HIPAA, the Health Insurance Portability and Accountability Act, sets the national rules for protecting patient health information. For any business that handles that information, complying with HIPAA means putting real protections in place, documenting them, and being able to show that you take the privacy and security of patient data seriously. It is partly a legal obligation, with genuine penalties for falling short, and partly a matter of trust, because patients expect their most sensitive information to be handled carefully. In practice, HIPAA compliance is one part of a broader approach to compliance and risk management, less about a single certificate and more about an ongoing program of safeguards and documentation that protects the information your business is responsible for.
Many practices find HIPAA intimidating because the rules are written in dense legal language and the consequences of getting it wrong feel high. The work of a good compliance partner is to translate that into clear, practical steps and to make sure nothing important is missed, so that meeting the requirement strengthens your practice rather than hanging over it.
Who HIPAA Applies To
A common misunderstanding is that HIPAA only applies to doctors and hospitals. It is broader than that. The law covers what it calls covered entities, which are healthcare providers, health plans, and healthcare clearinghouses. But it also reaches the businesses that handle protected health information on their behalf, known as business associates, a category that includes IT providers, billing companies, cloud services, and many other vendors. If your business creates, receives, stores, or transmits protected health information, you have obligations under HIPAA, whether you are the practice itself or a company that serves one. This matters when you choose vendors, because their compliance becomes part of yours.
It Starts With a Risk Analysis
If there is one place HIPAA compliance begins, it is a security risk analysis. This is a thorough review of where protected health information exists in your business, how it moves, and what could compromise it, whether that is a cyberattack, a lost device, or a simple mistake. It is worth dwelling on, because it is both the foundation of everything else and the single requirement that regulators most often find missing or done poorly. A risk analysis is not a form you fill out once and file away; it is the assessment that tells you what your actual risks are, so you can address the real ones rather than guessing. Every safeguard you put in place and every policy you write should trace back to something this analysis identified. We start here because a compliance program built on anything else is built on sand.
The Safeguards HIPAA Expects
HIPAA organizes its security requirements into three kinds of safeguards, and a sound program addresses all of them. Administrative safeguards are the policies, training, and processes that govern how your people handle protected information, including who is responsible and how staff are trained to avoid mistakes. Physical safeguards protect the places and devices where information lives, from locked areas to controls on the laptops and servers that hold patient data. Technical safeguards are the security controls on your systems, such as limits on who can reach patient information, protections for data as it is stored and sent, and records of who accessed what. None of these stands alone; a strong password policy means little if a laptop full of records is left unlocked, and the best encryption does not help if staff have not been trained. Bringing the three together, in a way that fits how your practice actually works, is the substance of compliance.
The Proposed 2026 Changes, and What They Mean Now
It is worth being clear and honest about where the rules stand, because there has been a great deal of noise about changes. A significant update to the HIPAA Security Rule was proposed in early 2025, which would tighten a number of requirements and remove some of the flexibility practices have relied on, in areas such as encryption, multi-factor authentication, and regular testing. As of the middle of 2026, that update remains a proposed rule. It has not been finalized, the expected timeline has slipped, and it could still be changed, delayed, or withdrawn. What that means in practice is straightforward: the current Security Rule is still what you are held to today, and you should not treat the proposed requirements as if they were already law. At the same time, most of what the proposal points to is simply sound security, so a practice that strengthens its protections now will be in a far better position whichever way the rule lands. We help you meet today’s requirements while preparing sensibly for what may come, without overstating what is actually required.
Compliance Is Ongoing, Not One-Time
One of the most important things to understand is that HIPAA compliance is not a one-time project. It is easy to treat it as something you achieve once, with a burst of effort, and then forget. In reality, your systems change, staff come and go, new threats appear, and your risk analysis and safeguards need to keep pace. Documentation has to stay current, training has to be repeated, and the protections that were adequate a year ago may not be today. Treating compliance as an ongoing program, rather than a one-off, is both what the rules expect and what genuinely protects patient information and your practice.
HIPAA Compliance Support for Los Angeles Practices
As a managed IT and cybersecurity provider based in the Los Angeles area, with CCSP certified expertise, GlobeVM helps healthcare practices and their business associates across Woodland Hills, Encino, Sherman Oaks, the San Fernando Valley, Santa Clarita, the Conejo Valley, and Ventura County meet their HIPAA obligations. We carry out the risk analysis, put practical safeguards in place, keep the documentation auditors expect, and sign the business associate agreements that working with patient data requires. No provider can promise that an incident will never happen, but we can make sure your practice has taken protection seriously, can show it, and is genuinely prepared rather than merely hoping.