Compliance
HIPAA Compliance Services for Medical and Mental Health Practices
Our HIPAA compliance services cover the Privacy, Security and Breach Notification Rules for medical and mental health practices. OCR's Risk Analysis Initiative reached its 14th enforcement action on June 18, 2026, so the security risk analysis comes first. We build the program with you and keep it current as the rules change.
The short answer
What do HIPAA compliance services cover?
The security risk analysis, privacy and security policies, the Notice of Privacy Practices, business associate agreements, workforce training and breach risk assessments, each kept 6 years. Act on records requests within 30 days and notify patients of a breach within 60 days of discovery. The Advixor Group develops and updates your policies and patient notices, coordinates HIPAA training, conducts compliance reviews and risk assessments, and tracks rule changes.
Sources45 CFR 164.30845 CFR 164.31645 CFR 164, subpart D45 CFR 164, subpart E
Risk Analysis
HIPAA compliance consulting starts with the security risk analysis
- Not yet law: HHS’s January 2025 update (encryption, multi-factor authentication and yearly training among its items) is still a proposal, targeted for July 2027 on the federal agenda.
- OCR’s 2026 findings: no accurate and thorough risk analysis behind a $450,000 health-plan settlement (June 18), a $552,250 health-system settlement (July 29), and a $700,000 genetic-testing settlement that also cited no procedure for ending a departing employee’s access and no unique user IDs (September 17).
Marked “Required”
“Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.”
Documents and Deadlines
HIPAA compliance for healthcare providers: the documents and deadlines
| Document or task | Deadline or frequency | Rule (45 CFR) |
|---|---|---|
| Security risk analysis and risk management plan | No fixed interval; periodic evaluation and review | 164.308(a)(1), (a)(8); 164.316(b)(2) |
| Privacy official, complaint contact, security official | Named in writing | 164.530(a); 164.308(a)(2) |
| Privacy and security policies | Updated when the law or your operations change | 164.530(i); 164.316 |
| Notice of Privacy Practices | By the first service, telehealth included (have it ready when you open a practice); posted in the office and online; acknowledgment sought. Since Feb 16, 2026, HHS requires it to include information on 42 CFR Part 2 substance use records | 164.520(b)(1)(ii)(C)–(D), (c), (e); HHS model notices |
| Business associate agreements | Before any PHI is shared; binding subcontractors too | 164.504(e); 164.314(a) |
| Workforce training | New staff within a reasonable period; after material policy changes; ongoing security awareness | 164.530(b); 164.308(a)(5) |
| Amendment request | 60 days; one 30-day extension | 164.526(b)(2) |
| Accounting of disclosures | 60 days; one 30-day extension; covers 6 years; the first in 12 months free | 164.528 |
| Complaints and workforce sanctions | Each documented, with its outcome | 164.530(d), (e) |
| Breach risk assessment | Before deciding not to notify | 164.402; 164.414(b) |
Source eCFR, current as of Oct 15, 2026.
Keep each for 6 years from its creation or the date it was last in effect, whichever is later (164.316(b)(2)(i); 164.530(j)(2)).
Front Desk
HIPAA compliance help for the front desk: records requests in 30 days
- The clock: act within 30 days of the request; one extension of up to 30 more days needs a written reason and a new date, sent inside the first 30.
- The format: the form and format the patient asks for, if readily producible, and an electronic copy of electronic records.
- The fee: HIPAA allows only a reasonable, cost-based fee for copying labor, supplies, postage and an agreed summary. Florida requires copies “in a timely manner, without delays for legal review,” never conditioned on paying for services (s. 456.057(6)), and Board of Medicine licensees charge patients at most $1.00 a page for the first 25 pages and 25 cents a page after (Rule 64B8-10.003). Ask your attorney which limit governs a request.
- Therapy practices: psychotherapy notes kept apart from the record are outside the right of access (164.524(a)(1)(i)); medications, session times, test results and summaries of diagnosis, treatment plan and progress are not psychotherapy notes (164.501), so that exclusion doesn’t cover them. See also our progress notes guide.
- Enforcement: slow access has drawn civil money penalties of $70,000 to $200,000 (2024–2025).
After a Breach
HIPAA consulting after a breach: the four-factor test and the deadlines
An impermissible use or disclosure is presumed a breach unless a documented risk assessment shows a low probability that the information was compromised, weighing at least what information was involved, who received it, whether it was actually acquired or viewed, and how far the risk was mitigated. You carry the burden of proof (164.402; 164.414(b)). The notices below apply to breaches of unsecured PHI (164.402; 164.404(a)(1)).
- Patients: without unreasonable delay and within 60 calendar days of discovery, in plain language, by first-class mail or agreed email: what happened and when, what information, steps to take, what you are doing, and a toll-free number, email, website or postal address (164.404). With 10 or more unreachable, a 90-day home-page posting or major media, plus a toll-free line for 90 days.
