A recent cybersecurity threat is a reminder that older or overlooked technology can put patient information and daily operations at risk. 

In October 2026, two serious PHP software vulnerabilities, collectively called PHP2Shell, prompted cybersecurity warnings. PHP (PHP Hypertext Processor) is used behind the scenes in some websites and applications. It is a programming language that helps websites and online applications work behind the scenes. For example, when you submit an appointment request through a website built with PHP, it can process the information you entered and send back a confirmation. Attackers could run malicious code on affected systems without logging in. The original article reports that CISA urged organizations to identify and update vulnerable systems. 

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026. The Cybersecurity and Infrastructure Security Agency (CISA) subsequently added both to its Known Exploited Vulnerabilities catalog on October 26, confirming that attackers were actively exploiting these weaknesses. 

 CISA has urged organizations to identify affected PHP installations and apply security updates immediately, prioritizing systems accessible from the internet. 

Your practice may use PHP without knowing it. It could be part of a website, patient portal, scheduling tool, billing application, or older administrative system. Not all these systems use PHP or are affected; your IT provider or vendor must determine actual exposure. 

Why This Matters for Healthcare 

A vulnerable application does not have to be your electronic health record (EHR) to cause trouble. An attack on a connected or administrative system could interrupt scheduling, billing, insurance verification, or patient communication. If electronic protected health information (ePHI) is involved, unauthorized access could also create privacy and security concerns. 

The HIPAA Connection 

The HIPAA Security Rule requires organizations to assess risks and vulnerabilities to ePHI and implement appropriate safeguards. This includes considering older applications, vendor-managed tools, and other systems that store, transmit, or provide access to ePHI—not just the main EHR. 

A vulnerability scan can identify some technical weaknesses, but it does not replace a comprehensive HIPAA Security Risk Analysis. Identified risks also need to be addressed and documented. 

Five Practical Steps for Your Practice 

• Ask IT what systems you use. Have your IT provider review websites, servers, portals, older applications, and other tools for potentially affected PHP components.
• Confirm updates and vendor guidance. Ask whether any systems are affected and whether security patches or other protective steps have been completed. Prioritize internet-facing systems.
• Check for signs of compromise. Patching does not undo an earlier attack. Have qualified personnel investigate suspicious activity and follow your incident response process when appropriate.
• Review your Security Risk Analysis. Make sure older systems, third-party applications, and changes to how ePHI is handled are considered. Document risks and corrective actions.
• Remind employees to report concerns. Staff should promptly report unusual system behavior or access requests and obtain approval before using new applications.

The Bottom Line 

The biggest lesson from PHP2Shell is not that every healthcare practice has this vulnerability. It is that organizations need to know what technology they rely on, and who is responsible for keeping it secure. Regular IT reviews, timely updates, a thorough Security Risk Analysis, and employee awareness all help protect patient information and keep care running. 

HIPAA Secure Now helps healthcare organizations strengthen compliance through Security Risk Analysis, employee training, and cybersecurity education.

The post PHP2Shell: What Healthcare Practices Need to Know appeared first on HIPAA Secure Now!.

A cybersecurity incident doesn’t have to stop patient care to seriously disrupt a healthcare organization. 

The recent Luminis Health incident is a good example: 

On September 1, Luminis reported that a cybersecurity incident had made certain systems unavailable. Hospitals and care locations remained open, but MyChart and other digital services were affected, some processes took longer, and patients were told they might need to complete paper forms. 

And recovery wasn’t immediate. 

Luminis relied on downtime procedures while systems were unavailable. Phone service was restored in stages, MyChart returned later in September, and even after systems were restored, teams were still reconciling and entering documentation from visits that happened during the downtime. 

That’s an important reminder: Cyber incident response isn’t only about getting systems back online. It’s about keeping the organization functioning while they’re unavailable. 

What Would Your Team Do? 

If your EHR suddenly went down today: 

• Do employees know where to find downtime procedures? 

• Can patient care continue using approved processes? 

• Does everyone know who to contact? 

• Is there a plan for reconciling information once systems return? 

Those are much easier questions to answer before an incident begins. 

Preparedness Has to Work in the Real World 

The Luminis incident shows why healthcare organizations need more than a plan sitting in a file. 

Employees need to understand what to do when normal systems aren’t available, and how to keep work moving without creating new privacy or security risks. 

