Blog

HIPAA Right of Access: How to Handle Patient Requests Under 45 CFR 164.524

Handle every HIPAA right of access request on time: designated record set, 30-day deadline, fees, denial grounds and business associate duties for HealthTech.

HIPAA Technical Safeguards: An Engineering Guide to 45 CFR 164.312

HIPAA technical safeguards explained for engineers: each 45 CFR 164.312 standard, required vs addressable specs, SaaS implementation and the evidence to keep.

HIPAA Tracking Technologies: Pixels, Analytics and the OCR Bulletin After AHA v. Becerra

HIPAA tracking technologies explained: what the OCR bulletin still requires after AHA v. Becerra, plus a tag audit checklist and BAA table for HealthTech teams.

HITRUST Inheritance: How to Inherit Controls From Certified Cloud and Service Providers

Learn how HITRUST inheritance works in MyCSF, what you can inherit from certified cloud providers and how to document shared responsibility to cut audit work

42 CFR Part 2: A Compliance Guide for HealthTech Vendors Handling SUD Records

42 CFR Part 2 explained for HealthTech vendors: covered SUD records, the 2024 final rule, how it differs from HIPAA, and the steps to reach Part 2 compliance.

FTC Health Breach Notification Rule: A Guide for Health Apps Outside HIPAA

FTC Health Breach Notification Rule guide for health apps outside HIPAA: who is covered, what counts as a breach, deadlines, penalties and HIPAA vs FTC.

HIPAA Incident Response Plan: Security Incident Procedures for HealthTech Teams

Build a HIPAA incident response plan that meets 164.308(a)(6), separates security incidents from breaches and gives HealthTech teams a clear, repeatable process

Risk Transfer in Cybersecurity: Insurance, Contracts, Outsourcing and What Stays With You

Risk transfer explained: how cyber insurance, contracts and outsourcing shift cyber risk, what stays with you, and how to record it for SOC 2 and ISO 27001.

Washington My Health My Data Act: A Compliance Checklist for HealthTech, Wellness and SaaS Teams

Washington My Health My Data Act checklist for HealthTech and SaaS teams: scope, consent, sale authorization, consumer rights and a practical 90-day plan.

AI Agent Identity Governance: How to Control What Your Agents Can Access

AI agent identity governance in practice: give every agent its own identity, scope its permissions, track delegation and review access so agents stay auditable.