Assessments and ongoing risk management 

• HIPAA and cybersecurity awareness training 

• Updated policies and procedures 

• Business associate and vendor risk management 

Work with Your Trusted Advisors 

You do not have to figure out every requirement on your own. 

Now is an excellent time to meet with your IT provider, managed service provider (MSP), or compliance partner to review your current security posture, discuss where improvements may be needed, and estimate future costs. Having those conversations before budgets are finalized gives your organization greater flexibility and helps avoid unexpected expenses later. 

Prepare with Confidence 

Organizations that budget and plan ahead are far less likely to face rushed purchasing decisions, implementation delays, or last-minute compliance challenges if the final rule moves forward. 

More importantly, many of these investments provide immediate value by reducing cybersecurity risk, strengthening the protection of electronic protected health information (ePHI), and improving your overall security posture. 

HIPAA Secure Now is here to help healthcare organizations prepare before the clock starts. By taking practical steps today, you can make the 180-day compliance window far more manageable while building a stronger, more resilient organization for the future. 

The post Preparing Your 2027 Budget for the Proposed HIPAA Security Rule appeared first on HIPAA Secure Now!.

For healthcare executives and practice owners, cybersecurity is no longer just an IT responsibility. It is a business risk, a patient trust issue, and a core part of HIPAA compliance. 

As cyberattacks against healthcare organizations continue to rise, conducting a thorough Security Risk Assessment, or SRA, is one of the most important steps your organization can take to protect electronic protected health information, also known as ePHI. 

Read more: Opportunities for MSPs in Healthcare

More Than a Compliance Requirement 

The HIPAA Security Rule requires covered entities and business associates to regularly evaluate risks to ePHI. But a strong SRA should be more than a compliance exercise. 

It should help your organization understand where sensitive data lives, how it moves, who can access it, and where vulnerabilities may exist across systems, vendors, devices, and workflows. 

Read more: Why Continuous Training Beats One-and-Done Cyber Awareness

Visibility Is the First Step Toward Protection 

Without clear visibility, healthcare organizations may overlook gaps that could lead to unauthorized access, data exposure, operational disruption, or regulatory scrutiny. 

A well-executed SRA gives leaders a practical roadmap. It helps identify weaknesses, prioritize security investments, strengthen policies and procedures, and document the steps your organization is taking to reduce risk. 

For small and mid-sized healthcare practices that may not have a dedicated compliance officer, this kind of guidance can make HIPAA readiness feel more manageable. 

Read More: Proactive Cybersecurity Strategies to Protect Your Business

Proposed Rule Changes Raise the Stakes 

The proposed updates to the HIPAA Security Rule reinforce the importance of moving beyond a “check-the-box” approach. 

If finalized as proposed, the changes could require more detailed documentation, regular reassessments, technology asset inventories, ePHI mapping, and ongoing risk management. 

In other words, risk analysis is not something to complete once and file away. It is an ongoing process that should evolve as your technology, workforce, vendors, and threat landscape change. 

OCR Is Paying Attention 

The U.S. Department of Health and Human Services Office for Civil Rights has also emphasized risk analysis through its enforcement activity. Inadequate or missing SRAs continue to appear in investigations, often leading to penalties and corrective action plans. 

Build Confidence Before Pressure Builds 

A Security Risk Assessment does more than support HIPAA compliance. It helps healthcare leaders make informed decisions, protect patient data, strengthen trust, and build a more resilient organization. 

HIPAA Secure Now is here to help healthcare organizations take that next step with confidence. 

The post The SRA: Your Roadmap to Stronger HIPAA Compliance appeared first on HIPAA Secure Now!.

The proposed HIPAA Security Rule update has not been finalized yet, but small healthcare practices should not wait until the deadline is set to start preparing. 

One practical step your organization can take now is to begin building, reviewing, or updating your asset inventory. 

An asset inventory is a documented list of the systems, devices, software, vendors, and access points that may create, receive, maintain, or transmit electronic protected health information, also known as ePHI. While asset inventories have not historically been listed as a specific HIPAA Security Rule requirement, the proposed updates could make them a much more formal expectation. 

More importantly, an asset inventory is a smart foundation for your overall security and compliance program. 

Why does it matter? 

Because you cannot protect what you do not know exists. If your practice does not have a clear picture of where ePHI lives, how it moves, and who can access it, your risk analysis may miss important gaps. That can make it harder to identify vulnerabilities, update policies, manage vendor risk, and show that your organization is taking reasonable steps to protect patient data. 

