“An entire industry was charging $2,000 a month for annual assessments and generic templates. The practices were paying for a certificate, not protection.”
20 years in enterprise technology. Built the product strategy, market positioning, and growth architecture behind Patient Protect — with the conviction that independent practices deserve real security infrastructure, not paperwork disguised as protection.
Authored guides
29 guides on Patient Protect.
HIPAA compliance software ranges from $39/mo to $40,000/yr. The four pricing models, what's actually included at each tier, and the five red flags that hide the real total cost.
HIPAA risk assessments range from $0 (HHS SRA Tool) to $25,000 (full consultant engagement). The honest breakdown by tier, what you actually get, and how to evaluate quotes.
Patient Protect has released a public HIPAA infrastructure layer — 21 production-grade resources spanning compliance education, risk assessment, training, breach intelligence, public datasets, developer resources, AI-readiness, and a Chrome extension. Free. No login. Under permissive licenses where applicable.
The best HIPAA compliance software in 2026 is not a policy library — it is a security platform that enforces what the new Security Rule will require. Score yours with the Patient Protect Readiness Index (PPRI).
Ranked guide to the 7 patient communication platforms that sign BAAs and handle SMS, secure messaging, video, and email correctly. What each does well and the workflow gaps each one creates.
Ranked guide to the 10 cloud storage providers that offer HIPAA-eligible plans with a signed BAA, plus what each is suited for and the configuration traps independent practices miss.
Ranked guide to the 7 practice management platforms that sign BAAs and serve independent healthcare practices. What each does well, and the compliance work each one leaves to the practice.
The 10 most-cited HIPAA violation categories in OCR enforcement actions, ranked by frequency. What independent practices get wrong, and what to put in place before the audit.
Ranked guide to the 8 EHR platforms most commonly adopted by independent healthcare practices, with the HIPAA configuration responsibility each one transfers back to the practice.
What happens when you sign up for Patient Protect. A minute-by-minute breakdown showing how architecture, guided setup, and acknowledgments cover ~70% of HIPAA requirements in under 60 minutes.
All 5 standards and 9 specs under §164.312 — classified required vs. addressable with implementation steps for independent practices. Free checklist included.
OCR audits don't appear at random. They follow predictable triggers — patient complaints, breach reports, media coverage, referrals. These are the nine independent practices most often miss.
OpenAI won't sign a BAA, but your staff is already pasting patient data into ChatGPT. The HIPAA rules you're breaking, the penalties, and how to stop it now.
Eight recurring patterns across HHS OCR enforcement settlements that independent practices should treat as roadmap, not surprise. What each settlement tells the next practice in line.
HHS proposed major updates to the HIPAA Security Rule. MFA becomes mandatory, risk assessments get more specific, and incident response timelines tighten. Here is what independent practices need to know.
AI amplified the value of stolen medical records by 30%. How artificial intelligence is making healthcare breaches more damaging, more expensive, and harder to contain.
How AI lowered the cost of exploiting healthcare data, why stolen PHI trades like currency, and what independent practices can do about the information asymmetry.
Independent practices face a six-fold surge in cyberattacks and carry enterprise-grade compliance obligations with none of the infrastructure. Here is what that actually costs.
6 HIPAA compliance platforms compared for independent practices: prevention vs. paperwork. Pricing from $39/mo, BAAs, methodology, vendor scoring.
Step 7: Provide PHI access, honor patient requests, track disclosures, and deliver Notice of Privacy Practices — the Privacy Rule in practice.
Step 4: Secure physical access to ePHI — manage devices, enforce encryption, and reduce HIPAA risk with documented controls.
Step 5: Protect ePHI at the device level — encrypt hardware, enforce mobile controls, and harden your HIPAA infrastructure.
Step 6: Implement HIPAA-compliant access controls — RBAC, vendor permissions, audit trails, and the minimum necessary standard.
Step 1 of our 17-step HIPAA compliance series. Determine whether you are a Covered Entity, Business Associate, Hybrid Entity, or Vendor — and what that means for your obligations.
Step 2: Conduct risk assessments, monitor threats, and document mitigation strategies to keep your practice secure and audit-ready.
Step 3: Assign Privacy and Security Officers, deliver required training, and document policies to protect your practice and meet HIPAA standards.
Some HIPAA compliance platforms are built on outdated technology that creates the very vulnerabilities they claim to prevent. Here is how to check yours.
Feature checklist, pricing benchmarks, and vendor red flags. What separates real compliance platforms from documentation-only tools — for independent practices.
A buyer's guide for independent practices evaluating HIPAA compliance platforms. What actually matters, what to skip, and why most tools deliver documentation exercises instead of operational security.
