{"id":2580,"date":"2026-11-13T06:25:27","date_gmt":"2026-11-13T12:25:27","guid":{"rendered":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/?p=2580"},"modified":"2026-11-12T06:32:36","modified_gmt":"2026-11-12T12:32:36","slug":"hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/","title":{"rendered":"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices"},"content":{"rendered":"<p><span style=\"font-weight: 400\">For more than twenty years, the HIPAA Security Rule has guided how healthcare practices protect electronic patient information. During that time, the threats have changed completely. Practices that once worried about a lost filing cabinet now face ransomware crews, stolen logins, cloud misconfigurations, and phishing messages written by artificial intelligence. The rule itself, however, has barely changed since 2013.<\/span><\/p>\n<p><span style=\"font-weight: 400\">That gap is what federal regulators want to close. In late 2024, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights proposed the first major overhaul of the Security Rule in a generation. The proposal would turn many &#8220;recommended&#8221; safeguards into firm requirements and add specific technical expectations that small offices have never been formally held to.<\/span><\/p>\n<p><span style=\"font-weight: 400\">This guide explains the proposed changes in plain language, what they would mean for medical and dental offices, and what you can do now. Many of the steps are smart whether or not the final rule looks exactly like the proposal. A note on timing: regulatory details can shift, so confirm the current status of the rule with HHS and your legal counsel before you finalize any compliance plan.<\/span><\/p>\n<h2><b>Where the Security Rule Stands Today<\/b><\/h2>\n<p><span style=\"font-weight: 400\">The current Security Rule requires covered entities and business associates to protect electronic protected health information (ePHI) through administrative, physical, and technical safeguards. Its flexible, scalable design was intentional, because it needs to work for a solo dentist and a hospital system alike.<\/span><\/p>\n<p><span style=\"font-weight: 400\">That flexibility created a problem. The rule divides its specifications into two groups:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Required:<\/b><span style=\"font-weight: 400\"> Controls every organization must implement.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Addressable:<\/b><span style=\"font-weight: 400\"> Controls an organization must implement or document why an alternative is reasonable.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">In practice, many small offices treated &#8220;addressable&#8221; as &#8220;optional.&#8221; Encryption, for example, was often skipped without a documented analysis. Regulators have repeatedly found that practices lacked a thorough risk analysis, which remains one of the most common causes of enforcement actions.<\/span><\/p>\n<p><span style=\"font-weight: 400\">The proposed rule responds to this history. It aims to remove ambiguity, require written proof, and set a higher baseline for cybersecurity across the healthcare sector.<\/span><\/p>\n<h2><b>What Has Been Proposed<\/b><\/h2>\n<p><span style=\"font-weight: 400\">The HHS proposal, published for public comment in early 2025, would make several significant changes. Because the rule had not been finalized at the time of this writing, treat the list below as the direction of travel, not a final checklist.<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><b>No more &#8220;addressable&#8221; category.<\/b><span style=\"font-weight: 400\"> Nearly all specifications would become required, with only narrow exceptions.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Written documentation for everything.<\/b><span style=\"font-weight: 400\"> Policies, procedures, plans, and analyses would need to be in writing and kept current.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Technology asset inventory and network map.<\/b><span style=\"font-weight: 400\"> You would need to know every device and system that touches ePHI and how data flows between them, reviewed at least every twelve months.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>A more rigorous risk analysis.<\/b><span style=\"font-weight: 400\"> The analysis would need to be detailed, written, and reviewed at least annually or after major changes.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Mandatory multi-factor authentication.<\/b><span style=\"font-weight: 400\"> Access to systems that hold ePHI would require MFA, with limited exceptions.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Required encryption.<\/b><span style=\"font-weight: 400\"> ePHI would need to be encrypted both at rest and in transit, again with limited exceptions.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Network segmentation.<\/b><span style=\"font-weight: 400\"> Systems with ePHI would need to be separated from other parts of the network.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Vulnerability scanning and penetration testing.<\/b><span style=\"font-weight: 400\"> Scans at least every six months and penetration tests at least every twelve months.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Defined patching timelines.<\/b><span style=\"font-weight: 400\"> Critical vulnerabilities would need to be addressed within about fifteen days, and high-risk ones within about thirty.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Faster recovery.