A strong asset inventory should include: 

• Hardware, such as computers, laptops, mobile devices, servers, medical devices, and equipment that touches ePHI 

• Software and applications, including EHR/EMR systems, billing platforms, cloud tools, and other SaaS applications 

• Data flows that show where ePHI is stored, transmitted, and accessed 

• Vendors and business associates that interact with your systems or patient data 

• Network components, such as routers, firewalls, remote access tools, and other connection points 

• User access, including who has access to what and at what permission level 

The goal is not perfection on day one. The goal is visibility. 

Starting now gives your practice time to identify what you use, where patient data may be exposed, and which areas may need stronger safeguards. It can also make future compliance work easier if the proposed rule is finalized and organizations have a shorter window to act. 

HIPAA Secure Now is here to help healthcare organizations take practical steps before the clock starts. For more information, or to request a sample Asset Inventory, please reach out to our compliance team. 

The post Don’t Wait for the Final HIPAA Rule: Start with Your Asset Inventory appeared first on HIPAA Secure Now!.

HIPAA compliance has always required ongoing attention. But with proposed changes to the HIPAA Security Rule now on the table, healthcare organizations may need to prepare for a higher standard of cybersecurity, documentation, and ePHI protection. 

In January 2025, the U.S. Department of Health and Human Services Office for Civil Rights proposed major updates to the HIPAA Security Rule. If finalized as proposed, the updates could raise expectations around cybersecurity, documentation, workforce training, and how electronic protected health information, or ePHI, is protected. 

For small and mid-sized healthcare organizations, that can feel like a lot to take on. You may already be balancing patient care, staffing, billing, vendor relationships, insurance requirements, and daily operations. Adding new compliance expectations to the list can feel like one more thing you don’t have time to manage. 

That is exactly why preparation matters.  

What Could Change?

The proposed updates focus on safeguards healthcare organizations should already be evaluating, including: 

• Technology asset inventories 

• Risk analysis 

• Multifactor authentication 

• Encryption 

• Vulnerability management 

• Contingency planning 

• Documented policies and procedures 

• Stronger incident response planning 

• Business associate oversight 

• Workforce training 

Some of these areas may already be part of your compliance program. Others may need more documentation, stronger processes, or closer review if the rule is finalized as proposed. 

The proposed updates point to a clear theme: healthcare organizations may need to show that safeguards are not only in place, but also documented, reviewed, and maintained over time. 

Why This Matters Now

The response across the healthcare industry has been mixed. Many healthcare organizations have raised concerns about cost, timing, operational burden, and the potential impact on smaller or rural providers. At the same time, federal lawmakers continue to discuss stronger cybersecurity expectations across healthcare, including legislation aimed at improving cybersecurity resilience throughout the industry. 

Those developments may seem to pull in different directions, but they point to the same reality: healthcare organizations should be paying close attention to cybersecurity and HIPAA compliance. 

The timeline is what makes this especially important. If the proposed rule is finalized as written, covered entities and business associates may have as little as 180 days to demonstrate compliance. 

That is a short runway for organizations that may need to: 

• Identify compliance and security gaps 

• Update policies and procedures 

• Implement or strengthen security controls 

• Train employees 

• Review vendor and business associate relationships 

• Document compliance efforts 

For organizations without a dedicated compliance officer or internal HIPAA expert, waiting could make the process more stressful than it needs to be. 

Preparation Doesn’t Have to Happen All at Once

The good news is that preparing for what may be coming doesn’t mean everything overnight. 

 It starts with understanding what has been proposed, reviewing where your compliance program stands today, and taking practical steps to strengthen the safeguards that protect patient data. 

That may include reviewing your Security Risk Assessment, confirming policies and procedures are current, checking how your organization manages employee training, and looking more closely at areas like MFA, encryption, vendor oversight, and incident response. 

It also means helping employees understand their role in protecting patient data, especially as cyber threats, AI tools, and Microsoft 365 usage continue to shape daily healthcare operations. 

HIPAA Secure Now Can Help 

Since 2010, HIPAA Secure Now has helped more than 5,000 healthcare organizations strengthen HIPAA compliance, protect patient data, and reduce cyber risk. 

