Beyond HIPAA: Why Compliance Doesn’t Mean Your Organization Is Cyber Secure

A healthcare organization can maintain its policies, execute its vendor agreements and train its staff every year and still be one phishing email away from a breach. HIPAA compliance and cybersecurity overlap, but they are not interchangeable, and federal regulators keep finding the same gaps in organizations after attacks have already exposed patient records.

What HIPAA Compliance Covers and What It Leaves Open

HIPAA establishes legal requirements for protecting patient health information (PHI). The Security Rule focuses specifically on the confidentiality, integrity and availability of electronic PHI (ePHI). The Security Rule requires administrative, physical and technical safeguards, and it was written to be flexible, which leaves each organization to decide how those safeguards look in practice. The rule applies to health plans, clearinghouses, most providers and the business associates that handle patient data on their behalf. Policies, business associate agreements, training records and a documented risk analysis are important parts of HIPAA compliance, but they are not enough by themselves. The Security Rule also requires appropriate administrative, physical and technical safeguards to be implemented in practice.

Documentation matters, and it’s also where many organizations stop. A policy that tells staff to lock their screens or report suspicious emails protects the organization only when people follow it on a busy afternoon with a full waiting room.

The Risk Analysis Is Where Organizations Fall Short

When the Office for Civil Rights (OCR) at HHS investigates a breach, the risk analysis gets close attention. In its July 2026 settlement with OSF Healthcare, which followed a ransomware attack that exposed the records of 53,907 patients, OCR found the health system had failed to conduct an accurate and thorough risk analysis. The resolution cost $552,250 plus two years of OCR monitoring and marked the agency’s 21st ransomware enforcement action. The case fits a pattern. All four ransomware settlements OCR announced in April 2026 cited the same failure, and those announcements brought its Risk Analysis Initiative to 13 completed investigations. In the same release, OCR’s director noted that hacking and ransomware are now the most frequent type of large breach reported to the agency. 

OCR’s director put the stakes plainly in announcing the OSF settlement, warning that organizations that don’t know their risks often learn the hard way when their systems are hacked. A risk analysis completed once and filed away won’t reflect new staff, new software or new threats and vulnerabilities, and OCR expects it to be updated as needed.

What Real Protection Looks Like Day to Day

OCR’s own recommendations make a practical starting point, and most don’t require a large IT department. Many of these steps are achievable for smaller organizations, but they require clear accountability and may require support from an experienced cybersecurity provider:

• Know where patient information lives, including how it enters, moves through and leaves the organization’s systems.
• Review who is accessing systems and watch for activity that doesn’t fit.
• Confirm that only authorized users can get in, using tools such as multifactor authentication (MFA), which asks for a second proof of identity at login.
• Give staff regular training built around their specific jobs.

OCR also recommends encrypting patient information in transit and at rest when appropriate, which helps protect data if a device goes missing or an account is compromised.

Phishing remains a common way in. The breach behind OCR’s September 2026 settlement with Ambry Genetics began with a single compromised employee email account and potentially exposed the information of 225,370 people. Investigators found Ambry had failed to conduct an accurate risk analysis and lacked procedures for cutting off access when an employee left or no longer needed it, and the company paid $700,000. Vendors belong in the same review, since every billing company, IT provider and software platform that touches patient data needs a current business associate agreement. 

Plan for How Care Continues During an Outage

Ransomware can lock scheduling, charting and billing systems at the same time, and every day offline delays claims and the cash that follows them. Leaders should decide in advance:

• How the organization will see patients, document visits and submit claims if systems go down
• Who has authority to make decisions during an outage
• How patients will be kept informed
• Who to call first, including the IT provider, cyber insurer and legal counsel

Paper forms, a call list and a clear process for rescheduling can keep the front desk working while systems are restored.

Backups deserve the same attention. They should be tested on a regular schedule, since a backup no one has restored is an assumption until it’s proven. Revenue belongs in the plan too, and leadership should know how long the organization can cover payroll and expenses if claims stop moving for several weeks.

Protect Patients and Revenue Together

HIPAA compliance is the starting point for protecting patient information. Keeping the risk analysis current and planning for an outage are what keep an organization running when an attack gets through. Cybersecurity Awareness Month in October is a good time to put both on the agenda.

James Moore Technology Services helps healthcare organizations protect patient data, operations and revenue from cyber risk. Contact us when you’re ready to talk through where your organization stands. 

All content provided in this article is for informational purposes only. Matters discussed in this article are subject to change. For up-to-date information on this subject please contact a James Moore professional. James Moore will not be held responsible for any claim, loss, damage or inconvenience caused as a result of any information within these pages or any information accessed through this site.