<\/b><span style=\"font-weight: 400\"> Organizations would need to restore critical systems and data within seventy-two hours of a loss.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Tested incident response.<\/b><span style=\"font-weight: 400\"> Written response plans would need regular testing.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Annual compliance audits.<\/b><span style=\"font-weight: 400\"> You would need to verify at least once a year that you meet each requirement.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Stronger business associate oversight.<\/b><span style=\"font-weight: 400\"> Vendors would need to verify their technical safeguards annually and notify you within twenty-four hours of activating their contingency plans.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Faster access changes.<\/b><span style=\"font-weight: 400\"> Covered entities would need to notify relevant parties within twenty-four hours when a workforce member&#8217;s access changes or ends.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">The proposal also contemplated a transition period after the final rule takes effect. Even so, preparing early is far easier than scrambling when a deadline arrives.<\/span><\/p>\n<h2><b>Why This Matters for Long Beach Practices<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Medical and dental offices are attractive targets because patient records contain everything a criminal needs for identity theft, insurance fraud, and extortion. At the same time, practices tend to operate with lean teams and limited IT budgets.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Long Beach offices face a familiar mix of pressures:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><b>Small teams wearing many hats.<\/b><span style=\"font-weight: 400\"> The office manager often doubles as the IT contact.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Shared workstations and front desk traffic.<\/b><span style=\"font-weight: 400\"> Screens, printers, and sign-in tablets create physical and technical exposure.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Referrals and outside providers.<\/b><span style=\"font-weight: 400\"> Records move constantly between primary care, specialists, labs, imaging centers, and insurers.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Telehealth and patient portals.<\/b><span style=\"font-weight: 400\"> Convenience features add new systems that must be secured.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Older equipment.<\/b><span style=\"font-weight: 400\"> Imaging machines, sensors, and legacy practice software often run outdated operating systems.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>California privacy rules.<\/b><span style=\"font-weight: 400\"> State laws, including the Confidentiality of Medical Information Act, can add obligations beyond HIPAA.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Understanding the<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/the-biggest-healthcare-it-security-challenges-facing-medical-practices-in-2026\/\"> <span style=\"font-weight: 400\">healthcare security challenges<\/span><\/a><span style=\"font-weight: 400\"> that medical practices face today puts the proposed requirements in context.<\/span><span style=\"font-weight: 400\"> Many of them simply formalize what good security already looks like. Practices that fall behind often have<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/how-medical-practices-in-long-beach-can-eliminate-hidden-tech-gaps-that-impact-patient-trust\/\"> <span style=\"font-weight: 400\">patient trust technology gaps<\/span><\/a><span style=\"font-weight: 400\"> that patients never see until something goes wrong.<\/span><\/p>\n<h2><b>Start With a Real Risk Analysis<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Everything in the Security Rule builds on the risk analysis. It is the single most cited failure in HIPAA enforcement, and the proposed rule would make it even more demanding.<\/span><\/p>\n<p><span style=\"font-weight: 400\">A strong risk analysis answers four questions:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Where does ePHI live, travel, and get stored?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">What threats and weaknesses could expose it?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">How likely is each risk, and how damaging would it be?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">What controls reduce each risk, and who owns them?<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">A checklist is not a risk analysis. A real one documents your systems, evaluates actual vulnerabilities, ranks risks, and produces a plan with deadlines. It also needs to be updated when something changes, such as a new EHR, a new location, or a new cloud service.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Working with specialists who provide<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/compliance\/\"> <span style=\"font-weight: 400\">HIPAA compliance support<\/span><\/a><span style=\"font-weight: 400\"> can turn this exercise from a dreaded annual chore into a clear roadmap.<\/span><span style=\"font-weight: 400\"> Many practices also find that reviewing<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/is-your-business-hipaa-compliant-5-common-gaps-most-healthcare-practices-miss\/\"> <span style=\"font-weight: 400\">common HIPAA compliance gaps<\/span><\/a><span style=\"font-weight: 400\"> is a useful way to spot weak points before an auditor does.