Skip to content
Beefed Up IT

Blog

HIPAA & Compliance

Plain-English guidance on the HIPAA Security Rule, BAAs, risk assessments and other rules small practices and firms have to follow.

HIPAA & ComplianceBusiness Associate Agreements (BAA): An IT Vendor GuideWhich IT vendors need a HIPAA BAA (MSP, Microsoft, backup, phone, fax, email, cloud), what it must say, red flags, subcontractors and Microsoft's BAA.26 min readHIPAA & ComplianceHIPAA Breach Response Plan: First 24 Hours to 60 DaysWhat to do after a HIPAA incident: the first 24 hours, the 4-factor risk assessment, notification deadlines, the 500 rule, ransomware, and a plan template.26 min readHIPAA & ComplianceHIPAA Compliant Email Encryption: A Practical Guide (2026)When HIPAA requires email encryption, TLS vs end-to-end vs portal encryption, setting up Microsoft Purview Message Encryption, emailing patients, and a policy template.24 min readHIPAA & ComplianceHIPAA Security Risk Assessment: Step-by-Step GuideHow to do a HIPAA Security Risk Assessment for a small practice: what OCR expects, the HHS SRA Tool, documentation, how often, and a sample risk register.26 min readHIPAA & ComplianceHIPAA Security Rule Checklist for Small Practices (2026)Every HIPAA Security Rule safeguard for a 5–50 person practice: administrative, physical, technical, required vs addressable, and how to do it in Microsoft 365.32 min readHIPAA & ComplianceHIPAA Security Rule Proposed Changes: Status and What to DoHHS proposed a major HIPAA Security Rule update in January 2025. Its status as of October 2026, what it would require, and the steps small practices should take now.24 min readHIPAA & ComplianceIs Microsoft 365 HIPAA Compliant? BAA, Setup and LicensingMicrosoft signs a HIPAA BAA for Microsoft 365, but compliance depends on setup. What's covered, which license you need, and a step-by-step hardening checklist.26 min read

Let's make your IT one less thing to worry about.

Book a free 20-minute call. We'll listen, look at what you have, and tell you honestly what we'd do.