Dr. Kainat Amjad, MBBS
Dr. Kainat Amjad writes about healthcare operations, patient-facing workflows, administrative burden, and practical technology adoption, with an emphasis on preserving accountability, privacy, and the patient experience.
Healthcare delivery has changed dramatically over the past decade. Electronic health records, cloud-based practice management systems, telehealth platforms, remote billing teams, and mobile applications have become integral to patient care. While these technologies can improve access and workflow efficiency, they also expand the number of systems and locations where protected health information is stored, transmitted, and accessed.
The need for stronger controls is measurable. The HHS Office for Civil Rights report on breaches occurring in 2024 recorded 663 breaches affecting 500 or more people. Hacking and IT incidents represented 81% of those reports. A 2024 HHS Office of Inspector General audit also cited an October 2023 OCR communication reporting a 278% increase in ransomware over the preceding four years. A later review of the live OCR portal by The HIPAA Journal listed 772 large breaches for 2025 as of June 2026. Portal totals can change as reports and investigations are updated.
Modernizing HIPAA compliance means adapting privacy and security practices to digital care without treating technology as a substitute for governance.
What Should Healthcare Providers Prioritize?
Map ePHI
Map where electronic protected health information, or ePHI, is created, received, maintained, and transmitted.
Control access
Use role-based access, unique identities, multifactor authentication, and prompt offboarding.
Protect data
Protect data at rest and in transit using encryption appropriate to the system and risk.
Manage risk
Treat risk analysis, monitoring, vendor oversight, and incident planning as ongoing processes.
Keep accountable owners
Keep privacy, security, legal, clinical, and compliance decisions with qualified internal owners.
Why This Matters Now
In its official 2024 breach report, OCR stated that hacking and IT incidents made up 81% of reported breaches affecting 500 or more people and 99% of the individuals affected by those large breaches. OCR also opened compliance reviews for all reported breaches affecting 500 or more individuals. These figures do not mean every organization faces the same risk. They show why an accurate, documented risk analysis and controls matched to the organization’s real systems cannot be reduced to an annual paperwork exercise.
Why Is a Traditional Annual HIPAA Checklist No Longer Enough?
An annual review can still be useful, but it cannot be the entire compliance program. HHS guidance states that the risk-analysis process should be ongoing and that the HIPAA Security Rule does not prescribe one universal frequency for every organization.
Many healthcare organizations still use programs built around periodic risk assessments, written policies, and annual staff training. Those activities remain important, but today’s environment changes throughout the year as organizations add cloud tools, remote access, mobile devices, integrations, vendors, and new users.
Healthcare providers routinely exchange patient information through:
- Electronic health record systems
- Telehealth platforms
- Cloud-based practice management software
- Patient portals
- Mobile devices
- Remote workforce connections
- Third-party vendors
- Revenue cycle management platforms
Each technology creates questions about identity, access, configuration, data location, monitoring, contracts, incident response, and recovery. Those questions require continuing oversight, especially after a material technology or operational change.
IBM’s 2025 Cost of a Data Breach Report estimated an average healthcare breach cost of $7.42 million across the healthcare organizations in its study, the highest industry average reported for the twelfth consecutive year. Healthcare breaches in that study took an average of 279 days to identify and contain, compared with a 241-day cross-industry average. These are study averages, not forecasts for a particular provider.
What Healthcare Providers Are Discussing
These questions reflect current provider concerns. The answers below use authoritative sources and preserve operational, legal, privacy, security, and clinical responsibility boundaries.
Is a Patient’s Voluntary Use of Consumer AI the Same as a Provider Disclosure?
No. HIPAA generally regulates covered entities and business associates, not a patient’s voluntary disclosure of personal health information to a consumer application that is not offered by or on behalf of a regulated entity. HHS explains that information a person voluntarily enters into an unregulated consumer app may fall outside HIPAA, although other protections, including the FTC Health Breach Notification Rule and applicable state laws, may still apply.
For an outsourced administrative workflow, the practical question is different: who is authorized to access PHI, under what contract and policy, through which approved system, and for what task? Governed outsourcing can support defined administrative work under a signed BAA, role-based access, monitoring, and escalation, but it does not transfer the provider’s privacy, security, legal, or compliance responsibilities.
Does HIPAA Prohibit Faxing Patient Information?
No. HHS states that providers may fax PHI for permitted purposes, including treatment, when reasonable and appropriate safeguards are used. The operational risk comes from mistakes such as selecting the wrong recipient or using an outdated number, not from fax technology being automatically prohibited.