<\/span><\/p>\n<h2><b>Build Your Asset Inventory and Network Map<\/b><\/h2>\n<p><span style=\"font-weight: 400\">The proposal would require a written inventory of every technology asset that creates, receives, maintains, or transmits ePHI, plus a map showing how that information flows. This sounds simple. In reality, many offices discover devices nobody remembered.<\/span><\/p>\n<p><span style=\"font-weight: 400\">A complete inventory for a medical or dental office usually includes:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Workstations, laptops, and tablets<\/b><span style=\"font-weight: 400\"> used at the front desk, in exam rooms, and in operatories<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Servers and cloud-hosted systems<\/b><span style=\"font-weight: 400\"> for the EHR or practice management software<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Imaging equipment<\/b><span style=\"font-weight: 400\">, including digital X-ray sensors, panoramic units, intraoral cameras, and scanners<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Network devices<\/b><span style=\"font-weight: 400\"> such as firewalls, switches, routers, and wireless access points<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Medical and diagnostic devices<\/b><span style=\"font-weight: 400\"> that connect to the network<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Mobile phones and personal devices<\/b><span style=\"font-weight: 400\"> used for work<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Printers, copiers, and fax services<\/b><span style=\"font-weight: 400\"> that store images of documents<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Telehealth platforms and patient portals<\/b><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Backup systems<\/b><span style=\"font-weight: 400\"> and any offsite storage<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Phone systems and voicemail<\/b><span style=\"font-weight: 400\">, which may contain patient details<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">For each asset, record the owner, location, software version, and the type of data it touches. Then draw how data moves: from patient intake to the EHR, from the EHR to the billing service, from the practice to the lab, and from the office to the cloud.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Once you can see the map, gaps become obvious. You may find an unsupported device on the same network as your records, or a vendor connection nobody has reviewed in years. Replacing old gear is easier when purchasing follows a plan, and<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/it-procurement\/\"> <span style=\"font-weight: 400\">IT procurement guidance<\/span><\/a><span style=\"font-weight: 400\"> helps you choose hardware that will stay supported. Retiring unsupported equipment also means dealing with<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/outdated-os-updated-risk-what-happens-when-you-stick-with-windows-10\/\"> <span style=\"font-weight: 400\">outdated operating system risks<\/span><\/a><span style=\"font-weight: 400\">, which are especially common in dental imaging environments.<\/span><\/p>\n<h2><b>Multi-Factor Authentication Everywhere It Counts<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Stolen credentials are behind a large share of healthcare breaches. That is why the proposal would make MFA a requirement instead of a suggestion.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Plan to protect these access points first:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">EHR and practice management logins<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Email accounts<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Remote access and VPN connections<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Cloud storage and patient portal administration<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Administrator accounts on servers, firewalls, and workstations<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Billing and clearinghouse platforms<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Many practices still depend on shared logins at the front desk or in treatment rooms. Shared accounts make it impossible to know who viewed which record, which creates problems for both security and audit trails. Give each person a unique account, and remove access the same day someone leaves.<\/span><\/p>\n<p><span style=\"font-weight: 400\">If you need a primer on why this control matters so much, learning how<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/multi-factor-authentication-the-5-fix-that-stops-99-of-account-takeovers\/\"> <span style=\"font-weight: 400\">MFA account takeover protection<\/span><\/a><span style=\"font-weight: 400\"> works shows why it stops so many attacks. Practices with staff working from home or traveling between locations should also consider<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/why-healthcare-providers-are-rethinking-access-controls-for-remote-staff\/\"> <span style=\"font-weight: 400\">remote staff access controls<\/span><\/a><span style=\"font-weight: 400\"> that verify both the person and the device.<\/span><\/p>\n<p><span style=\"font-weight: 400\">The proposed twenty-four-hour notification rule for access changes also means you need a reliable offboarding process. When someone leaves, HR, the office manager, and IT must work from the same checklist so accounts are disabled quickly and completely.