Category: Compliance

Your Business is About to Get Hacked

 Author: Seymore Bones  Published Date: October 12, 2026  Leave a Comment on Your Business is About to Get Hacked

Hackers are looking for weaknesses and, when found, they’ll pounce.

If any of the following resemble your practice, you are definitely in trouble.

1. You have higher than average employee turnover.

If you’re losing employees more than the norm than there may be a reason behind this – like lower than average pay, less than fabulous working conditions, etc.  When employees leave they sometimes take data with them – usually inadvertently but sometimes on purpose to use with a competitor or other vengeful reasons.  Re-address your employee concerns and do your best to limit turnover – you will reduce a chance of a hack that way

2. Your staff is remote and/or mobile.

When employees are moving around they are moving around with your data – it can be easily lost or stolen.  If an employee or contractor is remote then they are connecting to your database through online services and these have a chance of being hacked.  Work with an IT person to make sure you have strong data management and connection tools in place for these remote people and make sure they’re being monitored

3. You have no IT support.

Speaking of an IT (information technology) person:  get one.  Even the smallest of companies are exposed to a data hack.  Paying someone to evaluate your risks, install software, monitor activity and keep things up to date is a critical and essential business cost – even the work is done monthly (it all depends on your size and activity)

4. You do not buy security software.

Subscribe to one of the great security applications like McAfee, Norton, Malwarebytes or Bitdefender.  There are many others.  These software applications are inexpensive, run quietly in the background of every device and are checking for malware, viruses, infected websites and other tools of the hacker.  Make sure this software is always updated.

5. Your employees do not get trained.

Most security problems, particularly at small companies, are from employee-related errors – clicking on bad websites, opening up infected files, etc.  Invest in a day of training a few times a year with a good IT security firm so that your employees are well aware of potential problems and can avoid doing dangerous stuff.

6. You have no procedures for securing data.

If you are handling health, financial or other personal information about your customers, and it gets stolen, you could have a big problem on your hands.  Keeping this data in an unprotected place means that hackers are going to find it.  If this is you, then you’re going to need procedures and policies around the safeguarding of confidential customer data.  And after they’re written training will be required to ensure that your employees are complying.

7. Your computers and operating systems are old.

Thousands of computers around the world are still running older, out of date versions of Microsoft Windows.  All hackers need is one vulnerable computer to attack and then can get on a network and wreak havoc.  One of the best ways to avoid a hack is to ensure that all of your computers are running the most recent versions of Windows or iOS all the time.  If a desktop or other device is too old to handle the new operating systems then buy a new one.  The cost will pale in comparison to the cost you’ll incur if you’re hacked

8. You have no BYOD policy.

Are your employees allowed to bring their own devices (a BYOD policy) and use them for work?  That’s what most companies do. Unfortunately, this can create security issues if they are not monitored.  Many companies use remote management software to install company apps on their employees’ devices for a secure access while other companies issue their own devices to their employees which have been secured.  So, what is your Bring Your Own Device policy?  Every company must have one and every company must have an IT person monitoring those devices.

9. Password changes are not enforced.

Most people are pretty complacent with passwords – the most common one, if you can believe it, is still “1234.”  You must require a more complicated password for your employees to enter your network – a combination of letters, numbers and symbols – and this password should be required to be changed every month or two.  That way passwords are more difficult to hack and hackers may move on to another easier target.
Speaking of an IT person; Get One

HIPAA Compliance is Not A Choice

 Author: Seymore Bones  Published Date: July 1, 2025  Leave a Comment on HIPAA Compliance is Not A Choice

The HHS Office for Civil Rights (OCR) just sent another clear message: HIPAA compliance isn’t optional no matter your practice size.

The OCR has reached a resolution with Vision Upright MRI, a small California imaging provider, after a breach of unsecured protected health information (PHI) impacted 21,778 patients. The breach originated from an unsecured server that housed radiology images and lacked proper risk analysis, audit controls, and breach notification procedures.

What happened:

  • No HIPAA risk analysis ever conducted
  • Breach notification wasn’t sent within the required 60-day timeframe
  • ePHI was stored on an unprotected PACS server

As a result, the total settlement cost was a $5,000 fine plus 2 years of monitoring in addition to mandatory corrective actions including:

  • Risk analysis 
  • Mandatory training 
  • Updated policies and procedures
  • Encryption and audit protocols  

Why this matters to you:

Whether you’re a solo provider or part of a large system, OCR expects every HIPAA-covered entity to:

  • Identify where ePHI resides
  • Conduct and update risk analyses regularly
  • Encrypt ePHI in transit and at rest
  • Provide HIPAA training tailored to roles
  • Maintain up-to-date breach response protocols
  • Monitor audit logs and respond to anomalies

Mandated CME Requirements Are Shifting

 Author: Seymore Bones  Published Date: May 15, 2025  Leave a Comment on Mandated CME Requirements Are Shifting

A recent reorganization of Texas Medical Board (TMB) rules has removed certain universal CME obligations. The removal of universal CME requirements could result in a lighter load for physicians but may make it more challenging to determine what is required and when. 

