Patch management is the process of identifying, prioritizing, acquiring, installing, evaluating, and verifying software and system updates. It helps correct security weaknesses while reducing the risk that an update will disrupt operations or affect electronic protected health information (ePHI). 

How do covered entities and business associates know what needs patching? Common sources include: 

• Vendor notifications and security advisories  

• Automated vulnerability scans  

• Penetration-testing results  

• Government resources, such as CISA’s Known Exploited Vulnerabilities Catalog  

• IT or managed service provider reports  

• Internal risk analyses and system reviews  

The U.S. Department of Health and Human Services (HHS) proposed significant HIPAA Security Rule changes in December 2024. As of today, the proposal has not been finalized. The federal regulatory agenda identifies July 2027 as an estimated final-action date, but that date is not binding and may change. 

If finalized as proposed, covered entities and business associates would need written procedures for identifying, prioritizing, acquiring, installing, evaluating, and verifying patches, updates, and upgrades across relevant electronic information systems. These procedures would need to be reviewed and tested at least annually. 

Critical risks generally would need remediation within 15 calendar days after the need is identified when a patch, update, or upgrade is available. High risks generally would need remediation within 30 calendar days. If remediation is unavailable, the applicable period would begin when it becomes available. Organizations would set and document timelines for other risks. 

Limited exceptions would apply when remediation is unavailable or would adversely affect the confidentiality, integrity, or availability of ePHI. The organization would have to document the exception in real time and implement appropriate compensating controls. 

Organizations should not wait. The HHS Office for Civil Rights has confirmed that the current HIPAA risk-analysis requirement includes risks and vulnerabilities to ePHI from unpatched software. 

The post HIPAA Patch Management: What to Prepare For appeared first on HIPAA Secure Now!.

For healthcare leaders, multi-factor authentication, or MFA, is more than an IT decision. It is a business decision that directly affects patient trust, operational resilience, regulatory risk, and the organization’s reputation. 

Healthcare organizations rely on digital systems for patient records, billing, scheduling, communication, and clinical workflows. When access to those systems is compromised, the impact can extend far beyond a single account. A breach can expose electronic protected health information (ePHI), interrupt patient care, create costly recovery work, and damage the trust an organization has worked hard to build. 

Passwords Alone Are No Longer Enough 

Passwords remain one of the most common entry points for attackers. They can be stolen through phishing emails, exposed in data breaches, reused across multiple accounts, or purchased on the dark web. 

Even a strong password cannot provide complete protection if it falls into the wrong hands. 

MFA adds another layer of verification before access is granted. In addition to entering a password, the user must confirm their identity through another method, such as an authentication application, security key, or unique code. 

That additional step makes it much more difficult for an attacker to enter a system using stolen credentials alone. 

Why MFA Matters in Healthcare 

Healthcare organizations and their business associates manage highly sensitive information across a wide range of systems, users, and locations. Employees may access ePHI from clinical workstations, laptops, mobile devices, cloud platforms, or remote environments. 

A single compromised account could provide an attacker with access to patient data, email, shared files, administrative systems, or connected applications. Privileged accounts, remote access tools, and systems containing ePHI should be especially important priorities when implementing MFA. 

HIPAA Expectations Are Changing 

MFA is also becoming a more urgent HIPAA consideration. 

Under the current HIPAA Security Rule, some access-control safeguards are considered addressable, allowing organizations to evaluate how they apply based on their circumstances. The proposed HIPAA Security Rule updates would establish stronger and more consistent expectations for MFA. 

Although the proposed rule has not been finalized and its requirements may change, the direction is clear: healthcare organizations should prepare for stronger access controls. 

A Practical Step You Can Take Now 

Implementing MFA now can reduce the likelihood of unauthorized access while supporting several broader organizational goals. It can strengthen cyber insurance readiness, support Security Risk Assessment findings, protect remote and privileged accounts, and demonstrate due diligence to patients, partners, and regulators. 