<\/span><\/p>\n<h2><b>Encrypt Patient Data at Rest and in Transit<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Encryption turns readable records into scrambled data that is useless to anyone without the key. Under the current rule, encryption is addressable. Under the proposal, it would be required in most cases.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Focus on these areas:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Laptops, tablets, and desktops:<\/b><span style=\"font-weight: 400\"> Turn on full-disk encryption.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Servers and databases:<\/b><span style=\"font-weight: 400\"> Encrypt stored records, including those used by imaging and practice software.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Mobile devices:<\/b><span style=\"font-weight: 400\"> Require device encryption, screen locks, and remote wipe capability.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Email and file transfers:<\/b><span style=\"font-weight: 400\"> Use secure methods when sending records to patients, labs, and other providers.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Backups:<\/b><span style=\"font-weight: 400\"> Encrypt both local and offsite copies, and protect keys separately.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Wireless networks:<\/b><span style=\"font-weight: 400\"> Use modern encryption and keep guest access fully separate.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Portable media:<\/b><span style=\"font-weight: 400\"> Avoid USB drives, or encrypt any that are truly necessary.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Encryption is not a cure-all. A logged-in user on an unlocked workstation can still view everything. But it removes the worst-case scenario, because a stolen laptop or backup drive becomes a replaced device instead of a reportable breach. <\/span><span style=\"font-weight: 400\">To decide where stronger protection belongs, review<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/data-encryption-strategies-for-businesses-in-a-hybrid-cloud-environment\/\"> <span style=\"font-weight: 400\">encryption in hybrid environments<\/span><\/a><span style=\"font-weight: 400\"> that mix on-site equipment with cloud services.<\/span><\/p>\n<h2><b>Segment Your Network<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Network segmentation means dividing your network into zones, so a problem in one area cannot easily spread to another. The proposal would require this for systems that hold ePHI.<\/span><\/p>\n<p><span style=\"font-weight: 400\">A practical layout for a medical or dental office separates:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Systems that store or process patient records<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Front desk and administrative computers<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Imaging devices and clinical equipment<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Guest and patient Wi-Fi<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Security cameras, thermostats, and other smart devices<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Staff personal phones and tablets<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Phone and communications systems<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">The most common mistake is putting everything on one flat network. When the waiting room Wi-Fi shares a path with the server that holds records, one infected visitor device can become a very bad day.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Professional<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/network-management\/\"> <span style=\"font-weight: 400\">network segmentation support<\/span><\/a><span style=\"font-weight: 400\"> designs these zones, monitors the traffic between them, and keeps firewall rules from drifting over time.<\/span><span style=\"font-weight: 400\"> Pairing segmentation with a<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/how-zero-trust-security-is-helping-small-businesses-stop-modern-cyber-attacks\/\"> <span style=\"font-weight: 400\">zero trust security model<\/span><\/a><span style=\"font-weight: 400\"> means every user and device must prove itself before reaching sensitive records.<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-2583\" src=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-31-1024x535.png\" alt=\"\" width=\"1024\" height=\"535\" srcset=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-31-1024x535.png 1024w, https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-31-300x157.png 300w, https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-31-768x401.png 768w, https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-31.png 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<h2><b>Scanning, Testing, and Patching on a Schedule<\/b><\/h2>\n<p><span style=\"font-weight: 400\">The proposal would turn good habits into required routines:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><b>Vulnerability scans<\/b><span style=\"font-weight: 400\"> at least every six months<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Penetration tests<\/b><span style=\"font-weight: 400\"> at least every twelve months<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Patching<\/b><span style=\"font-weight: 400\"> of critical and high-risk flaws within defined timeframes<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Removal of unneeded software<\/b><span style=\"font-weight: 400\"> and closing of unused network ports<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Anti-malware protection<\/b><span style=\"font-weight: 400\"> on all systems that touch ePHI<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Secure configuration standards<\/b><span style=\"font-weight: 400\"> for servers, workstations, and network gear<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">For a small office, this schedule is hard to maintain without help. Patches arrive constantly, and many clinical applications are fragile. The solution is a documented process: identify what needs updating, test it, schedule it outside patient hours, and record the result.