Cybersecurity Awareness Month may be ending, but preparedness can’t be seasonal. 

HIPAA Secure Now’s Healthcare Security & Privacy Incident Response Checklist can help your organization think through the people, processes, and decisions that matter before an incident happens. 

Don’t wait for downtime to find out whether your plan works. 

Download the Healthcare Security & Privacy Incident Response Checklist

The post When Systems Go Down: What the Luminis Health Incident Reminds Us About Preparedness appeared first on HIPAA Secure Now!.

Cybersecurity Awareness Month isn’t only an opportunity to remind employees to watch for phishing emails or protect their passwords. 

It’s also a good time for healthcare leaders to ask a bigger question: Are the cybersecurity fundamentals actually working across your organization? 

Here are six questions worth asking. 

1. Do employees know how to report something suspicious?

If someone receives a suspicious email, unexpected MFA prompt, strange phone call, or notices unusual system activity, do they know exactly what to do? 

Quick check: Ask a few employees how they would report a cybersecurity concern. If the answers are different—or they don’t know—you’ve found a gap. 

2. Is your Security Risk Analysis current, and are you acting on what it found?

Your Security Risk Analysis should reflect the systems, devices, locations, vendors, and workflows your organization uses today. 

But identifying risks is only the first step. Those findings need to lead to action. 

Quick check: Have you added new technology, vendors, locations, or ways of handling electronic protected health information since your last assessment? Then pick a few risks from your most recent analysis. Can you identify what has been done, who owns the next step, and what still needs attention? 

3. Do you know where your ePHI lives?

Electronic protected health information can exist well beyond the EHR. 

Think email, mobile devices, cloud applications, file-sharing tools, medical devices, backups, and other systems employees use every day. 

Quick check: Is there anywhere ePHI is stored, transmitted, or accessed that isn’t reflected in your current documentation? 

4. Are employees prepared for unexpected login requests?

Multifactor authentication adds another layer of protection, but employees still need to recognize when something isn’t right. 

Quick check: Do employees know not to approve an MFA request they didn’t initiate—and how to report it? 

5. Are systems and software being kept current?

Unpatched or unsupported technology can create opportunities for attackers. 

Quick check: Ask whether there are critical updates, known vulnerabilities, or outdated systems that still need attention. 

6. Does cybersecurity training continue after annual training is complete?

Annual training can establish a foundation. But employees make security decisions all year. 

Phishing changes. Social-engineering tactics evolve. People forget. 

Quick check: What is your organization doing between annual training sessions to keep cybersecurity habits top of mind? 

Cybersecurity Is an Ongoing Practice 

You don’t need to solve every cybersecurity challenge during October. 

But Cybersecurity Awareness Month is a good reason to ask the questions, identify gaps, and decide what needs attention next. 

And when it comes to your workforce, reinforcement matters. 

HIPAA Secure Now’s PHIshMD Ongoing Training Program helps healthcare organizations keep cybersecurity top of mind throughout the year with bite-sized training, simulated phishing, and ongoing visibility into employee risk. 

Don’t make cybersecurity a once-a-year conversation.

Click Here to Learn More About PHIsh MD

The post 6 Cybersecurity Questions Healthcare Leaders Should Ask This October appeared first on HIPAA Secure Now!.

Cybersecurity training doesn’t always have to mean another long meeting. 

A five-minute conversation during a staff meeting, morning huddle, or shift change can help employees think through the kinds of situations they may actually face, and reinforce what to do before they’re under pressure. 

For Week 2 of Cybersecurity Awareness Month, here are four quick discussions you can use with your healthcare team. 

How to use them: Read the scenario, ask the questions, and close with the takeaway. That’s it. 

Huddle 1: The “Urgent” IT Request 

The Scenario 

You receive a call from someone who says they’re with IT. 

They know your name and where you work. They tell you there’s a security problem with your account and you need to reset your password immediately using a link they send you. 

Ask Your Team 

• What would make you suspicious? 

• What should you do before following the caller’s instructions? 

• How would you verify that the request is legitimate? 

The Takeaway 

Attackers often create urgency so you’ll act before you have time to question the request. 

If someone unexpectedly asks you to reset a password, change a security setting, provide a code, or take another sensitive action, stop and verify the request through a contact or process you already trust. 

The habit: Pause. Verify. Then act. 

Huddle 2: The Login You Didn’t Start 

The Scenario 

Your phone asks you to approve a multifactor authentication request. 