We provide HIPAA training, Security Risk Assessments, policies and procedures, phishing awareness, vulnerability tools, AI training, Microsoft 365 productivity training, and compliance support designed specifically for healthcare organizations. 

Our connected compliance and training platform helps make HIPAA easier to understand, document, and maintain over time, so your organization can take practical steps before the deadline is set. 

Protecting patient data is about more than meeting a requirement. It’s about knowing you can answer with confidence when someone asks, “Can you show me your HIPAA compliance program?” 

The proposed rule is not final yet. The time to prepare is before the deadline is set. 

Download the Industry Brief

Learn what may be changing, why it matters, and how HIPAA Secure Now can help your organization prepare.

The post What the Proposed HIPAA Security Rule Changes Could Mean for Your Organization appeared first on HIPAA Secure Now!.

Walk into any medical office today, and you’ll probably hear the soft ping of an email, maybe a Teams message popping up on someone’s screen. Chances are someone else is copying patient instructions into a word processor or using a chatbot to summarize notes. It all blends in with the workday.

The tools feel familiar. That’s the problem.

When something feels routine, it’s easy to forget how much risk it carries. Especially when the systems involved are handling patient data. Most teams aren’t doing anything malicious—they’re just moving fast, solving problems, and trying to get through the day. That’s exactly when mistakes happen.

An acceptable use policy helps with that. Not by scaring people, but by drawing clear lines around what’s appropriate, what’s not, and what should trigger a pause.

Where Most People Slip Up: Email

Email feels harmless. It’s the go-to for appointment reminders, referral requests, lab results, and staff communication. But it’s also one of the easiest places for patient information to leak.

Some examples:

• Sending the wrong attachment to the right person

• Forgetting to BCC on a group message

• Forwarding a sensitive message to a personal inbox so it’s easier to print at home

None of these actions start with bad intentions. But they create real exposure.

A policy needs to call that out, plainly. Staff should know when it’s okay to send PHI over email, and when it’s not. If encryption isn’t automatic, that needs to be clear too. Some offices go further and restrict emailing PHI altogether unless a secure system is used.

Make sure people understand the rules before a mistake forces the conversation.

AI Use Is Growing Fast

There’s no shortage of tools that promise to speed things up. From grammar checkers built into browsers to full-blown AI assistants, people are using them. Often without asking.

And here’s the thing: many of these platforms collect and store the input they’re given. That includes copy-pasted notes, emails, and yes—patient details.

If an employee pastes a progress note into an AI tool to rewrite it “more clearly,” that data leaves your system. You don’t get it back. There’s no agreement in place, no guarantee of security.

This isn’t about banning technology altogether. Some AI tools are safe to use for general writing help. But the line needs to be clear: don’t feed these systems sensitive information, ever. The policy should say so in plain terms. No fine print, no room for interpretation.

Personal Devices and Apps: Another Blind Spot

Most people don’t think twice about checking work email on their phone. Or jotting a reminder in their Notes app. Maybe they message a coworker a patient name to coordinate care. All of it seems efficient—until something gets lost, copied, or accidentally sent to the wrong contact.

If personal devices are allowed, that has to come with conditions. Require passcodes. Disable app syncing for certain platforms. Clarify which apps are approved and which aren’t. And make sure everyone knows where the boundaries are.

Without a shared understanding, people fill in the blanks themselves. That’s where risk lives.

The Policy Only Works If People Understand It

A 12-page acceptable use document full of legalese won’t help your team avoid trouble. Nobody reads it. And if they do, they won’t remember it.

Keep it short. Use plain language. Give real examples of what’s allowed and what’s not. Review it regularly, not just during onboarding. Post the top five takeaways where people will actually see them—break rooms, log-in screens, onboarding packets.

Training helps too. Not a video once a year, but small, repeatable reminders tied to the tools people actually use.

Before You Rework Your Policy

If any of this feels familiar, that’s probably a good thing. It means you’re noticing where gaps exist—and that’s the first step toward fixing them.

HIPAA Secure Now offers real-world training and policy templates that make acceptable use more than just a document. We help healthcare teams apply these rules to the tools they use every day, like email, Microsoft 365, and even AI.

Want to build a policy that actually sticks? Reach out. We’ll help you get it done right.

The post What Is Acceptable Use in a Medical Office? appeared first on HIPAA Secure Now!.

