Practical guidance on AI governance and HIPAA compliance, written for the people who run the program.
Subscribe by RSS to hear when a new post is published
February 18, 2026
45 CFR 164.308(a)(7)(ii)(B) covers disaster recovery plan. This post walks through a disaster recovery plan sized to your practice, with the language of the requirement itself and the evidence an assessor asks to see. It is a required implementation specification, so there is no documented-alternative route.
Read more →February 17, 2026
45 CFR 164.308(a)(7)(ii)(A) covers data backup plan. This post walks through backups you have actually restored from, with the language of the requirement itself and the evidence an assessor asks to see. It is a required implementation specification, so there is no documented-alternative route.
Read more →February 13, 2026
45 CFR 164.308(a)(6)(ii) covers response and reporting. This post walks through response and reporting, and where breach analysis begins, with the language of the requirement itself and the evidence an assessor asks to see. It is a required implementation specification, so there is no documented-alternative route.
Read more →February 12, 2026
45 CFR 164.308(a)(6)(i) covers security incident procedures. This post walks through incident procedures before you need them, with the language of the requirement itself and the evidence an assessor asks to see. It is a standard, so it must be met in full and there is no documented-alternative route.
Read more →February 11, 2026
45 CFR 164.308(a)(5)(ii)(D) covers password management. This post walks through password management under current NIST guidance, with the language of the requirement itself and the evidence an assessor asks to see. It is an addressable implementation specification, which means documenting your reasoning is part of the requirement.
Read more →February 10, 2026
45 CFR 164.308(a)(5)(ii)(C) covers log-in monitoring. This post walks through log-in monitoring and reporting discrepancies, with the language of the requirement itself and the evidence an assessor asks to see. It is an addressable implementation specification, which means documenting your reasoning is part of the requirement.
Read more →February 9, 2026
45 CFR 164.308(a)(5)(ii)(B) covers protection from malicious software. This post walks through malware protection on clinical endpoints, with the language of the requirement itself and the evidence an assessor asks to see. It is an addressable implementation specification, which means documenting your reasoning is part of the requirement.
Read more →February 6, 2026
45 CFR 164.308(a)(5)(ii)(A) covers security reminders. This post walks through security reminders that change behavior, with the language of the requirement itself and the evidence an assessor asks to see. It is an addressable implementation specification, which means documenting your reasoning is part of the requirement.
Read more →February 5, 2026
45 CFR 164.308(a)(5)(i) covers security awareness and training. This post walks through training that produces evidence an assessor accepts, with the language of the requirement itself and the evidence an assessor asks to see. It is a standard, so it must be met in full; the addressable implementation specifications beneath it are each assessed and documented on their own.
Read more →February 4, 2026
45 CFR 164.308(a)(4)(ii)(C) covers access establishment and modification. This post walks through granting and changing access with a paper trail, with the language of the requirement itself and the evidence an assessor asks to see. It is an addressable implementation specification, which means documenting your reasoning is part of the requirement.
Read more →