There may be brief adjustments as employees become familiar with a new login process, but that inconvenience is small compared with the disruption that can follow a compromised account. 

The question is no longer whether MFA adds another step. The real question is whether your organization can afford to rely on passwords alone. 

MFA is one of the most practical and effective steps healthcare leaders can take today to reduce risk, protect ePHI, and prepare for where HIPAA expectations are heading. 

The post Why MFA Is Essential for Healthcare Organizations appeared first on HIPAA Secure Now!.

As healthcare organizations prepare for the proposed updates to the HIPAA Security Rule, one area receiving significant attention is encryption. 

While the rule has not yet been finalized and may change before publication, the proposal makes the overall direction clear: encryption is expected to become a foundational safeguard for protecting electronic protected health information (ePHI), rather than an addressable implementation specification. 

For many healthcare organizations, this is an opportunity to evaluate whether their current security practices align with where HIPAA expectations are heading. 

Protecting ePHI at Rest and in Transit 

If the proposed rule is finalized as written, organizations should expect encryption to be applied much more broadly to ePHI at rest, meaning data stored on devices or systems. 

This includes: 

• Laptops, desktops, tablets, and smartphones that store or access ePHI 

• Servers and databases containing ePHI 

• Backup media, including external hard drives and cloud backups 

• Portable storage devices such as USB drives 

The proposal also reinforces the importance of protecting ePHI while it is in transit, or moving between locations or systems. 

Examples include: 

• Encrypted email solutions 

• Secure web connections 

• Virtual Private Networks (VPNs) for remote access 

• Encrypted communications between healthcare applications and cloud services 

These safeguards help reduce the risk of unauthorized access while sensitive patient information is being stored, shared, or transmitted. 

Start Preparing Now 

Healthcare organizations do not need to wait for the final rule before evaluating their encryption posture. 

A practical first step is creating or updating a technology asset inventory to identify every device, application, and system that creates, receives, maintains, or transmits ePHI. From there, organizations can confirm encryption is enabled where appropriate, document current encryption standards, and identify any legacy systems that may not support modern encryption practices. 

Taking these steps now can help reduce future implementation costs while strengthening your organization’s overall cybersecurity posture. 

HIPAA Secure Now Is Here to Help 

Although the final rule may differ from the current proposal, the direction is becoming increasingly clear. Strong encryption is quickly becoming an expected safeguard for protecting patient data. 

HIPAA Secure Now is here to help healthcare organizations understand what may be changing, evaluate their current security posture, and prepare before the compliance clock starts. If you have questions about encryption, asset inventories, or your organization’s HIPAA readiness, our compliance team is ready to help. 

The post Encryption and the Proposed HIPAA Security Rule Changes appeared first on HIPAA Secure Now!.

In January 2021, the U.S. Department of Health and Human Services (HHS) published a Notice of Proposed Rulemaking (NPRM) proposing updates to the HIPAA Privacy Rule. The proposal was intended to remove barriers to coordinated care, improve individuals’ access to their health information, reduce unnecessary administrative burden, and strengthen certain patient rights while continuing to protect the privacy of protected health information (PHI).

The proposal has remained under federal review for several years. If a final rule is published, it may adopt some, all, or none of the originally proposed changes. 

When Could This Happen? 

While HHS has not announced an official publication date, the final rule is widely expected to be published as early as August 2026 based on the federal regulatory agenda.

If finalized, organizations will not be expected to comply immediately. Historically, HIPAA rules have become effective 60 days after publication, with compliance required approximately 180 days later. The final rule will establish the official effective and compliance dates. 

What Was Included in the Proposal? 