A practice can reduce misdirected communications by verifying recipient details, using approved cover sheets, preprogramming frequently used numbers where appropriate, documenting the transmission, and escalating errors promptly. A trained outsourced administrative team may perform those defined steps within the client’s approved workflow, while the practice retains responsibility for policy, authorization, incident assessment, and any required notification.
How Can Practices Improve Security Without Adding More Work for Clinicians?
Practices can move repeatable controls into the workflow instead of asking clinicians to remember extra manual steps. Centralized identity management, multifactor authentication, device controls, automated logging, approved communication channels, defined vendor reviews, and clear escalation paths can reduce avoidable friction.
Outsourcing may help with assigned administrative tasks such as access rosters, scheduling, billing support, prior-authorization tracking, document routing, and workflow documentation. It should not replace the organization’s privacy officer, security leadership, legal counsel, IT function, or clinical decision-makers.
What Challenges Does Digital Healthcare Create for HIPAA Compliance?
Digital care increases the number of potential access points to ePHI.
Common operational challenges include:
- Remote employees accessing patient records outside the organization’s facilities
- Providers using mobile devices during patient care
- Multiple cloud applications creating, receiving, maintaining, or transmitting ePHI
- Telehealth consultations occurring across different networks and devices
- Third-party vendors supporting billing, scheduling, transcription, and customer service
- Phishing, ransomware, stolen credentials, and other attacks targeting people and systems
Each technology may improve an operational process while expanding the organization’s security responsibilities. The goal is not to add a manual approval step to every digital action. It is to build appropriate safeguards into the systems and workflows so protection is less dependent on memory during a busy patient day.
How Can Healthcare Organizations Secure Cloud-Based Systems?
Healthcare organizations can use cloud services for ePHI when the arrangement and configuration satisfy applicable HIPAA requirements. Moving data to the cloud does not transfer the covered entity’s or business associate’s responsibilities to the cloud provider.
Electronic medical records, billing platforms, scheduling software, imaging systems, and collaboration tools increasingly depend on cloud infrastructure. Before implementation, organizations should evaluate:
- Whether the service is offered for HIPAA-regulated use
- Whether a BAA is required and available
- How data is encrypted at rest and in transit
- How identities, roles, and privileged access are controlled
- What audit logs are available and how long they are retained
- How backups, restoration, and contingency operations work
- Where data is stored and which subprocessors may handle it
- How security incidents are reported and escalated
- What support access the vendor may have
- What happens to data at contract termination
HHS cloud-computing guidance explains that a cloud service provider that creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate is generally a business associate, even if the provider holds encrypted data without the decryption key.
Organizations should execute a BAA whenever the relationship meets the HIPAA definition of a business associate. A BAA defines permitted uses and disclosures, safeguard duties, reporting obligations, and other responsibilities. It does not replace the regulated entity’s own risk analysis or vendor-governance process.
Why Do Encryption at Rest and in Transit Matter?
Encryption can make exposed data unusable or unreadable to an unauthorized person when it is implemented correctly and the key remains protected.
Healthcare information moves through many systems during a patient’s care journey, including:
- Telehealth consultations
- Secure messaging
- Laboratory interfaces
- Imaging transfers
- Insurance claim submissions
- Patient portal communications
Two common encryption states are:
Data at rest
This is information stored on servers, laptops, databases, backup media, and mobile devices.
Data in transit
This is information moving between devices, networks, applications, and cloud services.
Under the HIPAA Breach Notification Rule, PHI encrypted according to the methods identified in HHS guidance is not considered unsecured PHI. That can affect whether breach notification is required, but only when the applicable encryption standard was met and the decryption key or process was not compromised. An organization should not assume that any encrypted file or connection automatically creates a notification safe harbor.
The phrase “end-to-end encryption” should be reserved for systems where data remains encrypted between the communicating endpoints and intermediaries cannot decrypt it. For a broader HIPAA program, it is more accurate to evaluate encryption at rest, in transit, in backups, and within each relevant application and access pattern.
How Can Identity and Access Management Reduce Risk?
Identity and access management, or IAM, helps organizations control who can access systems, what each user can do, and how access changes throughout the user’s lifecycle.
