ABYDE FOR DARKHORSE TECH USERS

It's time for stress-free compliance.

  • EASIEST SOFTWARE YOU’LL EVER USE

    And if we’re being honest, easy is an understatement. All companies say it, but we are so confident in the simplicity of our software that we will prove it.

  • ‘HANDS OFF’ APPROACH

    We automate it all – from notifications about training to policy generation. Can you imagine not having to set your own reminders?! Go ahead, focus on your patients – we will ping you with the important stuff.

  • CUSTOMER SUCCESS TEAM LIKE NO OTHER

    We will meet you where you are – whether that’s by phone, chat, or email. It’s tough stuff in the tech space, but our customers love us as much as we love them.

  • STATE BY STATE, LAW BY LAW

    No matter what state your practice is in, our solution is for you — from sea to shining sea. We know our stuff and dedicate ourselves to staying on top of the latest state and federal changes so you don’t have to.

  • MORE THAN JUST SOFTWARE

    With us, you get more than policies and software. We offer Master Classes, newsletters, and more to keep you up to date. At the end of the day, we are proud to lead with education.

LATEST COMPLIANCE NEWS

HIPAA Compliance Officers

HIPAA Compliance Officers: Building a Culture of Patient Privacy

October 8, 2025   What happens when a patient calls with a complaint about their medical records? Or when a Business Associate requests access to your data? If you’re unsure, it’s time to meet with your practice’s HIPAA Compliance Officer (HCO).  HIPAA requires hiring a compliance officer (HCO), which is key to building a foundation of HIPAA compliance for your practice. More than just a box to check, having an HCO provides structure and clarity for your practice, ensuring that all the proper safeguards are in place to secure patient data.  While the HCO title might seem like a simple administrative label, the duties are anything but. This vital oversight ensures that everyone knows their HIPAA responsibilities and that patients’ Protected Health Information (PHI) is kept under lock and key.    Behind the Badge: Responsibilities of an HCO An HCO wears many hats when it comes to compliance. From safeguarding PHI to managing vendors, these responsibilities form the backbone of a practice’s HIPAA program.  First, the HCO needs to complete a Security Risk Analysis (SRA) for the practice. The SRA is a thorough document detailing all physical, technical, and administrative safeguards to keep PHI safe. The HCO should update it annually, and new legislation has been proposed to define this as a yearly requirement strictly. An SRA can be completed by hiring a third-party consultant, leveraging smart software, or even manually entering the information. HCOs should consider time investment, accuracy, and cost before choosing an approach.  The HCO must ensure that every staff member is adequately trained and aware of their responsibilities before interacting with PHI. This includes showing new staff where compliance documents (policies, procedures, forms, etc.) are and equipping staff with thorough training to handle any situation with PHI. Additionally, the HCO must ensure all training and documentation are current and in line with the latest legislation. HCOs must also ensure that any relationship with a vendor is handled correctly and there’s documentation to prove it. The vendors, or Business Associates (BAs), that work alongside healthcare providers and have access to PHI must also be HIPAA compliant. One of the most important documents when working with a BA is the Business Associate Agreement (BAA). This required agreement holds both parties liable and defines their responsibilities. Both BAs and Covered Entities must sign this document before working together. The Office for Civil Rights (OCR) can and has fined practices for missing a BAA after a breach.  This is only a brief overview of the many responsibilities HCOs take on. A good HCO establishes a culture of compliance, ensuring that protecting patient information becomes second nature for the entire practice.   Streamlining HCO Responsibilities At the end of the day, the HCO is the practice’s go-to authority for HIPAA. From handling patient complaints to addressing staff concerns and representing the practice during an investigation, the HCO is the person everyone turns to. While taking on this role might be overwhelming, intelligent solutions can streamline and assist HCOs to ensure they’re always on top of compliance. You can proactively identify gaps and take control by leveraging the right compliance tools. These tools automate and streamline compliance, allowing HCOs to spend less time buried in paperwork and more time guiding their teams. Meet with a compliance expert today to learn more about HIPAA compliance in your practice. 

Read More »
Cadia Healthcare HIPAA Fine

From Success Stories to HIPAA Violations: Cadia Healthcare’s $182K Lesson

October 6, 2025   Remember: sometimes, it’s not your story to tell.  While your practice might be excited to share the positive results of quality patient care, it’s your patients’ right to share their stories. Patients’ medical histories and treatment plans are considered Protected Health Information (PHI), and it’s your practice’s responsibility to safeguard all sensitive patient data.  Cadia Healthcare Facilities is the latest rehabilitation organization caught in the Office for Civil Rights’ (OCR) crosshairs after improperly disclosing patient health stories online. Notified by a patient complaint, the OCR investigated the organization and settled the violation with a $182,000 fine and a two-year Corrective Action Plan (CAP). A major financial and reputational hit, paired with thorough government monitoring, is a lesson learned for the organization.  The 20th fine of the year teaches healthcare practices the importance of HIPAA-compliant marketing, website management, and patient consent.    What Happened?  The rehabilitation organization implemented a Success Story section on its site, with 150 patients’ stories publicly highlighted on the page. This page had extensive PHI, including a patient’s name, image, conditions, treatment, and recovery plans.  While Cadia Healthcare Facilities utilized the website with good intentions, these Success Stories quickly turned into HIPAA horrors. The reason why? Missing HIPAA authorization forms for all 150 featured patients. Then, a patient contacted the OCR with concerns about their image being used without permission on the Cadia Healthcare Facilities website. That’s when the OCR discovered the rehabilitation organization’s noncompliant website and impermissible disclosures.  In addition to the fine and government monitoring, the organization must notify all impacted patients that their information was breached on its site, per the Breach Notification Rule.   Share Online Compliantly Posting your practice’s accomplishments online might be exciting, but your practice must handle it carefully.  Your practice must obtain a HIPAA authorization form before publicly sharing patients’ PHI. This includes before-and-after photos, testimonials, and, in this case, success stories. The forms must be written and specific, and patients can withdraw permission at any time.  Your practice’s online presence is likely a new patient’s first impression, so it’s essential to maintain and update your webpage. However, having more likes and views should never outweigh your commitment to compliance and patient protection. Are you confident your staff understands how HIPAA compliance extends to social media and other forms of marketing? With smart software, your practice can easily train and provide staff with the required documents for HIPAA-compliant social media use. The right compliance solution will empower your staff to handle HIPAA compliance with ease, allowing them to build an online presence while keeping patient data safe.  To learn more about HIPAA compliance for your practice, meet with a compliance expert today. 

Read More »

READY TO BE STRESS-FREE?