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Ongoing<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/cybersecurity\/\"> <span style=\"font-weight: 400\">cybersecurity protection services<\/span><\/a><span style=\"font-weight: 400\"> handle scanning, endpoint monitoring, and threat response around the clock, which is nearly impossible to replicate internally.<\/span><span style=\"font-weight: 400\"> Practices should also close<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/endpoint-security-in-a-remote-world-what-smbs-are-still-missing\/\"> <span style=\"font-weight: 400\">endpoint security gaps<\/span><\/a><span style=\"font-weight: 400\">, since laptops, tablets, and phones are common entry points for attackers.<\/span><\/p>\n<h2><b>Prepare for the Seventy-Two-Hour Recovery Standard<\/b><\/h2>\n<p><span style=\"font-weight: 400\">One of the most talked-about proposals is the requirement to restore critical systems and data within seventy-two hours. For a medical or dental office, that is a business survival issue. If your scheduling system, EHR, or imaging archive is down for a week, patients cannot be seen and revenue stops.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Meeting a seventy-two-hour target requires more than having backups. You need:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><b>Defined priorities:<\/b><span style=\"font-weight: 400\"> Know which systems come back first, such as the EHR, scheduling, phones, and imaging.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Reliable copies:<\/b><span style=\"font-weight: 400\"> Keep multiple backups, including one that attackers cannot alter or delete.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Tested restores:<\/b><span style=\"font-weight: 400\"> Practice bringing systems back and time how long it takes.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Documented procedures:<\/b><span style=\"font-weight: 400\"> Write down steps, contacts, and decision authority.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Downtime workarounds:<\/b><span style=\"font-weight: 400\"> Prepare paper forms and manual processes for patient care during an outage.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Communication plans:<\/b><span style=\"font-weight: 400\"> Decide how you will reach staff and patients if email or phones are down.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Dependable<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/data-backup\/\"> <span style=\"font-weight: 400\">backup and recovery solutions<\/span><\/a><span style=\"font-weight: 400\"> form the foundation of this capability.<\/span> <span style=\"font-weight: 400\">A practical<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/ransomware-recovery-building-a-72-hour-response-strategy\/\"> <span style=\"font-weight: 400\">72 hour recovery plan<\/span><\/a><span style=\"font-weight: 400\"> shows how to organize the first critical days after an attack.<\/span><span style=\"font-weight: 400\"> Broader<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/integrating-cybersecurity-and-business-continuity-planning-for-true-resilience\/\"> <span style=\"font-weight: 400\">business continuity planning<\/span><\/a><span style=\"font-weight: 400\"> ties security and operations together so patient care can continue while systems are restored.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Cloud-hosted practice systems can also shorten recovery dramatically. If you are considering a move,<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/cloud-services\/\"> <span style=\"font-weight: 400\">secure cloud migration<\/span><\/a><span style=\"font-weight: 400\"> planning helps you build in encryption, access controls, and logging from the beginning.<\/span><\/p>\n<h2><b>Strengthen Business Associate Oversight<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Medical and dental practices rely on many outside companies: EHR vendors, billing services, answering services, transcription providers, IT firms, cloud hosts, shredding companies, and more. Under HIPAA, any vendor that handles ePHI on your behalf is a business associate, and you remain responsible for choosing them carefully.<\/span><\/p>\n<p><span style=\"font-weight: 400\">The proposal would increase expectations in several ways:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Business associates would need to verify their technical safeguards at least annually and provide written confirmation.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">They would need to notify you within twenty-four hours of activating their contingency plans.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Covered entities would be expected to keep business associate agreements current and documented.