A structured IAM program may include:
- Unique user identities
- Multifactor authentication
- Role-based access
- Single sign-on
- Privileged-access controls
- Password or passkey management
- Account provisioning
- Periodic access review
- Prompt account deactivation when roles or employment change
Permissions should reflect job responsibilities and the purpose of access. The table below is illustrative and must be adapted to the organization, system, patient population, and applicable law.
| Role | Illustrative access need |
|---|---|
| Physician | Clinical records, orders, and prescribing functions required for care |
| Nurse | Documentation and records required for assigned duties |
| Medical coder | Documentation required for authorized coding work |
| Billing specialist | Claims, payment, and insurance information required for assigned accounts |
| Scheduler | Appointment, contact, and demographic information needed for scheduling |
| Human resources | Employee records, without routine patient-record access |
The HIPAA minimum necessary standard generally requires reasonable efforts to limit access, uses, disclosures, and requests when the standard applies. It has exceptions, including disclosures between healthcare providers for treatment. Access design should therefore be reviewed by qualified privacy, legal, security, clinical, and operational owners rather than copied from a generic role table.
Why Should Healthcare Organizations Prioritize Multifactor Authentication?
Multifactor authentication adds another verification factor beyond a password and can materially reduce account-compromise risk.
Examples include:
- Authenticator applications
- Hardware security keys
- Passkeys
- One-time verification codes
- Biometric authentication used as part of a properly designed system
Microsoft’s current Entra documentation states that its research found MFA can block more than 99.2% of account-compromise attacks. That figure is based on Microsoft’s identity environment and should not be interpreted as a universal guarantee. MFA can still be weakened by phishing, token theft, prompt fatigue, insecure recovery processes, and poor configuration.
Healthcare organizations should use risk analysis to prioritize strong authentication for:
- Remote access
- Cloud applications
- Administrative and privileged accounts
- Electronic health record systems
- Vendor and third-party access
Phishing-resistant methods such as passkeys and hardware-backed security keys may provide stronger protection for high-risk access than approval prompts or text-message codes.
What Role Does Single Sign-On Play?
Single sign-on, or SSO, lets an authorized user authenticate through a central identity service before accessing approved applications.
Healthcare staff often move between multiple systems during the day. Repeated logins can contribute to password reuse, written passwords, reset requests, and workflow interruptions. SSO may improve usability while giving administrators a central place to apply access policy, review sign-in activity, and disable access.
SSO is not automatically secure. It can concentrate risk if the primary identity is compromised. It should be combined with MFA, appropriate session controls, logging, resilient recovery procedures, and careful protection of administrative accounts.
Why Should Continuous Monitoring Supplement Periodic Audits?
Continuous or frequent monitoring can identify changes and suspicious activity between formal assessments. It does not eliminate the need for documented risk analysis, periodic evaluation, or human investigation.
Examples of events that may warrant review include:
- Unusually large record downloads
- Access outside expected patterns
- Logins from unfamiliar locations or devices
- Repeated failed authentication attempts
- Unexpected access to sensitive records
- Changes to privileged accounts
- Disabled security controls
- Unpatched systems or newly identified vulnerabilities
HHS states that risk analysis should be ongoing, while also noting that the Security Rule does not prescribe one fixed assessment frequency for every regulated entity. Monitoring should therefore be designed around the organization’s systems, threats, size, capabilities, and documented risk-management decisions.
OCR opens compliance reviews for all reported breaches affecting 500 or more people. Its investigations and enforcement actions frequently examine whether the organization conducted an accurate and thorough risk analysis and acted on identified risks. Monitoring records can support that process, but alerts alone do not prove compliance.
How Can Mobile Device Management Support HIPAA Safeguards?
Mobile device management, or MDM, can help an organization enforce approved settings and respond when a managed device is lost, stolen, outdated, or noncompliant.
Healthcare professionals may use smartphones and tablets to access:
- Patient portals
- Secure messaging platforms
- Scheduling systems
- Clinical documentation
- Telehealth applications
Depending on the organization’s risk analysis and device model, MDM may help:
- Enforce screen-lock and authentication policies
- Require device encryption
- Install or restrict applications
- Separate managed work data from personal data
- Block unapproved storage or sharing
- Apply security updates
- Remotely remove organizational data
- Record device-compliance status
Organizations also need clear policies for personally owned devices, shared devices, lost devices, local downloads, screenshots, backups, messaging, and remote support. A tool cannot compensate for an undefined ownership model or an untested incident process.
Why Must Workforce Training Evolve?
Training should reflect the threats, systems, and workflows people actually encounter. Annual HIPAA training can provide a baseline, but targeted reminders and exercises may be needed when risks or tools change.
