HIPAA Compliance Resources
Practical guides written by the Atascocita IT compliance team for medical practices in Texas.
How ready is your practice? Find out in 2 minutes.
10 questions, an instant Low / Moderate / High risk indicator, and a plain-English list of your biggest gaps. Free, no sign-up.
Free downloads
Buyer guides
How Much Does a HIPAA Audit Cost? What Affects Price for Small Practices
What drives the price of a HIPAA cybersecurity audit for a small medical practice: workstation count, providers, EHR setup and number of locations. Quoted after a free consultation.
HIPAA Security Risk Assessment vs. Vulnerability Scan
A vulnerability scan finds technical weaknesses; a HIPAA security risk assessment evaluates risk to patient data across people, process and technology. Here's how they differ and fit together.
HIPAA Compliance Software vs. a Hands-On Audit: What Small Practices Actually Need
Compliance software organizes policies, training and checklists; a hands-on audit checks how your devices, network and staff actually work. How small practices can decide what they need.
What Happens After a HIPAA Risk Assessment: Remediation Steps
A HIPAA risk assessment is the start, not the finish. How a medical practice turns findings into a risk management plan: prioritize, fix, document and review.
HIPAA Penalty Tiers Explained (2026): Civil and Criminal Penalties
The four HIPAA civil penalty tiers, the 2026 inflation-adjusted amounts HHS published, OCR's enforcement-discretion caps, criminal penalties and how a documented risk analysis helps.
From the blog
All postsRansomware Defence for Medical Practices: The Five Controls That Matter
Most practices buy the wrong thing first. Here are the five controls that actually decide whether ransomware is a bad Tuesday or a front-page breach.
9 min readMFA Is Now Mandatory: What the 2026 Security Rule Means in Practice
The word 'addressable' did a lot of work for a lot of practices. The 2026 NPRM takes it away — starting with multi-factor authentication.
7 min readThe Four Phishing Emails Your Front Desk Will Actually Fall For
Generic security awareness training uses generic lures. Real attacks against clinics look like the work your staff do all day.
8 min readAn OCR Investigation, Start to Finish: What Actually Happens
The letter arrives on a Thursday. Here is what the following months look like, stage by stage, and where practices lose control of the process.
10 min readGuides & articles
The 2026 HIPAA Compliance Checklist for Medical Practices
The 2026 HIPAA Security Rule NPRM is the biggest change to HIPAA in a decade. Here's what medical practices in Northeast Houston must do to stay compliant.
How to Prepare for an OCR HIPAA Audit
OCR sends an initial data request with 10 business days to respond. Here's exactly what they ask for — and how to have it ready before you ever get the letter.
Texas HB300 Explained for Medical Practices
Texas HB300 imposes stricter privacy requirements than federal HIPAA — and Texas AG enforcement is more aggressive than OCR. Here's what your practice actually has to do.