October 21, 2025 Running a healthcare practice means juggling patient care, staff, and countless responsibilities. Somewhere in the mix, HIPAA can feel like one more thing on the never-ending list. Understandably, compliance might not always top your priorities. But that’s precisely where many practices get caught off guard. Misunderstanding what HIPAA truly requires can lead to costly mistakes. Even the most well-intentioned practices can fall for common HIPAA misconceptions that put them at risk. It’s time to debunk myths and get your practice back on track. Myth 1: HIPAA only applies to large hospitals We hate to break it to you, but if your practice handles Protected Health Information (PHI), you must follow HIPAA. It doesn’t matter if your practice has five employees or 5,000; it’s held to the same standards. HIPAA investigators can and will continue to investigate small practices. In fact, one of the most recent fines was a single facility healthcare provider for $250,000 after a ransomware attack exposed several HIPAA violations. Smaller practices often don’t have the same IT departments, legal teams, or budgets as large hospitals, which makes HIPAA violations even more damaging. A fine or breach can strain finances, disrupt daily operations, and erode patient trust, which took years to build. Myth 2: We do HIPAA training – we’re good! Full HIPAA compliance is much more than training. Thorough HIPAA training is necessary, but ensuring staff are educated on their responsibilities is only scratching the surface of a compliant practice. One of the most commonly missed HIPAA requirements is the Security Risk Analysis (SRA). The SRA is a thorough review of all physical, administrative, and technical safeguards your practice currently has in place. Does your practice have an alarm? If so, does every staff member have individual codes to disarm it? Does your practice deploy antivirus software? Does your staff ensure patients are unable to see computers with PHI? These are all example questions of what the SRA assesses. The SRA is a required document that is strongly recommended to be completed annually. Proposed legislation would require this document yearly for all regulated entities, and Business Associates would have to submit their documentation and be certified by a cybersecurity expert. Unfortunately, only 14% of practices could produce a compliant SRA during the last round of HIPAA audits, making this a commonly missed requirement. The Office for Civil Rights (OCR) is investing more resources to ensure all regulated entities know this document is essential. The OCR has introduced a Risk Analysis Initiative, fining and highlighting practices as an example of missing the SRA. While the SRA is one of the largest requirements for HIPAA, all of its requirements come together like a puzzle. The SRA, training, proper technical safeguards, Business Associate Agreements, documentation, and more all ensure that a practice upholds HIPAA legislation. Myth 3: My IT company handles HIPAA for me If only it were that easy. While having an IT company is encouraged to ensure that your technical safeguards are in place to protect PHI, that doesn’t necessarily mean they handle all your HIPAA requirements. For example, while your IT company can equip your email systems with compliant email encryption, it cannot prevent a breach if a staff member accidentally emails PHI to the wrong patient. If you are investigated because of this, although your IT team can provide technical knowledge, the OCR will request more information about training, documentation, and other areas not within your IT team’s expertise. The human factor is often the weakest link in data protection. Even the best encryption can’t prevent an employee from falling for a phishing scam or leaving a chart open on their desk. That’s why consistent staff training and clear procedures are as essential as your technical defenses. While your IT company can assist with the technical side of HIPAA, it’s strongly recommended that you utilize a compliance platform for training, documentation, your SRA, and more to address the other requirements. Relying solely on your IT provider can leave your practice vulnerable. HIPAA requires comprehensive compliance, secure technology, thorough documentation, SRAs, training, and ongoing monitoring. Myth 4: If a patient posts their own info online, I can comment Even if your patient posts a glowing review of how wonderful their experience was with your practice, you cannot comment on a personal response. By commenting on an individual response, you are confirming that this reviewer was a patient at your practice, a big HIPAA no-no. When answering any review, keep it brief and generic. For instance, “Thank you for your kind words. If you have any questions or further feedback, contact 123-456-7891.” is a compliant response. If you’d like to use a patient’s experience in marketing material, communicate with them through a secure channel and provide a media consent form. If you receive a negative response, take the reviewer offline and provide a secure communication channel, like a phone number or encrypted email. You should never get upset while responding online. Practices have been fined for inappropriate responses, such as leaking PHI to prove a point. Myth 5: A data breach automatically means a fine You can take a deep breath, because not every data breach turns into a hefty fine. Even with strong safeguards, no healthcare practice is entirely immune to risk. With ransomware attacks on the rise, cybercriminals are constantly evolving their tactics to exploit the sensitivity of patient data. It’s important to remember that HIPAA fines stem from missing or insufficient compliance measures, not the breach itself. That’s why proactive compliance is so critical. When your practice maintains proper safeguards and documentation, you significantly reduce your practice’s risks. During an investigation, the OCR will ask for documentation or proof that your practice protected patient data before the situation, how your practice handled the breach, and what your practice currently has in place following the incident. If your documentation is compliant, proving your practice takes the proper precautions and promotes a culture of compliance, the OCR can close the investigation, meaning no fine. What HIPAA Really Means