Effective programs may include:
- Short role-specific learning sessions
- Phishing simulations
- Examples drawn from current workflows
- Incident-reporting instructions
- Secure messaging and fax procedures
- Mobile-device expectations
- Remote-work requirements
- Consumer AI and approved-tool guidance
- Escalation for suspected mistakes
IBM’s 2025 breach study found that 16% of the breaches in its cross-industry sample involved attackers using AI. Among that subset, AI-generated phishing or other communications represented 37% and deepfake attacks represented 35%. These figures are not healthcare-specific, but they support training staff to verify unexpected messages, requests, voices, and login prompts.
What Policies Should Healthcare Organizations Update?
Policies should match the technology and working arrangements the organization actually uses.
Organizations should review policies covering:
- Remote work
- Personal and managed devices
- Text and secure messaging
- Email and fax
- Cloud storage
- Telehealth
- Authentication and account recovery
- Vendor access
- Consumer and enterprise AI tools
- Incident reporting
- Data retention and disposal
- Backup and recovery
A policy written around locked filing cabinets and office fax machines may not answer the questions faced by a scheduler using a managed laptop at home. Policies should define owners, permitted tools, prohibited actions, approval requirements, evidence to retain, and escalation paths.
Why Does Vendor Management Matter More Than Ever?
Vendor management matters because a provider’s ePHI may pass through cloud services, communication tools, billing platforms, contractors, and subprocessors.
Examples include:
- Medical billing
- Revenue cycle management
- Medical transcription
- Cloud hosting
- Telehealth services
- Appointment scheduling
- Customer support
- Data backup
Before engagement and at a risk-based interval afterward, organizations should evaluate:
- The service’s exact PHI role
- BAA requirements and contract terms
- Security and privacy controls
- Identity and access design
- Incident response and notification
- Subprocessors and data location
- Audit or assurance documentation
- Business continuity and recovery
- Data return or destruction
- Material changes to the service
A signed BAA is necessary when HIPAA requires one, but it is not a complete vendor-risk program. Vendors can change systems, subprocessors, integrations, and operating practices. Reassessment should be driven by risk, contract commitments, material changes, incidents, and the organization’s governance process rather than an unsupported universal schedule.
Which KPIs Can Help Measure a Modern HIPAA Program?
Metrics should show whether defined controls are operating and whether identified risks are being addressed. They should not be presented as proof that an organization is fully compliant or breach-proof.
| KPI | What it can indicate |
|---|---|
| MFA coverage by system and user type | Progress toward stronger authentication |
| Phishing-reporting and simulation results | Workforce recognition and reporting behavior |
| Time to triage security alerts | Operational response capability |
| High-risk access events reviewed | Monitoring coverage and follow-through |
| Managed-device compliance | Endpoint-control status |
| Time to remove access after a role change | Offboarding performance |
| Vendor reviews completed by risk tier | Third-party oversight execution |
| Critical risk-treatment items overdue | Governance and accountability |
| Backup restoration tests completed | Recovery readiness |
Leadership should define each metric, data source, owner, target, exception process, and reporting period. Averages from breach studies can provide context, but they should not be converted into promised savings or predicted outcomes for a specific practice.
What Common Mistakes Increase HIPAA Risk?
Common weaknesses include:
- Treating one annual assessment as the entire risk-management process
- Delaying security updates without documented risk handling
- Granting broader access than a role requires
- Failing to remove or change access promptly after a role change
- Overlooking vendor and subprocessor risk
- Using unapproved messaging, storage, or AI tools
- Providing generic training that does not match real workflows
- Assuming a cloud provider or outsourcing partner manages all HIPAA responsibilities
- Failing to test backups and incident procedures
- Handling patient record requests through an unclear or inconsistent workflow
OCR’s Right of Access Initiative also shows that HIPAA operations are not limited to cybersecurity. Organizations need reliable procedures for receiving, verifying, tracking, and completing patient access requests within applicable requirements. Administrative support may help execute the workflow, but qualified owners must set policy and address exceptions.
Where Can Security-Conscious Healthcare Outsourcing Help?
Security-conscious healthcare outsourcing can support defined administrative workflows when access, ownership, monitoring, contracts, and escalation are deliberately governed.
Potentially delegable administrative tasks include scheduling, insurance verification, prior-authorization tracking, billing support, document routing, account-roster maintenance, and workflow documentation. The client should define the permitted task, system, role, patient population, approval boundary, escalation path, and evidence to retain.