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Build a simple vendor management routine now:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Keep an up-to-date list of every vendor that touches patient data.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Confirm a signed business associate agreement is on file for each.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Request security documentation and audit reports each year.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Ask how and when they will notify you of a breach or outage.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Remove access for vendors you no longer use.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Practices with many overlapping vendors often struggle with this, and understanding<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/why-it-vendor-sprawl-is-creating-security-and-budget-problems-for-smbs\/\"> <span style=\"font-weight: 400\">vendor sprawl risks<\/span><\/a><span style=\"font-weight: 400\"> shows how scattered contracts create hidden exposure.<\/span><span style=\"font-weight: 400\"> Staff-adopted tools add another layer, so learn about<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/shadow-it-uncovered-hidden-risks-of-unsanctioned-apps-in-your-business\/\"> <span style=\"font-weight: 400\">unapproved app risks<\/span><\/a><span style=\"font-weight: 400\"> before a well-meaning employee pastes patient notes into an unvetted app. <\/span><span style=\"font-weight: 400\">Keeping approved tools patched and visible is easier with<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/productivity-applications\/\"> <span style=\"font-weight: 400\">productivity application management<\/span><\/a><span style=\"font-weight: 400\"> that standardizes what your team uses every day.<\/span><\/p>\n<h2><b>Watch Out for AI Tools and Patient Data<\/b><\/h2>\n<p><span style=\"font-weight: 400\">AI scribes, chatbots, and summarization tools are arriving fast in healthcare. They promise real time savings, but they also create new pathways for ePHI to leave your environment. Before any AI tool touches patient data, confirm that the vendor will sign a business associate agreement, does not train its models on your data, and meets your security standards.<\/span><\/p>\n<p><span style=\"font-weight: 400\">The topic deserves its own policy. Review the<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/ai-in-healthcare-the-benefits-the-roadblocks-and-what-comes-next\/\"> <span style=\"font-weight: 400\">AI in healthcare<\/span><\/a><span style=\"font-weight: 400\"> benefits and roadblocks so you can adopt useful tools without creating compliance problems. The same rules about risk analysis, documentation, and vendor oversight apply to every new technology you introduce.<\/span><\/p>\n<h2><b>Train Every Person on Your Team<\/b><\/h2>\n<p><span style=\"font-weight: 400\">The proposed rule would reinforce the long-standing requirement to train all workforce members, and training often decides whether an attack succeeds. A receptionist who spots a fake insurance email can prevent a breach that no firewall would have stopped.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Effective training for medical and dental teams includes:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Short, regular lessons instead of one long annual session<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Simulated phishing messages that look like real insurance, lab, and patient emails<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Clear rules for sharing records by email, text, or fax<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Guidance on handling patient information at the front desk and in open areas<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">A no-blame process for reporting mistakes and suspicious messages<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Role-specific content for clinicians, billing staff, and managers<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Modern<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/security-awareness-2-0-how-to-make-cyber-training-stick-for-your-entire-team\/\"> <span style=\"font-weight: 400\">staff cyber training programs<\/span><\/a><span style=\"font-weight: 400\"> keep lessons practical and memorable, which helps behavior change last. Document attendance and content, because the proposal emphasizes written proof.<\/span><\/p>\n<h2><b>Get Ready for Annual Compliance Audits<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Under the proposal, you would need to verify at least once a year that you meet every requirement. Even if the final rule changes the details, regulators and insurers already expect organized evidence.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Keep a compliance folder that includes:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Your latest risk analysis and remediation plan<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">The asset inventory and network map<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Policies and procedures with review dates<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Training records and phishing test results<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Backup and restore test logs<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Vulnerability scan and penetration test reports<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Business associate agreements and vendor reviews<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Incident response plans and tabletop exercise notes<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Access reviews and offboarding records<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Practices that treat documentation as an everyday habit find audits far less stressful. Understanding why<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/compliance-audits-are-getting-stricter-are-you-prepared\/\"> <span style=\"font-weight: 400\">stricter compliance audits<\/span><\/a><span style=\"font-weight: 400\"> are becoming the norm helps you set a steady rhythm instead of a yearly panic.