Healthcare IT: Pass the OCR Audit Without Filing for Bankruptcy.

Yes. HIPAA covers any healthcare provider that transmits health information electronically — including filing claims with insurance, electronic appointment reminders, or patient portal communications. Solo and small dental practices are covered entities identical to hospitals for the controls. The practice size affects what “reasonable safeguards” looks like, not whether the rule applies.

In April 2026, OCR signaled enforcement priority on practices whose Security Risk Analysis was completed but never followed by documented risk management. An SRA listing 14 identified risks with no remediation evidence reads as material noncompliance, not just an open work item. The pivot is procedural, not regulatory — the same Security Rule language has always required risk management; OCR is now enforcing it.

No, not since the public health emergency enforcement discretion ended. Consumer Zoom (without a Business Associate Agreement and HIPAA-specific features) does not satisfy the Security Rule. Zoom for Healthcare (paid tier with BAA) is compliant. Doxy.me, Updox, SimplePractice, and other telehealth platforms with BAAs are compliant. The practice must verify BAA coverage before using any telehealth tool.

Yes if the IT firm has access to systems holding ePHI — which is almost always. The BAA must be HIPAA-compliant and signed before access begins. Triton signs BAAs as a standard contract term and produces the BAA-required documentation (security policies, breach notification procedures, right-to-audit clause) without negotiation.

CTDPA has a HIPAA exemption that covers PHI specifically — but the exemption is narrower than most practices assume. Non-PHI data (employee personal data, marketing email lists, vendor data) remains in CTDPA scope. Most healthcare practices have CTDPA obligations alongside HIPAA. The compliance work mostly overlaps; the documentation is twin-track.

Total compliance investment for a 5-person practice typically runs $18,000 to $40,000 in the first year, then $12-25K/year ongoing. The split: technical stack with HIPAA-aligned configuration ($8-18K), SRA and risk management plan authoring ($4-10K), BAA framework and policy authoring ($3-7K), training and tabletop exercise ($2-5K). Larger practices scale roughly linearly.

That is a critical compliance gap on its face. Every covered entity is required to have a BAA with every business associate handling ePHI. An EHR vendor that refuses is either not legitimately a healthcare vendor or is misrepresenting their compliance posture. The practice must either obtain the BAA, terminate the vendor relationship, or document an alternative path that does not require ePHI access.

No. Dark web monitoring is a notification service, not a HIPAA Security Rule requirement. The Security Rule requires administrative, physical, and technical safeguards — endpoint protection, MFA, encryption, audit logging, incident response, training. Dark web alerts do not satisfy any safeguard category. We do not bundle dark web monitoring and it does not appear in any HIPAA evidence list.