Most healthcare organisations know what HIPAA requires. The difficulty is that compliance is decided by daily practice, and daily practice drifts.

Where organisations actually come unstuck

The problems we see are rarely dramatic. They are ordinary shortcuts that accumulate.

• Access that was never removed. Staff change roles or leave and their access remains. Reviewing it once a year is not enough in a practice with regular turnover.
• Patient data outside approved systems. A spreadsheet exported for a report, a scan sent to a personal address, a file saved to a local drive so it could be worked on at home. Each is small; together they are the exposure.
• Vendors without agreements. Any third party handling protected health information needs a business associate agreement. Software gets adopted by individual departments and the agreement never happens.
• Personal devices. Staff read email on their own phones. Without management, a lost handset becomes a reportable event.
• A risk analysis that is out of date. The requirement is ongoing, not one-time. An assessment describing an environment you no longer run offers no protection.

Documentation is not the same as compliance

A policy that says access is reviewed quarterly is worth nothing if the reviews are not happening and cannot be evidenced. Auditors ask for proof, and so do patients' lawyers. The practical test for any control is simple: could you show, today, that it has been operating?

Make the compliant path the easy one

Compliance that depends on people remembering to do the harder thing will fail eventually. It works better when the secure route is also the convenient one, so that staff are not choosing between doing their job and following the rules.

Give people a straightforward way to share files securely, manage the devices that touch patient data, and remove access as part of the standard leaver process rather than as a separate task somebody has to remember.