If you run or support a small healthcare organization, you’re probably used to doing more with less. You manage compliance, care, billing, and tech—often without a big team or deep pockets. So when you hear terms like “Generative AI training,” it might feel out of reach.

But the 2025 Wolters Kluwer Future Ready Healthcare Survey says otherwise.

Most healthcare leaders aren’t ahead of the curve—they’re still trying to figure it out. According to the study:

• 80% say optimizing workflows is a top priority

• 76% want to reduce clinician burnout

• Only 36% feel truly prepared to use GenAI to solve those problems

• And just 18% have policies in place to guide AI use

That gap between goals and action? It’s where risk lives and opportunity begins.

When GenAI Shows Up Quietly, So Do the Risks

Here’s what’s happening in most healthcare environments right now: someone on the team uses ChatGPT to rewrite patient instructions. A front desk staffer asks it to draft a policy update. A manager tries out an AI-based transcription tool for meeting notes.

They’re not doing anything wrong—they’re just trying to move faster. But without training or guardrails, things get risky fast:

• PHI slips into a chatbot

• Sensitive notes end up stored on external servers

• AI-generated content gets mistaken for accurate medical guidance

These aren’t theoretical risks. They’re happening now. And in healthcare, even small mistakes can have serious consequences.

The Survey’s Real Takeaway? No One Has This Fully Figured Out

The most surprising part of the Wolters Kluwer survey isn’t that AI is rising. It’s that even major health systems aren’t fully prepared. Less than 1 in 5 organizations have formal GenAI policies. Fewer than 1 in 4 offer staff training.

That means smaller practices and business associates have a real chance to lead—not by doing more, but by doing the right things first.

What That Could Look Like for You

Let’s keep it simple. Here’s what “taking the lead” might mean for your team:

• Start by talking about where AI already shows up—in Microsoft 365, in browser tools, in EHR plug-ins

• Create a basic acceptable use policy to help staff understand what’s safe to share and what’s not

• Offer short, practical GenAI training that explains risks in plain language

• Review tools you’re already using to see if any of them now include AI features you didn’t plan for

You don’t need a full-time AI officer. You need awareness, clarity, and some shared language to keep your team aligned.

Moving Slowly Isn’t the Same as Moving Safely

A lot of healthcare leaders are taking the “wait and see” approach. That’s understandable. But it won’t stop your staff—or your vendors—from adopting GenAI anyway.

The Wolters Kluwer survey makes this clear: the pressure to adopt AI is already here. But most organizations aren’t matching that pressure with preparation. That’s where risk starts to grow—quietly, in day-to-day tools, far from the IT department.

The solution isn’t to rush. It’s to educate. A little clarity now can prevent a lot of mess later.

Want a Simple Way to Move Forward?

At HIPAA Secure Now, we’ve helped healthcare organizations build strong foundations around security, compliance, and training for years. Now we’re doing the same with AI.

Our Generative AI Training is built specifically for covered entities and business associates. It covers:

• What GenAI is (and what it’s not)

• How to use it safely in a HIPAA-regulated environment

• The right way to talk about it with staff and vendors

• And how to introduce it without overcomplicating the process

It’s short, practical, and designed to help you stay in control of where GenAI shows up next.

→ Want to start the conversation inside your organization? Let’s talk.

The post Most Healthcare Leaders See the Promise of GenAI—Only 36% Feel Ready appeared first on HIPAA Secure Now!.

Shared office spaces are common in healthcare. Practices rent suites in the same building. Some share front desks, printers, and even Wi-Fi. It’s convenient—but it comes with risk.

Microsoft 365 makes it easy to access email, files, calendars, and patient documents from anywhere. That’s part of the appeal. But in a shared environment, the same tools that simplify your work can also create vulnerabilities.

The good news? You don’t need to overhaul your tech stack. You just need to use what you already have wisely.

Use the Right Version of Microsoft 365

Not all plans are built the same. Some are designed for home use. Others come with tools that help meet healthcare compliance requirements.

Choose a version like Microsoft 365 Business Premium or Enterprise. These include features that protect data and help you stay in control. Think audit logs, device security, and built-in encryption. Without them, you’re operating without a safety net.

Turn On Multi-Factor Authentication

Passwords are often weak. People reuse them. They write them on sticky notes. It happens.

Multi-factor authentication (MFA) adds a second layer. Even if someone gets a password, they can’t log in without the second step—usually a code sent to a phone or an app.

