Blog

42 CFR Part 2: A Compliance Guide for HealthTech Vendors Handling SUD Records

42 CFR Part 2 explained for HealthTech vendors: covered SUD records, the 2024 final rule, how it differs from HIPAA, and the steps to reach Part 2 compliance.

FTC Health Breach Notification Rule: A Guide for Health Apps Outside HIPAA

FTC Health Breach Notification Rule guide for health apps outside HIPAA: who is covered, what counts as a breach, deadlines, penalties and HIPAA vs FTC.

HIPAA Incident Response Plan: Security Incident Procedures for HealthTech Teams

Build a HIPAA incident response plan that meets 164.308(a)(6), separates security incidents from breaches and gives HealthTech teams a clear, repeatable process

Risk Transfer in Cybersecurity: Insurance, Contracts, Outsourcing and What Stays With You

Risk transfer explained: how cyber insurance, contracts and outsourcing shift cyber risk, what stays with you, and how to record it for SOC 2 and ISO 27001.

Washington My Health My Data Act: A Compliance Checklist for HealthTech, Wellness and SaaS Teams

Washington My Health My Data Act checklist for HealthTech and SaaS teams: scope, consent, sale authorization, consumer rights and a practical 90-day plan.

AI Agent Identity Governance: How to Control What Your Agents Can Access

AI agent identity governance in practice: give every agent its own identity, scope its permissions, track delegation and review access so agents stay auditable.

GDPR Data Mapping: How to Map Personal Data Flows Step by Step

GDPR data mapping explained: what to capture, how to build a living map of personal data flows in six steps, and how it feeds your Article 30 record and DPIAs.

NIST CSF Checklist: A Function-by-Function Guide to CSF 2.0

A practical NIST CSF checklist for CSF 2.0: scope a Current Profile, work through all six Functions and 22 Categories, pick a Target Tier and build a gap plan.

Quantitative vs Qualitative Risk Analysis: Which Should Your Team Use?

Quantitative vs qualitative risk analysis compared: how each works, a worked loss example, when semi-quantitative fits, and what HIPAA and NIST require.

CCPA HIPAA Exemption: What Is Exempt and What Still Falls Under the CCPA

The CCPA HIPAA exemption covers PHI and medical information, not your whole company. Learn what HealthTech teams must still handle under the CCPA and how.