Question 1

What does a HIPAA risk assessment actually cover, and do Ohio practices need one?

Accepted Answer

A full risk assessment evaluates administrative, physical, and technical safeguards across your practice — including EHR access logs, email encryption, device management, and vendor contracts. Under the HIPAA Security Rule, all covered entities must conduct one. NHM Ohio walks you through the Department of Health and Human Services risk assessment toolkit and produces documented findings Ohio auditors and OCR investigators would recognize.

Question 2

How do we handle HIPAA compliance when our staff uses personal devices for telemedicine?

Accepted Answer

Personal devices used to access ePHI fall under HIPAA's technical safeguard requirements regardless of ownership. We implement mobile device management (MDM) with containerization, ensuring patient data stays in a protected enclave even if the device is lost or the employee leaves. For Ohio practices using Doxy or Zoom for Health, we also audit the BAA coverage between your practice and the vendor.

Question 3

Our EHR vendor manages most of our IT — what are we still responsible for under HIPAA?

Accepted Answer

The vendor's BAA covers their systems, but your practice retains full liability for how your staff uses those systems, how your network connects to theirs, and your own contingency planning. Ohio practices often don't realize this gap until a breach audit. We provide joint accountability checklists and can act as your technical compliance liaison with Epic, athenahealth, or eCW.

Question 4

What are the HIPAA breach notification requirements, and how quickly must we respond in Ohio?

Accepted Answer

Breaches affecting under 500 individuals must be reported to the Secretary of HHS within 60 days of discovering the incident — and to affected patients without unreasonable delay. Breaches over 500 require immediate notification to HHS, prominent media notice in the state, and direct patient letters. We help Ohio practices build an incident response playbook that meets these timelines and includes forensic preserve for evidence.

Question 5

How often do healthcare staff need HIPAA training, and does it have to be documented?

Accepted Answer

HIPAA requires annual refresher training for all workforce members who handle PHI — and documentation of that training must be available during an audit. New hires should complete training before accessing any patient records. We provide live and recorded training sessions that produce documented completion records your compliance officer can export directly from our portal.

IT Solutions for Healthcare

Challenges We Solve

Ready to solve these challenges?

Healthcare IT Services

How we work with you for Healthcare

Discovery & context

Baseline & priorities

Plan, timeline, and ownership

Operate, monitor, and improve

Compliance & Standards

FAQ

Helpful Resources for Healthcare

Ready to Protect Your Patients?

Tell us what you need and we'll recommend the right next step.