Staffingly’s current HIPAA security and healthcare outsourcing page describes its security review materials and access patterns. Under the canonical Staffingly Truth Register, the approved wording is:
Staffingly maintains active ISO/IEC 27001:2022 certification and operates under HIPAA-compliant controls and signed BAAs. SOC 2 Type II reporting and security controls apply according to the relevant entity, client environment, facility, device, and workflow. Venn Blue Border and related workstation restrictions are used where applicable.
Relevant controls and access patterns should be confirmed for the specific engagement. A security-conscious outsourcing arrangement does not transfer HIPAA responsibility, guarantee compliance, eliminate breach risk, or replace the client’s CISO, privacy officer, legal counsel, IT team, clinical leaders, or other qualified decision-makers.
Staffingly’s medical outsourcing services hub describes the administrative services that may be considered for a defined workflow. The security model, BAA, system access, scope, staffing arrangement, and escalation design should be reviewed during procurement and documented before PHI access begins.
Frequently Asked Questions
What Is Modern HIPAA Compliance?
Modern HIPAA compliance applies the Privacy, Security, and Breach Notification Rules to the organization’s current systems and workflows. It combines documented risk analysis with appropriate administrative, physical, and technical safeguards, workforce training, vendor governance, monitoring, and incident response.
Does HIPAA Apply to Cloud-Based Healthcare Software?
HIPAA can apply when a cloud service creates, receives, maintains, or transmits ePHI for a covered entity or business associate. HHS states that the cloud provider is generally a business associate in that situation, and the parties must enter into an appropriate BAA and meet their other HIPAA obligations.
Why Is Multifactor Authentication Important?
MFA adds another verification factor beyond a password. Microsoft reports that MFA can block more than 99.2% of account-compromise attacks in its research environment, but MFA is not a guarantee and should be combined with secure configuration, phishing-resistant methods where appropriate, monitoring, and recovery controls.
How Often Should a HIPAA Risk Analysis Be Performed?
HHS says risk analysis should be ongoing and does not prescribe one fixed frequency for every organization. A regulated entity should update its analysis and safeguards as needed, including when systems, threats, vendors, locations, or workflows materially change.
How Much Does a Healthcare Data Breach Cost?
IBM’s 2025 study reported an average healthcare breach cost of $7.42 million among the organizations in its research sample. That was an industry study average, not a prediction of what a breach would cost a particular provider.
How Can Healthcare Providers Improve HIPAA Compliance Without Increasing Administrative Burden?
Providers can automate repeatable controls, centralize identity management, use risk-based monitoring, standardize vendor reviews, update training, and build security into existing workflows. Defined administrative tasks may be delegated, but privacy, security, legal, clinical, and compliance accountability must remain with qualified owners.
Is Encryption Mandatory for Every HIPAA System?
The current HIPAA Security Rule classifies encryption implementation specifications as addressable, which does not mean optional without analysis. A regulated entity must assess whether encryption is reasonable and appropriate and document its decision and any equivalent alternative measure. HHS proposed stronger encryption requirements in 2024, but organizations should not describe the proposed requirements as a final rule unless that status changes.
Does a BAA Make a Vendor Automatically HIPAA Compliant?
No. A BAA establishes contractual duties and is required for applicable business-associate relationships, but it does not prove that every control is effective or transfer all responsibility to the vendor. The parties must implement applicable safeguards and manage the relationship according to their roles.
Final Thoughts
Modern HIPAA compliance extends beyond policies and documentation. It requires healthcare organizations to understand where ePHI travels, control access, configure digital tools appropriately, monitor changing risks, prepare for incidents, train the workforce, and govern vendors.
Cloud infrastructure, identity management, encryption, monitoring, mobile-device controls, workforce education, and vendor oversight are most effective when they operate as one documented program. The goal is not to replace human judgment with automation or to add paperwork for its own sake. It is to make secure behavior part of everyday healthcare operations.
This article is educational and is not legal, privacy, compliance, cybersecurity, clinical, or regulatory advice. Organizations should apply the HIPAA Rules and other applicable requirements to their specific facts with qualified counsel and privacy, compliance, security, and clinical leadership.
Sources Referenced
Search Sources Reviewed
These sources were reviewed for search context. Their inclusion does not imply Staffingly endorsement, and they are not used as primary evidence.
Need More Administrative Capacity Without Broadening Access?
Map the workflow, the systems it touches, the minimum access required, the internal owner, and the escalation path before adding remote support.
Tell Us Which Administrative Workflow Needs Support
Share the workflow, systems, user roles, current bottleneck, and access concerns. We will map what may be delegated, what access is required, and where qualified human review remains necessary.