Description

2025 was a record year for HIPAA enforcement and fines, and 2026 is shaping up to be no different. New rules, new funding, and audits with strong bipartisan backing in Washington mean the question is no longer whether business associates and covered entities will face scrutiny, but whether they will survive it. And a second front has opened: plaintiffs' attorneys are now using HIPAA as the standard of care in state negligence lawsuits, turning every wrongful disclosure caused by bad IT or sloppy administrative practices into potential litigation. Organizations relying on outdated policies and HIPAA folklore are exactly the low-hanging fruit regulators and plaintiffs go after first.

This in-depth 90-minute session cuts through the myths and misinformation surrounding HIPAA's real do's and don'ts. It covers the 2026 updates, including Information Access, Information Blocking, encryption expectations, Notice of Privacy Practices, Dobbs/Jackson considerations, and care coordination, alongside the practical realities of texting and emailing PHI, BYOD and portable devices, the increased burden on business associates, the federal audit process, risk assessment resources, ransomware prevention, and exactly what to do when a breach occurs. Real litigated cases are used throughout, including matters where HIPAA compliance failures were used to justify state negligence claims.

The presenter, Brian L. Tuttle, brings more than 22 years of experience working with federal, state, and corporate auditors, has performed risk assessments for over 1,000 medical practices, hospitals, health plans, and business associates, has served as an expert witness in litigated HIPAA cases, and has worked directly with the Office of Civil Rights on both defense and government-side audits. If your organization touches PHI in any capacity, this is the 90 minutes that determines whether your next audit is a formality or a finding.

After this webinar attendees will be able to answer-

• Is your HIPAA compliance program actually effective, or would it collapse under the federal audit process that now has strong bipartisan backing in Washington?
• What changed for 2026 across Information Access, Information Blocking, Encryption, Notice of Privacy Practices, Dobbs/Jackson implications, and Care Coordination?
• Why has the compliance burden on business associates increased, and what does that mean for billing companies, IT vendors, transcription services, and other partners of medical practices?
• What are the real rules, not the myths, on texting PHI, emailing PHI, BYOD, portable devices, and medical messaging?
• How is HIPAA now being used in state negligence lawsuits, and which risk factors make your organization most likely to be sued and audited?
• How do you conduct a defensible risk assessment, and which free resources should you be using?
• What must you do, step by step, when ransomware hits or a breach occurs?

This webinar benefits the following agencies-

• Medical Billing and Coding Companies
• Health IT, EHR, and Managed Services Vendors
• Transcription Companies and Answering Services
• Physician Practices, Hospitals, and Health Systems
• Home Health and Hospice Agencies
• Law Firms and Consulting Firms Handling PHI
• Health Plans and Third-Party Administrators

Who should attend?

• Practice Administrators and Business Associate Operations Administrators
• Chief Compliance Officers, HIPAA Compliance Officers, and Privacy/Security Officers
• Internal Auditors and IT Security Audit Professionals
• C-Suite Executives (CEOs, CFOs, CIOs, CISOs, General Counsel of covered entities and business associates)
• Practice Managers and Office Managers
• Physicians and Other Medical Professionals with Compliance Oversight