You aren’t logging into anything. 

A few minutes later, another request appears. 

Ask Your Team 

• What could be happening? 

• Should you approve the request just to make the notifications stop? 

• What should you do next? 

The Takeaway 

An unexpected MFA request can mean someone else is trying to access your account. 

Deny the request and report it according to your organization’s procedures. 

Never approve a login you didn’t initiate or share authentication codes with someone who contacts you unexpectedly. 

The habit: If you didn’t start it, don’t approve it. 

Huddle 3: “Just Text It to Me” 

The Scenario 

A coworker needs patient information quickly and says: 

“Just text it to my personal phone. It’ll be faster.” 

Everyone is busy, and the request seems harmless. 

Ask Your Team 

• What should you consider before sending the information? 

• Is convenience enough reason to use a different tool? 

• What should you do if you aren’t sure whether a communication method is approved? 

The Takeaway 

When patient information is involved, the fastest option isn’t always the right one. 

Use the tools and processes your organization has approved. If you’re unsure, ask before creating your own workaround. 

The habit: Before you send, check where it’s going. 

Huddle 4: The EHR Is Down 

The Scenario 

You arrive at work and can’t access the EHR. 

Other employees are having the same problem. Patients are arriving, phones are ringing, and everyone needs to keep working. 

Ask Your Team 

• What should you do first? 

• Do you know where your organization’s downtime procedures are? 

• What should you avoid doing while systems are unavailable? 

The Takeaway 

Cybersecurity isn’t only about preventing incidents. It’s also about knowing what to do when technology isn’t available. 

Follow your organization’s downtime and incident-response procedures rather than creating unapproved workarounds. 

The habit: Know the plan before you need it. 

Five Minutes Can Reinforce a Habit 

The goal of these conversations isn’t to turn every employee into a cybersecurity expert. 

It’s to make good decisions easier to recognize and repeat. 

That takes more than one annual training session. 

HIPAA Secure Now’s PHIshMD Ongoing Training Program helps healthcare organizations reinforce cybersecurity habits throughout the year with weekly bite-sized training, simulated phishing, and ongoing visibility into employee risk. 

Keep cybersecurity training going all year.
Learn More About PHIsh MD Training

Next week: We’ll turn the focus to healthcare leaders with a practical cybersecurity checkup to help you ask: Are the fundamentals actually working across your organization? 

The post 4 Five-Minute Cyber Huddles for Healthcare Teams appeared first on HIPAA Secure Now!.

Healthcare employees are being targeted. 

Recent reporting from Cybersecurity Dive highlights increased social-engineering activity against healthcare and pharmaceutical organizations. Attackers are using phone calls, phishing sites, and urgent requests to convince employees to reset passwords, change multifactor authentication settings, or give up credentials. 

In fact, Health-ISAC reported that more than a dozen member organizations had been hit by social-engineering attacks in just a few months. 

Cybersecurity Awareness Month is a good opportunity to reinforce a simple idea: employees don’t have to be cybersecurity experts to make it harder for attackers. 

They need to know what to look for, when to slow down, and when to speak up. 

To make that easier, here are four messages healthcare organizations can copy, customize, and share with employees throughout October. 

Before sending: Add your organization’s IT/security contact or reporting process where indicated. 

Message 1: Pause. Verify. Then Act. 

Suggested subject: Before you act, take a second look 

Cybercriminals are getting better at making their requests look and sound legitimate. 

An email may appear to come from a vendor you know. A caller may claim to be from IT. A message may warn you about an urgent problem with your account. 

That urgency is a reason to slow down. 

If someone unexpectedly asks you to click a link, reset a password, approve a login, provide information, or change a security setting: 

• Pause before taking action. 

• Verify the request using a contact or process you already trust. 

• Don’t use a phone number or link provided in a suspicious message. 

• Report anything that doesn’t feel right to your IT/Security or your organization’s preferred reporting method. 

You don’t have to determine whether something is a cyberattack. 

If something seems unusual, stop and verify. 

Message 2: Didn’t Start the Login? Don’t Approve It. 

Suggested subject: One easy rule for unexpected login requests 

Have you ever received a multifactor authentication (MFA) request when you weren’t trying to log in? 

Don’t approve it just to make it go away. 

An unexpected login or MFA request can mean someone else is trying to access your account. 

If it happens: 

• Deny the request. 