The proposed rule included several notable changes, including but not limited to: 

Patient Access and Individual Rights 

• Proposing to reduce the time to respond to an individual’s request for access to PHI from 30 calendar days to 15 calendar days  

• Proposing to strengthen an individual’s right to inspect PHI in person, including the ability to take notes and photographs  

• Proposing changes to certain fees for copies of PHI, including additional transparency through website fee schedules, individualized fee estimates, and itemized bills  

• Creating a pathway for individuals to direct electronic PHI maintained in an electronic health record (EHR) to another covered healthcare provider or health plan  

Care Coordination and Permitted Disclosures 

• Expanding and clarifying certain permitted uses and disclosures of PHI to improve care coordination and case management  

• Proposing changes affecting disclosures to social service agencies and community-based organizations involved in an individual’s care  

• Proposing updates to certain standards governing disclosures to family members and caregivers in specific situations  

• Proposing to replace the current “serious and imminent threat” standard with a “serious and reasonably foreseeable threat” standard for certain disclosures made to prevent or lessen a threat to health or safety. 

• Clarifying the application of the minimum necessary standard for certain disclosures and requests for PHI to reduce unnecessary barriers to care while maintaining privacy protections  

Notice of Privacy Practices (NPP) 

• Proposing revisions to the Notice of Privacy Practices (NPP), including eliminating the requirement to obtain a patient’s written acknowledgment of receipt while retaining the requirement to provide the notice  

• Proposing changes to the required content and format of the NPP to better inform individuals of their privacy rights  

Administrative and Operational Changes 

• Clarifying several administrative provisions intended to reduce unnecessary regulatory burden while maintaining privacy protections 

While the proposal covers many topics, its primary focus is improving patient access, supporting care coordination, reducing administrative burden, and updating the Notice of Privacy Practices. These changes remain proposals until a final rule is published.
 

What Could This Mean for Covered Entities and Business Associates and What Should They Do Now? 

Covered entities are expected to be most directly affected by many of the proposed operational changes. Business associates should also review the final rule to determine whether any contractual, operational, or policy updates may be necessary.

Depending on the final rule, organizations may need to evaluate: 

• HIPAA policies and procedures 

• Patient access request workflows 

• Notice of Privacy Practices 

• Workforce training 

• Forms and documentation 

• Business associate agreements and operational processes that support HIPAA compliance 

The final requirements, effective date, and compliance deadlines will not be known until HHS publishes the final rule.

Now is a good time to: 

• Stay informed about the publication of the final rule 

• Begin identifying policies and workflows that could be affected if the proposed changes are adopted 

• Plan time and resources to review and implement any new requirements once the final rule is published 

The post A HIPAA Privacy Rule Update Could Arrive as Early as August 2026. Here’s What Covered Entities and Business Associates Should Know appeared first on HIPAA Secure Now!.

The proposed updates to the HIPAA Security Rule are expected to move forward in 2027, and if the rule is finalized as proposed, healthcare organizations could have as little as 180 days to demonstrate compliance. 

While six months may sound like plenty of time, the reality is different for many healthcare practices. Budget planning often happens only once a year, and significant security improvements can take time to evaluate, purchase, implement, and document. 

That is why now is the right time to start the conversation. 

Budgeting Today Can Prevent Scrambling Tomorrow 

Preparing for the proposed rule does not mean you need to invest in every security solution immediately. Instead, think of this year’s budgeting process as an opportunity to identify potential gaps, prioritize future investments, and create a roadmap that aligns with your organization’s needs. 

Many of the safeguards highlighted in the proposed rule are already considered cybersecurity best practices and can strengthen your organization’s security regardless of when the final rule is published. 

As you build your 2027 budget, consider planning for investments such as: 

• Multi-factor authentication (MFA) 

• Encryption 

• Technology asset inventories 

• Vulnerability scanning and remediation 

• Backup and disaster recovery testing 

• Security Risk Assessments and ongoing risk management 

• HIPAA and cybersecurity awareness training 

• Updated policies and procedures 

• Business associate and vendor risk management 

Work with Your Trusted Advisors 

You do not have to figure out every requirement on your own. 

Now is an excellent time to meet with your IT provider, managed service provider (MSP), or compliance partner to review your current security posture, discuss where improvements may be needed, and estimate future costs. Having those conversations before budgets are finalized gives your organization greater flexibility and helps avoid unexpected expenses later. 

