HIPAA Didn’t Change. Your Tools Did.

The Health Insurance Portability and Accountability Act (HIPAA) passed in 1996.

The Security Rule that governs how your practice protects electronic patient data was finalized in 2003 and last overhauled in 2013.

Your practice-management software added an AI assistant in the last 18 months. Your team moved to a cloud drive during a remote-work stretch and never moved back. Half your staff read work email on personal phones.

The rules didn’t move. The ground under them did.

That’s the quiet problem for most owner-doctors: the safeguards you set up years ago were built for the tools you had years ago. Here are three places the gap tends to open.

The rule is the same. The surface area isn’t.

HIPAA doesn’t list approved products. It asks you to know where protected health information (PHI) lives, to control who can reach it, and to be able to show your work.

That was manageable when PHI lived in one system on one server in one closet.

Today it lives in the practice-management system, the imaging platform, a cloud backup, the email server, a texting service, a payment processor, two or three AI tools, and whatever your staff installed to make their day easier.

Each new tool is a new place the same old rule applies. Nobody updated the list.

1. AI features that arrived turned on

Software vendors are adding AI to everything: note summaries, scheduling suggestions, patient-message drafts, claim scrubbing.

Often it shows up in a routine update, enabled by default, with a data flow that now includes the vendor’s AI partner. Your Business Associate Agreement (BAA) was signed before that partner existed.

Ask your vendors directly: what AI features are on in our account, what data do they touch, and does our current agreement cover it? Most will answer. Some will need to update the paperwork. Either way, you’ll know.

2. Personal devices that became work devices

The phone your office manager uses to check the practice inbox at night. The laptop your associate charts on from home. The tablet the hygienist uses to show patients their X-rays.

Some of those are practice-owned and managed. Some are personal and were never configured for anything.

If a personal phone with practice email on it is lost, is it encrypted? Can you wipe it remotely? Does anyone know it exists?

The rule expects you to protect PHI on every device that holds it. The device list has grown a lot faster than most practices’ ability to track it.

3. Cloud tools nobody vetted

A shared drive for scanned forms. A form builder for intake. A file-transfer link for sending records to a specialist. A scheduling app that texts patients.

Each one solved a real problem. Each one may also hold PHI, and each one needs a BAA, access controls, and a place on your inventory.

The common failure isn’t choosing a bad tool. It’s choosing a good tool and never doing the paperwork that makes it a known, protected part of the practice.

“Readiness” is a posture, not a certificate

There is no HIPAA certification for a dental or medical practice. No one can hand you a plaque that makes the question go away.

What exists is readiness: a current risk assessment, an inventory of where PHI lives, controls that match that inventory, agreements with the vendors who touch it, and documentation that shows it’s all being maintained.

That’s a posture you hold, not a box you check. And it has to be re-examined every time the tools change, which in 2026 means more often than most practices are doing it.

Start with the inventory, not the rulebook

You don’t need to re-read the regulations. You need to re-read your own practice.

What software is in use? What features got added? Which devices hold patient information? Which vendors have a signed agreement and which are running on a handshake?

That list, honestly built, tells you where the safeguards need to catch up. It’s also the first thing an auditor, an insurer, or an incident investigator will want to see.

We help practices rebuild that inventory and bring their safeguards in line with the tools they actually use today, without pretending any of it is a certification. It starts with a 10-minute discovery call.

Call us at 405-253-5101 or schedule a discovery call to get on the calendar.