• Never share authentication codes with someone else. 

• Don’t reset your password or MFA settings because an unexpected caller asks you to. 

• Report the activity to IT/Security or your organization’s preferred reporting method. 

MFA adds an important layer of protection, but it still depends on us paying attention. 

If you didn’t start the login, don’t approve it. 

Message 3: Keep Patient Information Where It Belongs. 

Suggested subject: Before you send it, check where it’s going 

Healthcare moves quickly, and sometimes the fastest way to get something done can seem like the easiest option. 

When patient information is involved, take an extra moment. 

Before you send, upload, text, or share information, ask yourself: 

• Am I using a tool approved by our organization? 

• Am I sending this to the right person? 

• Does this person need this information? 

• Do I need to share all of it? 

This applies to email, text messages, file-sharing tools, cloud applications, mobile devices, and other technology we use at work. 

If you’re not sure whether a tool or method is approved, check with IT/Security Administrator before using it. 

A quick check can help keep patient information where it belongs. 

Message 4: See Something? Say Something. 

Suggested subject: You don’t have to be sure before you report it 

Something doesn’t seem right. 

Maybe you clicked a link and realized afterward that it looked suspicious. You received an unexpected login notification. Someone called asking you to reset your password. Or a system suddenly isn’t behaving normally. 

Please tell us. 

You don’t have to investigate it yourself, and you don’t have to be certain it’s a cyberattack before reporting it. 

Contact IT/Security Administrator as soon as you notice something unusual. 

And if you clicked something you shouldn’t have? Tell us that too. 

The sooner we know, the sooner we can investigate and take action if needed. 

When in doubt, speak up. 

Keep the Conversation Going All Year 

Cybersecurity Awareness Month is a great reason to put these conversations front and center. But attackers don’t limit their efforts to October, and cybersecurity training shouldn’t be limited to one annual event. 

HIPAA Secure Now helps healthcare organizations keep cybersecurity and HIPAA top of mind throughout the year with ongoing workforce training designed to reinforce important habits before employees need them. 

Build a workforce that keeps learning all year.
Learn More About HIPAA Secure Now Training

Next week: We’ll share five-minute cyber huddles healthcare leaders and managers can use to turn these reminders into quick conversations with their teams. 

The post Cybersecurity Awareness Month: 4 Ready-to-Send Messages for Your Healthcare Workforce appeared first on HIPAA Secure Now!.

Cybersecurity Awareness Month starts today, and for healthcare organizations, the timing matters. 

Recent warnings from Health-ISAC have highlighted social-engineering attacks targeting healthcare employees through tactics like voice phishing, impersonation websites, and urgent requests to reset passwords or change security settings. 

It’s another reminder that cybersecurity isn’t only about technology. 

It’s also about the decisions people make every day. 

• An unexpected phone call. 
• An urgent email. 
• A login request. 

Patient information that needs to be shared quickly. 

October is a good opportunity to reinforce the habits that help employees make those decisions more securely. 

We’re making it easier to put Cybersecurity Awareness Month into action. 

Throughout October, HIPAA Secure Now will be sharing practical resources healthcare organizations can use with their teams: 

• Week 1: Ready-to-send cybersecurity messages for employees 
• Week 2: Five-minute cyber huddles for healthcare teams 
• Week 3: A cybersecurity checkup for healthcare leaders 
• Week 4: Incident response and downtime preparedness 

No complicated campaign. Just useful ideas and resources you can put to work. 

Cybersecurity Awareness Month may last 31 days, but the habits we reinforce now should last all year. 

Follow along throughout October for practical ways to keep cybersecurity conversations going with your workforce.

The post Cybersecurity Awareness Month Is Here. Let’s Put It to Work in Healthcare appeared first on HIPAA Secure Now!.

Most healthcare organizations hope they never have to put their incident response or disaster recovery plans into action. 

But hope is not a recovery strategy. 

When a cyberattack, system outage, natural disaster, or other disruption occurs, the middle of an incident is not the time to discover that responsibilities are unclear, backups cannot be restored quickly, or critical systems were never prioritized. 

That is one of the important themes behind the proposed changes to the HIPAA Security Rule. If finalized, the proposal would establish more specific expectations around how covered entities and business associates prepare for security incidents, respond when they occur, and restore critical systems afterward. 

The bigger takeaway for healthcare organizations is simple: having a plan on paper may no longer be enough. Organizations need to know whether that plan actually works. 