Prepare with Confidence 

Organizations that budget and plan ahead are far less likely to face rushed purchasing decisions, implementation delays, or last-minute compliance challenges if the final rule moves forward. 

More importantly, many of these investments provide immediate value by reducing cybersecurity risk, strengthening the protection of electronic protected health information (ePHI), and improving your overall security posture. 

HIPAA Secure Now is here to help healthcare organizations prepare before the clock starts. By taking practical steps today, you can make the 180-day compliance window far more manageable while building a stronger, more resilient organization for the future. 

The post Preparing Your 2027 Budget for the Proposed HIPAA Security Rule appeared first on HIPAA Secure Now!.

For healthcare executives and practice owners, cybersecurity is no longer just an IT responsibility. It is a business risk, a patient trust issue, and a core part of HIPAA compliance. 

As cyberattacks against healthcare organizations continue to rise, conducting a thorough Security Risk Assessment, or SRA, is one of the most important steps your organization can take to protect electronic protected health information, also known as ePHI. 

Read more: Opportunities for MSPs in Healthcare

More Than a Compliance Requirement 

The HIPAA Security Rule requires covered entities and business associates to regularly evaluate risks to ePHI. But a strong SRA should be more than a compliance exercise. 

It should help your organization understand where sensitive data lives, how it moves, who can access it, and where vulnerabilities may exist across systems, vendors, devices, and workflows. 

Read more: Why Continuous Training Beats One-and-Done Cyber Awareness

Visibility Is the First Step Toward Protection 

Without clear visibility, healthcare organizations may overlook gaps that could lead to unauthorized access, data exposure, operational disruption, or regulatory scrutiny. 

A well-executed SRA gives leaders a practical roadmap. It helps identify weaknesses, prioritize security investments, strengthen policies and procedures, and document the steps your organization is taking to reduce risk. 

For small and mid-sized healthcare practices that may not have a dedicated compliance officer, this kind of guidance can make HIPAA readiness feel more manageable. 

Read More: Proactive Cybersecurity Strategies to Protect Your Business

Proposed Rule Changes Raise the Stakes 

The proposed updates to the HIPAA Security Rule reinforce the importance of moving beyond a “check-the-box” approach. 

If finalized as proposed, the changes could require more detailed documentation, regular reassessments, technology asset inventories, ePHI mapping, and ongoing risk management. 

In other words, risk analysis is not something to complete once and file away. It is an ongoing process that should evolve as your technology, workforce, vendors, and threat landscape change. 

OCR Is Paying Attention 

The U.S. Department of Health and Human Services Office for Civil Rights has also emphasized risk analysis through its enforcement activity. Inadequate or missing SRAs continue to appear in investigations, often leading to penalties and corrective action plans. 

Build Confidence Before Pressure Builds 

A Security Risk Assessment does more than support HIPAA compliance. It helps healthcare leaders make informed decisions, protect patient data, strengthen trust, and build a more resilient organization. 

HIPAA Secure Now is here to help healthcare organizations take that next step with confidence. 

The post The SRA: Your Roadmap to Stronger HIPAA Compliance appeared first on HIPAA Secure Now!.

The proposed HIPAA Security Rule update has not been finalized yet, but small healthcare practices should not wait until the deadline is set to start preparing. 

One practical step your organization can take now is to begin building, reviewing, or updating your asset inventory. 

An asset inventory is a documented list of the systems, devices, software, vendors, and access points that may create, receive, maintain, or transmit electronic protected health information, also known as ePHI. While asset inventories have not historically been listed as a specific HIPAA Security Rule requirement, the proposed updates could make them a much more formal expectation. 

More importantly, an asset inventory is a smart foundation for your overall security and compliance program. 

Why does it matter? 

Because you cannot protect what you do not know exists. If your practice does not have a clear picture of where ePHI lives, how it moves, and who can access it, your risk analysis may miss important gaps. That can make it harder to identify vulnerabilities, update policies, manage vendor risk, and show that your organization is taking reasonable steps to protect patient data. 