In a shared space, this matters more than ever. Devices get left open. People come and go. MFA helps make sure only the right person gets in.

Assign Access Based on Roles

Not every user needs access to every part of the system. Role-based access controls allow you to assign permissions according to job function. This helps minimize internal risks and keeps your data more secure overall.

Microsoft 365 groups and SharePoint settings let you segment access to files, email, and calendars. If someone doesn’t need access to a type of data to do their job, they shouldn’t have it.

Secure the Devices People Actually Use

Staff use laptops. They check messages on phones. Some access calendars from home.

With Microsoft Intune or other mobile device management tools, you can create basic protections. You can block copy-paste between apps. You can require a screen lock. If a phone is lost, you can wipe it remotely.

None of this takes much time to set up—but it makes a big difference.

Use Data Loss Prevention to Stop Mistakes

It’s easy to send the wrong email. Or upload a document to a personal drive by accident.

Microsoft 365 has a feature called Data Loss Prevention (DLP). It flags risky actions before they happen. For example, if someone tries to send a spreadsheet with patient info to an outside email address, DLP can alert them—or block it entirely.

You set the rules. Microsoft 365 does the monitoring.

Watch What’s Happening in the Background

Audit logs show who accessed what and when. You can see if a file was edited, shared, or downloaded. You can check for strange sign-ins.

If you’re ever audited—or just want peace of mind—these logs help you understand how people are using the system.

They don’t take much effort to review. Once you get used to them, they become a normal part of running a secure environment.

Teach the Basics Again and Again

Technology helps. So does training.

Remind staff to log out of shared computers. Teach them not to leave printouts on the copier. Show them how to spot phishing emails. These aren’t one-time lessons. They’re habits that form over time.

The most secure teams aren’t the ones with the fanciest software. They’re the ones that know how to use the basics well.

A Quick Note on Support

If setting this all up feels overwhelming, that’s okay. You don’t have to do it alone. HIPAA Secure Now provides training, policy templates, and risk assessments built for healthcare. We help teams use tools like Microsoft 365 safely—without adding more to their plate.

If you want to train your team to use Microsoft 365 more efficiently and securely, we’d love to help. Contact us to learn how we make compliance practical and people-first.

The post How to Use Microsoft 365 Securely in a Shared Office Environment appeared first on HIPAA Secure Now!.

Many healthcare providers treat HIPAA policies like fire extinguishers: necessary, but rarely revisited unless there’s an emergency. The problem is that static policies don’t reduce real-world risk. If they aren’t updated, understood, and actively used, they’re just paper—no matter how well written.

HIPAA policies only work when they’re built into daily operations. That means customizing them to your systems, reviewing them consistently, and reinforcing them through practical training.

Dormant Policies Create Compliance Gaps

When an OCR investigation begins, regulators ask two questions. First, are HIPAA policies in place? Second, are they being followed in practice?

Without consistent implementation, even the best policy documents won’t protect your organization. Enforcement cases frequently reveal:

• Language that doesn’t reflect current technology or workflows

• Missing instructions for breach response or access control

• Team members unfamiliar with the steps outlined in key policies

• Long gaps between policy creation and meaningful review

In several recent cases, providers produced written policies but couldn’t show any evidence of use or training. That gap often shifts outcomes from corrective guidance to costly enforcement.

Make HIPAA Policies Operational, Not Optional

To avoid that outcome, HIPAA policies must go beyond documentation. They should be reflected in behavior, supported by systems, and routinely updated. Consider the following four strategies to make your policies effective:

1. Customize for Real Tools and Teams

First, make sure policies align with the actual tools and processes used in your practice. For example, if your team uses tablets at check-in or sends appointment reminders through Microsoft 365, those workflows should be addressed in your access and communication policies.

Describing what is allowed—and how protections are implemented—helps ensure policies are both actionable and enforceable.

2. Review Annually, Track All Changes

Next, treat policy reviews as a regular business process. Once a year, assign a team or individual to review each document and make updates based on regulatory changes, system updates, or team structure.

Document every revision with a log of what changed and why. This transparency shows regulators that your HIPAA policies are actively maintained and not ignored over time.

3. Connect Policies to Training and Procedures

Third, link each policy to the procedures staff follow. When someone learns how to report a suspected breach or securely email a patient document, that training should stem directly from your documented policy.

This approach not only reinforces retention but also improves clarity. When policies flow into clear procedures, and those procedures are part of employee training, your team can act with confidence—even under stress.