Incident Response: From Having a Policy to Being Prepared 

Under the current HIPAA Security Rule, organizations must have policies and procedures for identifying and responding to suspected or known security incidents, mitigating harmful effects when possible, and documenting incidents and their outcomes. 

The proposed HIPAA Security Rule would add more specific requirements around that process, including a written Security Incident Response Plan outlining how workforce members report suspected or known incidents and how the organization responds. 

It would also establish more detailed expectations around testing and revising those plans. 

That distinction matters. 

A written incident response plan can identify who should be contacted and what steps should be taken. Testing that plan helps determine whether employees know what to do, whether responsibilities are clear, and whether the process can work under the pressure of a real incident. 

Download Your Complimentary Incident Response Checklist

Disaster Recovery: What Needs to Come Back First? 

Incident response focuses on what happens when a security incident occurs. Disaster recovery asks another critical question: How quickly can your organization get back to normal operations? 

The current Security Rule requires a contingency plan that addresses areas such as backing up ePHI, restoring lost data, and continuing critical processes during an emergency. 

The proposed rule would make some of those expectations more specific:  

If finalized as proposed, organizations would need to establish written procedures for restoring certain critical electronic information systems and data within specified timeframes, including a proposed 72-hour restoration requirement for certain critical systems and data. 

Organizations would also need to analyze the criticality of their systems and technology assets. In practical terms, that means understanding which systems the organization depends on most and determining what needs to be restored first. 

For a healthcare organization, that exercise can extend beyond compliance. If several systems become unavailable at the same time, leaders should already know which ones are essential to patient care, operations, and the protection of ePHI. 

A Plan You Have Never Tested Is Still an Unknown 

It is easy to think of incident response and disaster recovery as documents that live inside a compliance program. Their real value becomes apparent when something goes wrong. 

Can employees recognize and report a potential security incident?  

Does everyone know who is responsible for responding? 

Can your organization restore critical data from its backups?  

Does your IT provider understand which systems need to be prioritized?  

Have you actually tested any of it? 

Those are valuable questions regardless of what ultimately happens with the proposed HIPAA Security Rule. 

The proposed changes are not final, and current HIPAA requirements remain in effect. But healthcare organizations can use this time to review their incident response and disaster recovery processes, identify gaps, coordinate with their IT providers, and test whether their plans work as expected. 

Because when an incident happens, the most valuable plan is not the one sitting in a binder. 

It is the one your organization is prepared to execute. 

The post When an Incident Happens, Will Your HIPAA Response Plan Actually Work? appeared first on HIPAA Secure Now!.

Your workforce is an important part of protecting electronic protected health information (ePHI). HIPAA already requires covered entities and business associates to train their workforce, maintain security policies, and control access to ePHI. A proposed update to the HIPAA Security Rule would make many of these requirements more specific. 

What Does HIPAA Require Today? 

The current Security Rule requires a security awareness and training program for all workforce members, including management. It also includes addressable provisions covering security updates, protection from malicious software, login monitoring, and password management. 

Organizations must maintain written Security Rule policies and procedures, update them when needed, and have procedures for ending access when a workforce member leaves. However, the current Security Rule does not set a specific annual training schedule, a deadline for training new workforce members, or a timeframe for removing access. 

What Would the Proposed Rule Change? 

If finalized as written, the proposed rule would establish clearer training content and deadlines. Covered entities and business associates would need to: 

• Provide role-based security training at least once every 12 months 

• Train new workforce members no later than 30 days after they first receive system access 

• Provide updated training within 30 days of a material policy or procedure change affecting someone’s role 

• Provide ongoing reminders/continuous trainings about security responsibilities and emerging threats 

• Document that training and reminders were provided 

The proposal would also require workforce security policies and procedures to be reviewed and tested annually. 

Training is only one part of workforce security. Under the proposal, system and facility access would need to be terminated as soon as possible, but no later than one hour after a workforce member’s employment or other arrangement ends. When that person had authorized access to systems maintained by another covered entity or business associate, that organization would generally need to be notified within 24 hours. 

These changes are not final, but organizations can begin preparing by reviewing their training, policies, documentation, and access-removal processes. 

The post HIPAA Workforce Security: What Could Change? appeared first on HIPAA Secure Now!.