A strong asset inventory should include: 

• Hardware, such as computers, laptops, mobile devices, servers, medical devices, and equipment that touches ePHI 

• Software and applications, including EHR/EMR systems, billing platforms, cloud tools, and other SaaS applications 

• Data flows that show where ePHI is stored, transmitted, and accessed 

• Vendors and business associates that interact with your systems or patient data 

• Network components, such as routers, firewalls, remote access tools, and other connection points 

• User access, including who has access to what and at what permission level 

The goal is not perfection on day one. The goal is visibility. 

Starting now gives your practice time to identify what you use, where patient data may be exposed, and which areas may need stronger safeguards. It can also make future compliance work easier if the proposed rule is finalized and organizations have a shorter window to act. 

HIPAA Secure Now is here to help healthcare organizations take practical steps before the clock starts. For more information, or to request a sample Asset Inventory, please reach out to our compliance team. 

The post Don’t Wait for the Final HIPAA Rule: Start with Your Asset Inventory appeared first on HIPAA Secure Now!.

HIPAA compliance has always required ongoing attention. But with proposed changes to the HIPAA Security Rule now on the table, healthcare organizations may need to prepare for a higher standard of cybersecurity, documentation, and ePHI protection. 

In January 2025, the U.S. Department of Health and Human Services Office for Civil Rights proposed major updates to the HIPAA Security Rule. If finalized as proposed, the updates could raise expectations around cybersecurity, documentation, workforce training, and how electronic protected health information, or ePHI, is protected. 

For small and mid-sized healthcare organizations, that can feel like a lot to take on. You may already be balancing patient care, staffing, billing, vendor relationships, insurance requirements, and daily operations. Adding new compliance expectations to the list can feel like one more thing you don’t have time to manage. 

That is exactly why preparation matters.  

What Could Change?

The proposed updates focus on safeguards healthcare organizations should already be evaluating, including: 

• Technology asset inventories 

• Risk analysis 

• Multifactor authentication 

• Encryption 

• Vulnerability management 

• Contingency planning 

• Documented policies and procedures 

• Stronger incident response planning 

• Business associate oversight 

• Workforce training 

Some of these areas may already be part of your compliance program. Others may need more documentation, stronger processes, or closer review if the rule is finalized as proposed. 

The proposed updates point to a clear theme: healthcare organizations may need to show that safeguards are not only in place, but also documented, reviewed, and maintained over time. 

Why This Matters Now

The response across the healthcare industry has been mixed. Many healthcare organizations have raised concerns about cost, timing, operational burden, and the potential impact on smaller or rural providers. At the same time, federal lawmakers continue to discuss stronger cybersecurity expectations across healthcare, including legislation aimed at improving cybersecurity resilience throughout the industry. 

Those developments may seem to pull in different directions, but they point to the same reality: healthcare organizations should be paying close attention to cybersecurity and HIPAA compliance. 

The timeline is what makes this especially important. If the proposed rule is finalized as written, covered entities and business associates may have as little as 180 days to demonstrate compliance. 

That is a short runway for organizations that may need to: 

• Identify compliance and security gaps 

• Update policies and procedures 

• Implement or strengthen security controls 

• Train employees 

• Review vendor and business associate relationships 

• Document compliance efforts 

For organizations without a dedicated compliance officer or internal HIPAA expert, waiting could make the process more stressful than it needs to be. 

Preparation Doesn’t Have to Happen All at Once

The good news is that preparing for what may be coming doesn’t mean everything overnight. 

 It starts with understanding what has been proposed, reviewing where your compliance program stands today, and taking practical steps to strengthen the safeguards that protect patient data. 

That may include reviewing your Security Risk Assessment, confirming policies and procedures are current, checking how your organization manages employee training, and looking more closely at areas like MFA, encryption, vendor oversight, and incident response. 

It also means helping employees understand their role in protecting patient data, especially as cyber threats, AI tools, and Microsoft 365 usage continue to shape daily healthcare operations. 