4. Update for New Threats—and Use the SRA to Find Them

Finally, be proactive about emerging risks. AI tools, mobile devices, and remote access are changing how healthcare teams work. If your HIPAA policies haven’t evolved to reflect these realities, there’s a gap that needs attention.

Your Security Risk Assessment (SRA) plays a key role here. A thorough SRA can reveal weaknesses in your current processes—like unsecured data storage, third-party application use, or lack of audit logging. Use those findings to guide updates to your policies, ensuring they match both your infrastructure and your risk profile.

Editable Doesn’t Mean Passive

At HIPAA Secure Now, we offer fully editable HIPAA policies, but we go further. Our guided risk analysis, employee training, and support help turn those policies into tools your team can use—day in and day out.

A policy that lives in a drawer can’t protect your practice. One that’s reviewed, customized, and applied across departments can make a measurable difference.

See how our HIPAA policy templates, training, and risk assessments work together to keep your organization compliant.

The post Why Your HIPAA Policies Shouldn’t Live in a Drawer appeared first on HIPAA Secure Now!.

AI tools like ChatGPT and Microsoft Copilot are finding their way into healthcare workflows—from drafting internal memos to summarizing meeting notes. While these tools offer convenience, they also introduce new compliance risks, particularly when staff members use them without structured guidance.

The danger isn’t malicious misuse. It’s casual, well-intentioned tasks that quietly edge past HIPAA boundaries.

Prompts Are the New Policy Risk

Imagine a staff member asking an AI tool:

“Summarize this intake form to identify follow-up questions. The patient noted past treatment for Lyme disease, chronic fatigue, and allergies to penicillin.”

No names. No dates. Still risky.

Why? Because AI tools—unless configured specifically for healthcare with a Business Associate Agreement (BAA)—may log that information or send it to third-party servers. Even de-identified text can pose a HIPAA risk if re-identification is possible based on context.

And if that same employee uploads the actual form for summarization? You’ve crossed the line entirely.

Practical Guidelines for Prompting AI Safely

To reduce your compliance exposure, consider training staff with these specific, realistic tactics:

1. Always Assume AI Tools Log Inputs

Unless you’re using a platform under a signed BAA, treat every prompt as public. Even enterprise tools like Copilot must be configured correctly before use.

Tip: Set internal defaults to “no uploads” and restrict AI use to templated tasks—not patient-specific queries.

2. Use Synthetic or Coded Data in Prompts

Need to draft a policy update or procedure template? Use mock data.

Instead of: “Write a letter to a patient who missed their 3-month diabetes checkup”

Try: “Write a template reminder for recurring chronic care appointments (e.g., diabetes) with flexible date and tone options.”

3. Limit Tasks to Non-Sensitive Use Cases

AI is great for brainstorming, rewording standard copy, or summarizing industry news—not analyzing clinical notes or interpreting patient documentation.

Safe use cases:

• Drafting generic FAQs for your website

• Summarizing HIPAA rule changes

• Rewriting patient onboarding instructions (after manual redaction)

4. Document Your AI Acceptable Use Policy

Verbal direction isn’t enough. Create a short, clear policy on when, how, and why AI can be used—then make training mandatory.

Include:

• Approved tools

• Prohibited prompt types

• Consequences of misuse

• Review cycles for updates

5. Keep Training Active, Not Passive

Annual compliance refreshers won’t cover this. Staff need short, practical refreshers tied to actual workflows.

Tip: Use “prompt audits” quarterly to spot common missteps. Think of it like a phishing simulation—but for AI.

The Role of AI Training in Compliance Strategy

Smart policies don’t mean much if staff aren’t equipped to apply them. AI tools evolve fast, and so does the regulatory landscape. Without targeted AI training, even experienced team members can make assumptions that lead to serious compliance gaps.

At HIPAA Secure Now, our AI Awareness Suite was built specifically configured for healthcare and covered under a Business Associate Agreement—combining technical know-how with practical restraint. From prompt safety basics to acceptable use frameworks, it’s designed to scale across roles and risk levels.

Don’t wait for OCR guidance to catch up. Train your staff now and use AI with confidence.

Explore our AI training solutions to protect your practice from accidental exposure—one prompt at a time.

The post Is Your Staff Prompting AI Safely? What You Need to Know Now appeared first on HIPAA Secure Now!.