Compliance feels like a cost center until it isn't. The Montefiore Medical Center settled a HIPAA case for $4.75M in 2024 over a single employee data theft from 2015 — because the investigation found inadequate audit logs and risk analysis going back years. Small practices aren't immune: Providence Medical Institute settled for $240,000 over a missing BAA. The distinguishing factor between practices that get caught and practices that don't isn't size; it's documentation.
Below: the 2026 HIPAA requirements (current rules plus the pending Security Rule update), telehealth-specific compliance where most practices have gaps, malpractice and liability coverage that actually matches your risk, and the legal support framework — when to handle it in-house, when to hire an attorney, and how to pick one that actually knows healthcare law.
HIPAA Compliance Essentials
If you don't have a current risk analysis, a documented training program, and executed BAAs with every vendor that touches PHI, everything else in compliance is premature. Start here.
Telehealth-Specific Compliance
The end of HHS enforcement discretion in May 2023 left many practices with telehealth stacks that aren't actually HIPAA-compliant. Free Zoom, unsecured SMS reminders, and personal email for patient communications are the most common gaps.
Malpractice & Liability
Malpractice coverage isn't commodity — policy structure (occurrence vs. claims-made), tail coverage, and entity coverage all matter in ways that only become apparent when you're filing a claim. These resources cover what matters and how to shop.
Legal Counsel
Not every practice needs a healthcare attorney on retainer, but every practice needs to know when to call one. These situations justify the hourly rate; others are better handled in-house.
Self-Assessment & Comparison Tools
Downloadable resources to run a HIPAA self-assessment and to compare malpractice carrier options on the factors that matter at claim time.
Related Guides
Other GetPracticeHelp guides that intersect with this topic.
EHR & Technology
Healthcare practice technology selection guide covering EHR systems, practice management software, and HIPAA-compliant telehealth platforms.…
Credentialing
Healthcare credentialing and payer enrollment guide for practices. Timelines, vendor selection, Medicare/Medicaid, and specialty-specific gu…
Startup & Growth
Starting and running a healthcare practice — financing, staffing, overhead benchmarks, marketing, patient acquisition, financial dashboards,…
Frequently Asked Questions
What are the HIPAA requirements for small medical practices in 2026?
Every covered entity — including solo practitioners — must: conduct and document an annual security risk analysis, implement administrative/physical/technical safeguards, train workforce members on HIPAA policies, execute BAAs with every vendor touching PHI, and notify affected individuals within 60 days of a breach. The proposed Security Rule update expected to finalize in May 2026 adds mandatory encryption, multi-factor authentication, and biannual vulnerability scanning — with a 240-day compliance window after finalization.
How much are HIPAA fines?
HIPAA uses a four-tier penalty structure. For violations assessed on or after August 8, 2024: Tier 1 (reasonable efforts) $141–$71,162 per violation; Tier 2 (lack of oversight) $1,424–$71,162; Tier 3 (willful neglect, corrected) $14,232–$71,162; Tier 4 (willful neglect, uncorrected) $71,162–$2,134,831 per violation. Real 2024–2025 settlements range from $10,000 (small cooperative operators) to $4.75M (Montefiore). The annual cap for identical violations is $2,134,831.
Do small practices really need a Business Associate Agreement with every vendor?
Yes — there's no minimum size threshold. Solo practices need signed BAAs with their EHR vendor, billing company, cloud storage provider, IT support firm, shredding company, and any other vendor that creates, receives, maintains, or transmits PHI. Providence Medical Institute's $240,000 settlement in 2024 was based specifically on a missing BAA. BAAs are typically templates the vendor provides; make sure you have signed copies on file for every active vendor relationship.
How often must I run a HIPAA risk analysis?
Current rules require a risk analysis initially and whenever there's a significant operational, environmental, or technological change. OCR strongly recommends (and the proposed Security Rule would mandate) an annual risk analysis tied to a current technology asset inventory and network map. The single most common cited violation in 2024–2025 enforcement actions was failure to conduct an adequate risk analysis — appearing in over 70% of civil monetary penalties.
What's the difference between occurrence and claims-made malpractice insurance?
Occurrence policies cover any incident that happened while the policy was active, regardless of when the claim is filed — even years later. Claims-made policies only cover claims filed while the policy is active. If you let a claims-made policy lapse (e.g., when leaving a practice or retiring), you need tail coverage to protect against claims filed after the policy ends. Tail can cost 150%–250% of a year's premium and is often forgotten until a claim surfaces. Occurrence costs more upfront but eliminates tail liability.
When should a practice hire a healthcare attorney?
Five situations: (1) entity formation and operating agreements when opening a practice; (2) ownership transitions — sales, partnerships, buy-ins; (3) employment agreements for providers, especially non-competes; (4) any government investigation (OCR, state medical board, Medicare audits); (5) payer contract disputes that can't be resolved in normal negotiation. Most day-to-day legal questions (vendor contracts, routine HR) can be handled by a general business attorney. Healthcare-specific counsel is worth the premium when regulatory or provider-specific issues are involved.
What changed in HIPAA after COVID-era enforcement discretion ended?
HHS's enforcement discretion for telehealth ended May 11, 2023. Many practices using free Zoom, FaceTime, or unsecured messaging apps during COVID haven't transitioned to HIPAA-compliant alternatives — and those are now active violations. The proposed 2025 Security Rule NPRM (expected to finalize in May 2026) will also add encryption, MFA, penetration testing, and vulnerability scanning requirements. If you haven't audited your telehealth stack since 2023, that's your highest-priority compliance gap.