HIPAA Secure Now Can Help 

Since 2010, HIPAA Secure Now has helped more than 5,000 healthcare organizations strengthen HIPAA compliance, protect patient data, and reduce cyber risk. 

We provide HIPAA training, Security Risk Assessments, policies and procedures, phishing awareness, vulnerability tools, AI training, Microsoft 365 productivity training, and compliance support designed specifically for healthcare organizations. 

Our connected compliance and training platform helps make HIPAA easier to understand, document, and maintain over time, so your organization can take practical steps before the deadline is set. 

Protecting patient data is about more than meeting a requirement. It’s about knowing you can answer with confidence when someone asks, “Can you show me your HIPAA compliance program?” 

The proposed rule is not final yet. The time to prepare is before the deadline is set. 

Download the Industry Brief

Learn what may be changing, why it matters, and how HIPAA Secure Now can help your organization prepare.

The post What the Proposed HIPAA Security Rule Changes Could Mean for Your Organization appeared first on HIPAA Secure Now!.

Walk into any medical office today, and you’ll probably hear the soft ping of an email, maybe a Teams message popping up on someone’s screen. Chances are someone else is copying patient instructions into a word processor or using a chatbot to summarize notes. It all blends in with the workday.

The tools feel familiar. That’s the problem.

When something feels routine, it’s easy to forget how much risk it carries. Especially when the systems involved are handling patient data. Most teams aren’t doing anything malicious—they’re just moving fast, solving problems, and trying to get through the day. That’s exactly when mistakes happen.

An acceptable use policy helps with that. Not by scaring people, but by drawing clear lines around what’s appropriate, what’s not, and what should trigger a pause.

Where Most People Slip Up: Email

Email feels harmless. It’s the go-to for appointment reminders, referral requests, lab results, and staff communication. But it’s also one of the easiest places for patient information to leak.

Some examples:

• Sending the wrong attachment to the right person

• Forgetting to BCC on a group message

• Forwarding a sensitive message to a personal inbox so it’s easier to print at home

None of these actions start with bad intentions. But they create real exposure.

A policy needs to call that out, plainly. Staff should know when it’s okay to send PHI over email, and when it’s not. If encryption isn’t automatic, that needs to be clear too. Some offices go further and restrict emailing PHI altogether unless a secure system is used.

Make sure people understand the rules before a mistake forces the conversation.

AI Use Is Growing Fast

There’s no shortage of tools that promise to speed things up. From grammar checkers built into browsers to full-blown AI assistants, people are using them. Often without asking.

And here’s the thing: many of these platforms collect and store the input they’re given. That includes copy-pasted notes, emails, and yes—patient details.

If an employee pastes a progress note into an AI tool to rewrite it “more clearly,” that data leaves your system. You don’t get it back. There’s no agreement in place, no guarantee of security.

This isn’t about banning technology altogether. Some AI tools are safe to use for general writing help. But the line needs to be clear: don’t feed these systems sensitive information, ever. The policy should say so in plain terms. No fine print, no room for interpretation.

Personal Devices and Apps: Another Blind Spot

Most people don’t think twice about checking work email on their phone. Or jotting a reminder in their Notes app. Maybe they message a coworker a patient name to coordinate care. All of it seems efficient—until something gets lost, copied, or accidentally sent to the wrong contact.

If personal devices are allowed, that has to come with conditions. Require passcodes. Disable app syncing for certain platforms. Clarify which apps are approved and which aren’t. And make sure everyone knows where the boundaries are.

Without a shared understanding, people fill in the blanks themselves. That’s where risk lives.

The Policy Only Works If People Understand It

A 12-page acceptable use document full of legalese won’t help your team avoid trouble. Nobody reads it. And if they do, they won’t remember it.

Keep it short. Use plain language. Give real examples of what’s allowed and what’s not. Review it regularly, not just during onboarding. Post the top five takeaways where people will actually see them—break rooms, log-in screens, onboarding packets.

