Ghosts of HIPAA Past - Ten Years Later - Ep 584

Ten years ago, we took a terrifying tour through the Cyber Scary Haunted House. Now, 507 episodes later, we're going back to see if anybody ever cleaned the place up. Spoiler alert: They didn't! The same old cybersecurity monsters are still lurking around, some have gotten even scarier, and AI has opened an entirely new wing of horrors. Join us for our annual Halloween episode as we revisit the ghosts of HIPAA past, meet some frightening new residents, and discuss what healthcare organizations can do to keep these monsters from haunting their patients.

More info at HelpMeWithHIPAA.com/584

Check out the episode!

HIPAA Penalty Math $5.9m to $140K - Ep 583

Ever wonder how a $5.9 million HIPAA penalty turns into just $140,000? No, it's not some clever investment strategy. It's HIPAA penalty math, and this case raises more questions than answers. What started as a patient simply trying to get a copy of their dental records uncovered missing records, questionable safeguards, nonexistent policies and procedures, and a whole lot of resistance to OCR's investigation. Even after a significant reduction in penalties, the bigger question remains: What happens when an organization would rather pay the fine than fix the problems? This week, we're breaking down the numbers, the failures, and the lessons every healthcare organization should take away from this enforcement case.

More info at HelpMeWithHIPAA.com/583

Check out the episode!

Cybersecurity Starts at Home and Then Goes to Work - Ep 582

What could nine seconds possibly do for your cybersecurity? Maybe more than you think! Cybersecurity doesn't start when you clock in at work. It starts at home, with the everyday decisions we make online. In this episode, we're celebrating Cybersecurity Awareness Month by exploring simple ways to build better security habits that protect our families, coworkers, and communities. From the Take 9 campaign and the power of a nine-second pause to free tools that help protect your digital life, we're sharing practical tips that remind us cybersecurity doesn't have to be complicated. There are a few laughs, some useful advice, and one very simple challenge: Pick something and do it! Because knowing what to do doesn't help much if you never actually do it.

More info at HelpMeWithHIPAA.com/582

Check out the episode!

Are You Ready for the Rules to Catch Up? - Ep 581

Cyber threats are moving at lightning speed, while regulations seem to be taking the scenic route. But what happens when the rules finally catch up? Will healthcare organizations be ready, or will they find themselves scrambling to meet expectations they should have been preparing for all along? In this episode, Donna and David dig into proposed HIPAA Security Rule changes and cybersecurity legislation being discussed in Congress. From minimum security standards and leadership accountability to proving that safeguards actually work, the message is becoming pretty clear: simply saying you're secure isn't enough. And while everyone waits to see which rules become reality, the threats aren't waiting around. It's time to ask whether you're truly protecting your organization and patients, or just hoping your IT provider has everything covered.

More info at HelpMeWithHIPAA.com/581

Check out the episode!

Keeping Humans in Charge of AI - Ep 580

Everybody wants AI to make things faster and easier. And it can. The problem starts when “AI is helping us” turns into “AI is doing it, so we stopped checking.” This week, Donna and David talk about why keeping a human in the loop isn’t enough if that human is just clicking “approve”, how agentic AI changes the risk equation, and why organizations need real guardrails, governance, and accountability before turning AI loose. AI may be able to do a lot of the work, but that doesn’t mean it should be the one making all the decisions. 

More info at HelpMeWithHIPAA.com/580

Check out the episode!

SMB Security Makes Progress BUT - Ep 579

Small businesses are making progress on cybersecurity, and that’s worth celebrating. But are they actually as prepared as they think they are? In this episode, Donna and David dig into the 2026 Small Business Cybersecurity Awareness and Practices Survey and the gap between confidence and readiness. From MFA and backups to incident response, testing, documentation, and the rapidly changing risks of AI, they discuss why putting security tools in place is only the beginning. Real security means knowing what’s working, verifying it, and being able to prove it.

More info at HelpMeWithHIPAA.com/579

Check out the episode!

The Risk Analysis Reality Check - A Screwdriver Is Not a Hammer - Ep 578

There is no shortage of tools, scans, checklists, and reports that promise to help with cybersecurity, but calling something a risk analysis does not magically make it one. This episode takes a hard look at what OCR keeps saying about Security Risk Analysis, why incomplete SRAs continue to show up in enforcement actions, and why understanding your actual environment still matters more than simply checking the right boxes.

More info at HelpMeWithHIPAA.com/576

Check out the episode!