Please click the button below to view the entire article from Texas Medical Assocation.

View Article

Exclusion Review (HOW TO)

 Author: Seymore Bones  Published Date: March 18, 2025  Leave a Comment on Exclusion Review (HOW TO)

Part 3 of 3: System for Award Management Report (SAMS)

This one is a little bit tricky. If you need help, please give us a call. 

Click here for printable instructions

Exclusion Review (HOW TO)

 Author: Seymore Bones  Published Date: March 18, 2025  Leave a Comment on Exclusion Review (HOW TO)

Part 2 of 3 Exclusion Review: Texas Office of the Inspector General

Click here for printable instructions

Exclusion Review Part 1 of 3

 Author: Seymore Bones  Published Date: March 18, 2025  Leave a Comment on Exclusion Review Part 1 of 3

Texas Office of Inspector General (OIG) Exclusions

Don’t forget to retain searches for 10 years. 

Click here for printable instructions

Exclusion Review

 Author: Seymore Bones  Published Date: March 17, 2025  Leave a Comment on Exclusion Review

There are three (3) websites you are required to search before hire and monthly thereafter. 

POET has tried to put together a step by step instruction to help you navigate each one. Today is: 

PART 1 of 3: Office of the Inspector General (OIG)

Printable Version
Exclusion Review Policy

What is the Security Rule Anyway?

 Author: Seymore Bones  Published Date: February 28, 2025  Leave a Comment on What is the Security Rule Anyway?

The Security Rule specifically sets out to ensure the “confidentiality, integrity,
and security” of electronic protected health information (ePHI). What does that mean?
• Confidentiality: ePHI is not available or disclosed to unauthorized persons.
• Integrity: ePHI is not altered or destroyed in an unauthorized manner.
• Availability: ePHI is accessible and usable on demand by an authorized person.

Security Rule

Don’t Be Caught Unaware

 Author: Seymore Bones  Published Date: February 27, 2025  Leave a Comment on Don’t Be Caught Unaware

Key HIPAA Security Rule components:

  • Appoint a security officer: Assign someone responsible for overseeing HIPAA security compliance, which
    includes managing risk assessments, audits and staff training.
  • Implement access controls: Limit access to ePHI to authorized personnel only, and use strong password
    policies, multi-factor authentication (MFA) and user role-based access
  • Conduct regular risk assessments: These are explicitly required for HIPAA compliance.
    Covered entities and business associates are required to “conduct an accurate and thorough
    assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and
    availability of electronic protected health information (ePHI).” This is often referred to as a “risk
    assessment” or “risk analysis.”
    ♦ A one-time risk assessment is not enough. Risk assessments need to be ongoing and
    periodic to ensure that new threats, vulnerabilities and changes to systems are consistently
    evaluated. This should be annually or as dictated by your organization’s risk profile.
    ♦ Document all risk assessment processes and results to meet HIPAA audit
    requirements.
  • Schedule regular security audits: While a risk assessment identifies threats and
    vulnerabilities, security audits go deeper into validating whether your safeguards and
    controls are both in place and effective.
    ♦ Administrative safeguards: Audits check for proper security policies, workforce
    training, and contingency planning.
    ♦ Physical safeguards: Audits assess physical controls around facility access and device security.
    ♦ Technical safeguards: Audits evaluate technical controls such as encryption, access controls and
    network monitoring.
    ♦ By conducting these audits on a scheduled basis (e.g., annually or quarterly, depending on the
    organization’s size and risk profile), you can detect and address any areas of non-compliance before they
    become liabilities.
  • Establish data backup systems: Regularly back up ePHI and store backups securely offsite
  • Enable audit logs: Activate and monitor audit logs for all systems handling ePHI.

What are the Security Requirements for HIPAA Compliant Emails?

 Author: Seymore Bones  Published Date: January 30, 2025  Leave a Comment on What are the Security Requirements for HIPAA Compliant Emails?

Security Rule (§164.306)

(a) ENCRYPTION: Securing email containing PHI from end to end. You may visit “The National Institute of Standards and Technology” for advice on the latest and most suitable standards for email services.

(b) Email Phishing Protection: Technology can include email filters and spam protection systems that help detect and block phishing emails before they reach the user’s inbox. Anti-phishing software solutions can detect and block phishing attempts by analyzing web traffic and identifying malicious websites designed to steal user credentials.

(c) Spam Protection: Email spam protection is a system designed to detect and block unwanted or potentially harmful email messages from reaching a user’s inbox.

(d) Virus Protection: Installed on email servers and user devices, virus protection solutions scan emails, including attachments and links in emails for viruses. The software is automatically updated with the latest virus definitions to protect against new threats and provide continuous monitoring and real-time protection of email traffic. 

(e) Ransomware Protection: Ransomware security protection involves a range of measures and tools designed to prevent, detect, and respond to ransomware attacks. In addition to antivirus software, phishing detection, spam filters, and email filtering discussed above, ransomware includes endpoint protection which monitors and secures individual devices against ransomware attacks along with the entire network of devices.

For more content follow this link to "The HIPAA Journal"