Healthcare, Dental, and Veterinary Groups

What arrives

The risk analysis
HIPAA Security Rule, 45 CFR 164.308(a)(1)(ii)(A). An accurate and thorough assessment of the risks and vulnerabilities to electronic protected health information.
Source
The BAA
HIPAA business associate contract, 45 CFR 164.504(e), including the business associate's duty to report breaches of unsecured protected health information to the covered entity.
Source
Breach notice
HIPAA Breach Notification Rule, 45 CFR 164.404. Notice to each affected individual without unreasonable delay, and no later than 60 calendar days after discovery.
Source
The six-year file
45 CFR 164.316(b)(2). Security Rule policies, procedures and required records retained six years from creation or from the date last in effect.
Source
The OCR risk analysis audit
HHS Office for Civil Rights Risk Analysis Initiative. Enforcement aimed at the HIPAA risk analysis; the March 21, 2025 settlement was its fifth action.
Source
A dentist and an assistant in scrubs treating a patient in the chair, an X-ray on the screen behind them.

What the Institute has found here

The Vigil Library
A plain envelope, franked and postmarked, on a pale ground.

Institute

Email Spoofability Across Veterinary Practices

Field finding · June 2026

Read it
A printed form covered in empty circles to be marked.

Institute

The Compliance Mirage: Why Regulatory Checkboxes Fail to Predict Breach Outcomes

Policy · June 2026

Read it
A container port at night from above, stacked containers under working lights.

Institute

The Vendor as the Vector: Third-Party Risk Management Across Veterinary and Insurance Networks

Field notes · June 2026

Read it

Request an Introduction