- HHS and media: for 500 or more people, HHS at the same time as patients; for fewer, a log reported within 60 days after the calendar year ends (164.408). More than 500 residents of a state also means prominent media (164.406). OCR investigates every breach of 500 or more; a breach of PHI that is also a Part 2 record is reported separately, as a HIPAA breach and a Part 2 breach.
- Florida: 30 days from determining a breach, to patients and, when 500 or more Floridians are affected, to the Department of Legal Affairs. Under s. 501.171(4)(g), notice that follows your primary or functional federal regulator’s rules is deemed to meet Florida’s notice to individuals, and a copy timely sent to the Department is deemed to meet the Department notice; whether that covers your breach is your attorney’s call. The civil penalty is $1,000 a day for 30 days, then $50,000 per 30 days, up to $500,000, per breach and not per person (s. 501.171(9)(b)).
Penalties
What a HIPAA audit or investigation can cost
The maximum per violation is $73,011 in the first three tiers and $2,190,294 for uncorrected willful neglect, also the calendar-year cap for identical violations. No penalty applies to a violation you show was not willful neglect and was corrected within 30 days of when you knew, or should have known, of it (160.410(c)). Otherwise the amount turns on the people affected, how long, the harm, your compliance history and your size (160.408), and HHS must weigh 12 months of recognized security practices, such as NIST methods or the HHS 405(d) approaches, without raising a fine for lacking them (42 U.S.C. 17941).
- Criminal: up to $50,000 and 1 year for knowingly obtaining or disclosing health information in violation of HIPAA, up to $250,000 and 10 years to sell it or use it for gain or harm (42 U.S.C. 1320d-6).
- Part 2: substance use disorder records follow the same four tiers, $103 to $1,538,970.
Source 45 CFR 102.3, Table 1 (2025 amounts, kept for 2026 under OMB memo M-26-11); tiers in 45 CFR 160.404.
Our Services
Our HIPAA compliance consultants: what we do, and what goes to your attorney
We also perform the security risk analysis with your IT vendor and build the risk management plan, put business associate agreements in place, draft your breach response plan, set up the access-request log and train the front desk on it, and review Part 2 consent practices for substance use programs.
HIPAA sits inside your wider compliance program. We provide compliance consulting and coordination, not legal advice: contract terms, breach-notice decisions and other legal questions go to your own attorney.
HIPAA compliance services
We guide you on these rules, and we:
- Develop and update your privacy and security policies and procedures, with the patient notices, acknowledgments and consent forms that go with them
- Develop and coordinate HIPAA training for your workforce and help maintain the training records
- Conduct internal compliance reviews and risk assessments, and help with inspections, audits, investigations and corrective action plans
- Guide your website and patient communications on digital compliance and advertising rules
- Track rule changes, such as the Privacy Rule final rule under White House review since April 2, 2026, and tell you what to update
What’s included
What our HIPAA compliance services include
HIPAA BAAs
When a vendor needs a business associate agreement, and what it must say.
Learn moreHIPAA checklist
Every HIPAA document and deadline on one checklist.
Learn moreCompliance training
HIPAA training for new staff and after policy changes, with training records.
Learn moreMarketing compliance
HIPAA rules for marketing, your website and patient communications.
Learn moreHR and staff training
Sanction policies for staff who break privacy or security rules, and how to document them.
Learn moreBehavioral health consulting
How 42 CFR Part 2 adds to HIPAA for substance use programs.
Learn moreQuick answers
HIPAA compliance services: audits, consultants and certification
OCR audits and how to prepare, audit logs, outside consultants and certification. Bring the rest to a consultation.
How often does OCR audit practices?
How do we prepare for a HIPAA compliance audit?
What does HIPAA require for audit logs?
Do we need a HIPAA security consultant, or can we do the evaluation ourselves?
Is any HIPAA compliance solution officially certified?
Talk to an advisor
You care for patients. Who’s taking care of the business?
Tell us where your practice is today. We will tell you what we would do first.
Official sources
All read Oct 15 to 19, 2026.
- eCFR, current as of Oct 15, 2026: 45 CFR 102.3, part 160, subpart D, 164.308, 164.312, 164.314, 164.316, part 164, subparts D and E; 42 U.S.C. 17941 and 1320d-6
- HHS-OCR: releases of June 18, July 29, Aug 27 and Sept 17, 2026; corrective action plan; resolution agreements; Enforcement Highlights; audit program; breach portal; certification FAQ
- HHS, Security Rule (Security Risk Assessment Tool) and 42 CFR Part 2
- reginfo.gov: RIN 0945-AA22 (2026 agenda) and OIRA’s rules under review (RIN 0945-AA00, received Apr 2, 2026); OMB memo M-26-11 (Apr 17, 2026)
- Florida Statutes (2026) s. 501.171 and s. 456.057; Rule 64B8-10.003