Training helps too. Not a video once a year, but small, repeatable reminders tied to the tools people actually use.

Before You Rework Your Policy

If any of this feels familiar, that’s probably a good thing. It means you’re noticing where gaps exist—and that’s the first step toward fixing them.

HIPAA Secure Now offers real-world training and policy templates that make acceptable use more than just a document. We help healthcare teams apply these rules to the tools they use every day, like email, Microsoft 365, and even AI.

Want to build a policy that actually sticks? Reach out. We’ll help you get it done right.

The post What Is Acceptable Use in a Medical Office? appeared first on HIPAA Secure Now!.

If you run or support a small healthcare organization, you’re probably used to doing more with less. You manage compliance, care, billing, and tech—often without a big team or deep pockets. So when you hear terms like “Generative AI training,” it might feel out of reach.

But the 2025 Wolters Kluwer Future Ready Healthcare Survey says otherwise.

Most healthcare leaders aren’t ahead of the curve—they’re still trying to figure it out. According to the study:

• 80% say optimizing workflows is a top priority

• 76% want to reduce clinician burnout

• Only 36% feel truly prepared to use GenAI to solve those problems

• And just 18% have policies in place to guide AI use

That gap between goals and action? It’s where risk lives and opportunity begins.

When GenAI Shows Up Quietly, So Do the Risks

Here’s what’s happening in most healthcare environments right now: someone on the team uses ChatGPT to rewrite patient instructions. A front desk staffer asks it to draft a policy update. A manager tries out an AI-based transcription tool for meeting notes.

They’re not doing anything wrong—they’re just trying to move faster. But without training or guardrails, things get risky fast:

• PHI slips into a chatbot

• Sensitive notes end up stored on external servers

• AI-generated content gets mistaken for accurate medical guidance

These aren’t theoretical risks. They’re happening now. And in healthcare, even small mistakes can have serious consequences.

The Survey’s Real Takeaway? No One Has This Fully Figured Out

The most surprising part of the Wolters Kluwer survey isn’t that AI is rising. It’s that even major health systems aren’t fully prepared. Less than 1 in 5 organizations have formal GenAI policies. Fewer than 1 in 4 offer staff training.

That means smaller practices and business associates have a real chance to lead—not by doing more, but by doing the right things first.

What That Could Look Like for You

Let’s keep it simple. Here’s what “taking the lead” might mean for your team:

• Start by talking about where AI already shows up—in Microsoft 365, in browser tools, in EHR plug-ins

• Create a basic acceptable use policy to help staff understand what’s safe to share and what’s not

• Offer short, practical GenAI training that explains risks in plain language

• Review tools you’re already using to see if any of them now include AI features you didn’t plan for

You don’t need a full-time AI officer. You need awareness, clarity, and some shared language to keep your team aligned.

Moving Slowly Isn’t the Same as Moving Safely

A lot of healthcare leaders are taking the “wait and see” approach. That’s understandable. But it won’t stop your staff—or your vendors—from adopting GenAI anyway.

The Wolters Kluwer survey makes this clear: the pressure to adopt AI is already here. But most organizations aren’t matching that pressure with preparation. That’s where risk starts to grow—quietly, in day-to-day tools, far from the IT department.

The solution isn’t to rush. It’s to educate. A little clarity now can prevent a lot of mess later.

Want a Simple Way to Move Forward?

At HIPAA Secure Now, we’ve helped healthcare organizations build strong foundations around security, compliance, and training for years. Now we’re doing the same with AI.

Our Generative AI Training is built specifically for covered entities and business associates. It covers:

• What GenAI is (and what it’s not)

• How to use it safely in a HIPAA-regulated environment

• The right way to talk about it with staff and vendors

• And how to introduce it without overcomplicating the process

It’s short, practical, and designed to help you stay in control of where GenAI shows up next.

→ Want to start the conversation inside your organization? Let’s talk.

The post Most Healthcare Leaders See the Promise of GenAI—Only 36% Feel Ready appeared first on HIPAA Secure Now!.