HIPAA Security Rule update

    Insights

    Enforcement, rules, and what to do about them, in plain English.

    Written by the team that has run HIPAA programs for 500+ organizations since 2010. Every piece names the regulation, the enforcement case, and the step to take, and each one shows the date it was last updated.

    New pieces by email

    The next piece, when it is published, and nothing else.

    Unsubscribe any time. Nothing here needs an email to read.

    Start here

    Four pieces that answer the first questions.

    The four pieces readers find most often.

    1. The Security Rule overhaul: what would change, and what is still in force.

      Proposed in January 2025, not final as of 2026, and the current rule stays in effect in the meantime.

      Regulatory Updates · 14 min read · Updated 1 September 2026

    2. Audit logs nobody reads: the rule requires two things, most do one.

      Audit controls require you to record activity, activity review requires you to read it, and keeping logs nobody reads fails the second.

      Compliance Guides · 5 min read · Updated 1 September 2026

    3. Ten HIPAA platforms, ranked, with who each one is best for.

      Live Compliance, Compliancy Group, Accountable HQ, Drata, Vanta, and five more, with honest limitations for each.

      Comparisons · 19 min read · Updated 17 September 2026

    The rest

    Everything else, newest first.

    Every other piece, dated and in order, with the regulation named in each.

    1. 27 August 2026Compliance Fundamentals

      Is ChatGPT HIPAA Compliant? A Badge Is Not a BAA

      Is ChatGPT HIPAA compliant? HIPAA does not certify products. A badge is not a BAA, consumer ChatGPT and ChatGPT Business have no BAA. You still own the program.

      14 min read

    2. 22 August 2026Compliance Guides

      Would You Bet an Audit on an App That Looked Ready?

      A polished demo is not a HIPAA program. How to vet a new app that touches PHI before patient data moves.

      19 min read

    3. 15 July 2026OCR Enforcement Lessons

      Your Accountant Might Be a HIPAA Business Associate — a $175,000 Lesson (2026)

      An OCR enforcement lesson: a $175,000 ransomware settlement with an accounting firm that was a HIPAA business associate. What actually triggers business-associate status (45 CFR 160.103), the risk-analysis finding OCR cited (45 CFR 164.308), and how to tell if HIPAA already applies to your firm.

      6 min read

    4. 26 June 2026Compliance Guides

      The Terminated Employee Still Has a Laptop Full of PHI. Now What? (2026)

      HIPAA asset management and termination requirements: Device and Media Controls (45 CFR 164.310(d)) and termination procedures (164.308(a)(3)(ii)(C)). Why an asset inventory underpins your risk analysis and how to ensure device recovery.

      5 min read

    5. 26 June 2026Compliance Guides

      In a HIPAA Audit, 'They Agreed' Isn't Evidence. A Signature Is. (2026)

      HIPAA documentation and e-signature requirements: documentation and 6-year retention (45 CFR 164.316(b)), training (164.308(a)(5)) and sanctions (164.308(a)(1)(ii)(C)). Why electronic signatures (ESIGN Act, 15 U.S.C. 7001) satisfy HIPAA and turn acknowledgments into evidence.

      5 min read

    6. 26 June 2026Compliance Guides

      HIPAA Security Risk Assessment: Why a Questionnaire Isn't a Risk Analysis (2026)

      A HIPAA security risk assessment questionnaire is not a risk analysis. What 45 CFR 164.308(a)(1)(ii)(A) requires, why it's the #1 OCR finding, and the difference a technical scan and remediation make.

      6 min read

    7. 26 June 2026Compliance Guides

      A Signed BAA Isn't 'Satisfactory Assurance' — What HIPAA Vendor Due Diligence Requires (2026)

      HIPAA vendor due diligence explained: the 'satisfactory assurances' requirement (45 CFR 164.308(b)(1), 164.502(e)(1)(i)). Why a signed BAA isn't enough and how to verify and document vendor safeguards.

      5 min read

    8. 26 June 2026Compliance Guides

      Is Email HIPAA Compliant? What the Rules Actually Require (2026)

      Is email HIPAA compliant? Standard email is not. What the HIPAA Security Rule requires for email (45 CFR 164.312), why 'addressable' isn't optional, and the breach safe harbor most practices miss.

      6 min read

    9. 26 June 2026OCR Enforcement Lessons

      What a $450,000 Ransomware Settlement Says About Your Risk Analysis (2026)

      An OCR enforcement lesson: a $450,000 ransomware settlement over a missing HIPAA risk analysis. What OCR actually cited (45 CFR 164.308), why employer health plans are covered entities, and how to close the gap before a breach.

      4 min read

    10. 24 June 2026Compliance Guides

      How Much Does HIPAA Compliance Software Cost? (2026)

      How much does HIPAA compliance software cost? Live Compliance: $399/mo (Essentials), $895/mo (Professional), $1,450/mo (Enterprise), plus $8.33 per employee.

      14 min read

    11. 30 March 2026Compliance Guides

      The Complete Guide to HIPAA Compliance in 2026

      Your 2026 HIPAA compliance guide to the Privacy, Security, and Breach Notification Rules, plus the most aggressive OCR enforcement era in the law's history.

      17 min read

    12. 25 March 2026Compliance Guides

      5 HIPAA Compliance Mistakes That Could Shut Down Your Practice (And How to Fix Them)

      These five common HIPAA compliance failures account for the majority of OCR enforcement actions and settlement agreements. Here's how to identify and fix them before your next audit.

      17 min read

    13. 16 March 2026Compliance Technology

      How to Choose HIPAA Compliance Software: A Buyer's Guide

      HIPAA compliance software ranges from policy templates to full platforms with risk automation and SIEM. What features matter and which questions to ask vendors.

      17 min read

    14. 16 March 2026Compliance Insights

      How Much Does HIPAA Non-Compliance Really Cost?

      HIPAA penalties range from $145 per violation to a $2.19 million annual cap per identical provision, but the financial damage extends far beyond fines. When you factor in breach response costs, legal fees, lost revenue, and reputational harm, a single compliance failure can cost a healthcare organization millions more than the penalty itself.

      15 min read

    15. 16 March 2026Compliance Guides

      The Complete Guide to HIPAA Risk Assessments

      A step-by-step HIPAA risk assessment guide: how to scope your environment, document findings, and meet exactly what OCR expects when they come knocking.

      16 min read

    Jim Johnson, Founder and president, Live Compliance

    Jim Johnson

    Founder and president, Live Compliance

    Written with the Live Compliance compliance team. Each piece names the regulation, the enforcement case, and the step to take, and shows the date it was last updated.

    About the founder

    See where your program stands before an auditor does.

    Get your free 10-minute audit-readiness score. Then, if you want it, the guarantee: audit-ready in 60 days, or we keep working at no additional cost until you are.

    Or talk to a specialist

    ~10 minutes · No credit card · No call required

    500+
    healthcare organizations
    100%
    audit success rate
    2010
    protecting healthcare since