Healthcare organizations depend on outside vendors for billing, cloud storage, IT support, legal services, and everyday operations. When a vendor accesses, processes, receives, maintains, or transmits protected health information (PHI) on your behalf, it generally is a business associate under HIPAA. 

That relationship creates responsibilities for both parties—and signing a Business Associate Agreement (BAA) is only the beginning. 

A BAA Is Essential, but It Is Not Vendor Management 

A BAA defines how a business associate may use and disclose PHI, requires appropriate safeguards, and addresses incident reporting and subcontractor responsibilities. However, a signed agreement does not prove that a vendor has effective security controls. 

Healthcare organizations need a repeatable process for managing vendors throughout the relationship: 

1. Identify and classify. Maintain an inventory of vendors, the services they provide, the PHI they handle, and any subcontractors they use. 
2. Evaluate risk. Review safeguards such as access controls, multifactor authentication, encryption, workforce training, incident response, backups, and vulnerability management before access begins. 
3. Set clear expectations. Ensure the BAA and service agreement address responsibilities, notification procedures, data return or destruction, and other requirements appropriate to the risk. 
4. Monitor the relationship. Reassess higher-risk vendors on a defined schedule and whenever services, ownership, access, or subcontractors change. 
5. Offboard securely. Remove accounts and integrations, recover assets, and confirm that PHI is returned or destroyed when required and feasible. 

Business associates must apply the same discipline to subcontractors that handle PHI on their behalf. Each additional party extends the chain of responsibility—and can increase exposure if oversight is weak. 

Effective vendor management is not paperwork for its own sake. It helps your organization know who has access to PHI, understand the risk, respond faster to incidents, and prevent former vendors from retaining unnecessary access or data. 

HIPAA Secure Now helps healthcare organizations assess risk, maintain policies and documentation, train employees, and keep compliance work moving throughout the year. 

Schedule a HIPAA compliance review to identify vendor-management gaps and prioritize your next steps. 

The post Business Associate and Vendor Management: A New Approach is Needed appeared first on HIPAA Secure Now!.

One common misconception about the HIPAA Security Rule is that an “addressable” safeguard is optional. That is not the case. 

Under the current Security Rule, when an implementation specification is designated as addressable, an organization must determine whether that safeguard is reasonable and appropriate for its environment. If it is not, the organization must document why and, when reasonable and appropriate, implement an equivalent alternative measure. 

The proposed HIPAA Security Rule changes could significantly reduce that flexibility. HHS has proposed eliminating the distinction between “required” and “addressable” implementation specifications, making the specifications required with limited exceptions. 

Why Is HHS Proposing This Change? 

During the recent NIST/HHS Safeguarding Health Information: Building Assurance Through HIPAA Security conference, one of the points discussed was that the Security Rule was originally designed with flexibility so organizations could adapt as technology evolved. 

Technology has certainly evolved. Many safeguards that may have once been difficult, costly, or impractical to implement are now considered fundamental security practices. 

Encryption is a good example. 

Years ago, encryption could be expensive or difficult to implement, particularly for a small healthcare organization. Depending on the organization’s circumstances, there may have been other reasonable and appropriate ways to protect electronic protected health information (ePHI). 

Today, encryption is widely available and often built directly into the technology healthcare organizations already use. What may have once required additional technology and resources has increasingly become a baseline safeguard for protecting sensitive information. 

The same evolution is happening across other areas of cybersecurity. As technology becomes more accessible and threats become more sophisticated, expectations for protecting ePHI are changing with them. 

What Does This Mean for Your Organization? 

The proposed HIPAA Security Rule has not been finalized, so the current Security Rule requirements remain in effect. 

However, healthcare organizations do not have to wait for a final rule to start preparing. 

Now is a good time to review the safeguards your organization currently treats as addressable. Understand which safeguards have been implemented, where alternative measures are being used, and whether those decisions still make sense based on today’s technology and cybersecurity risks. 

This review can also help identify areas that may require additional planning, budgeting, or support from your IT team or managed service provider. 

Even if the final rule differs from the current proposal, evaluating these safeguards today can help strengthen the protection of ePHI and put your organization in a better position to adapt as HIPAA requirements evolve. 

Preparing now means having more time to make thoughtful decisions instead of waiting until a compliance deadline is approaching. 

The post What Could the End of “Addressable” HIPAA Safeguards Mean for Healthcare Organizations? appeared first on HIPAA Secure Now!.