$1.5M HIPAA settlement
Athens Orthopedic Clinic
Georgia, 2016
Hackers stole the records of more than 200,000 patients and offered them for sale when the clinic would not pay. Regulators found no risk analysis and no current security policies.
< Back
Hospitals, clinics and medical offices hold the most personal data there is, and protecting it is required by law. This playbook explains the regulations that apply, shows how compliant practices protect patient data in daily work, and gives administrators and IT staff six steps to follow.
Staff working from home connect through a VPN, only from approved locations and devices, with multi-factor authentication.
Doctors see medical histories, nurses see treatment plans and billing sees payments. Every login and record access is logged.
Lab results and reminders go through a HIPAA-compliant app. Texts and emails carry a secure link, never the data itself.
Recorded consultations are encrypted end to end, access-limited and deleted after 12 months unless needed for care.
Content filters block malicious sites and downloads that could compromise health records.
Laptops and tablets have full-disk encryption, automatic screen locks and remote wipe if they are lost.
Work out which of HIPAA, HITECH, GDPR and state laws apply to your location, services and patients.
Audit IT systems, record storage, access controls and communication channels for gaps.
Cover handling PHI, storing records, securing devices and sharing information with third parties.
Run regular privacy and security training with real scenarios, such as handling patient records.
Secure EMRs, encrypted messaging, firewalls, access controls and automated breach monitoring.
Run internal audits, consider third-party assessments and review access logs and incident reports regularly.
$1.5M HIPAA settlement
Georgia, 2016
Hackers stole the records of more than 200,000 patients and offered them for sale when the clinic would not pay. Regulators found no risk analysis and no current security policies.
14,000+ patients' records exposed
Maryland, 2019
Ransomware locked therapy notes and insurance files at a small psychiatric clinic with no risk assessment or intrusion monitoring. It was fined $40,000, and referrals slowed.
The full playbook tells each of these stories in detail. Read them in the PDF (opens in a new tab)
A free compliance risk assessment shows which rules apply to you and where your systems fall short. Or call us on 718-806-9374.
How law firms keep client information confidential under the ABA rules, HIPAA, GDPR and PCI DSS, with a six-step plan and the breaches that ended firms.
ABA Model Rules, HIPAA, GDPR, PCI DSS, State laws
The rules banks, investment firms, insurers and fintechs answer to, from GLBA and SOX to PCI DSS and AML, with a six-step roadmap and two costly lessons.
Dodd-Frank, GLBA, SOX, PCI DSS, GDPR, AML and KYC