<\/span><\/p>\n<h2><b>What a Breach Really Costs a Small Practice<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Penalties for HIPAA violations can be significant, but regulatory fines are only part of the picture. A breach can lead to patient notification costs, credit monitoring, forensic investigations, legal fees, lost appointments, insurance consequences, and a damaged reputation in a community where word travels quickly.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Reviewing the<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/how-much-does-a-data-breach-really-cost-a-small-business-the-numbers-might-surprise-you\/\"> <span style=\"font-weight: 400\">cost of data breach<\/span><\/a><span style=\"font-weight: 400\"> for small organizations often changes how owners think about prevention budgets.<\/span><span style=\"font-weight: 400\"> Cyber insurance can help, but it is not automatic. Policies now ask detailed questions about MFA, backups, and training, and inaccurate answers can jeopardize a claim. Learn about<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/cyber-insurance-in-2025-is-your-coverage-keeping-up-with-evolving-risks\/\"> <span style=\"font-weight: 400\">cyber insurance requirements<\/span><\/a><span style=\"font-weight: 400\"> before your next renewal so your coverage matches your actual practices.<\/span><\/p>\n<h2><b>Medical Office Priorities<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Medical practices should pay special attention to:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>EHR security:<\/b><span style=\"font-weight: 400\"> Review user permissions, audit logs, and vendor security commitments.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Patient portals:<\/b><span style=\"font-weight: 400\"> Confirm strong login protection and monitor for suspicious activity.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Telehealth platforms:<\/b><span style=\"font-weight: 400\"> Use approved, secure tools with signed business associate agreements.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Lab and imaging connections:<\/b><span style=\"font-weight: 400\"> Secure interfaces and review who can access them.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Exam room devices:<\/b><span style=\"font-weight: 400\"> Lock screens automatically and prevent shared logins.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Phone and fax systems:<\/b><span style=\"font-weight: 400\"> Protect voicemail, call recordings, and digital fax services that contain patient information.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Referral workflows:<\/b><span style=\"font-weight: 400\"> Use secure channels instead of regular email when sharing records.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Secure voice and messaging matter in clinical settings, and modern<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/unified-communications\/\"> <span style=\"font-weight: 400\">secure unified communications<\/span><\/a><span style=\"font-weight: 400\"> can protect calls, texts, and virtual visits under consistent access controls.<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-2582\" src=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2026\/11\/boston-nov-blog-22-1024x536.png\" alt=\"\" width=\"913\" height=\"478\" srcset=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2026\/11\/boston-nov-blog-22-1024x536.png 1024w, https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2026\/11\/boston-nov-blog-22-300x157.png 300w, https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2026\/11\/boston-nov-blog-22-768x402.png 768w, https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2026\/11\/boston-nov-blog-22.png 1200w\" sizes=\"(max-width: 913px) 100vw, 913px\" \/><\/p>\n<h2><b>Dental Office Priorities<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Dental practices have their own risks:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Imaging systems:<\/b><span style=\"font-weight: 400\"> Digital sensors, panoramic units, and cone beam scanners often run older software and connect directly to the network.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Practice management software:<\/b><span style=\"font-weight: 400\"> Many platforms are installed locally and need careful patching and backup.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Multiple operatories:<\/b><span style=\"font-weight: 400\"> Each room adds workstations that need access control and automatic logoff.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Insurance and billing portals:<\/b><span style=\"font-weight: 400\"> Credentials for these sites are frequent phishing targets.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Multi-location groups:<\/b><span style=\"font-weight: 400\"> Different offices may use different equipment and inconsistent settings.<\/span><\/li>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Intraoral cameras and scanners:<\/b><span style=\"font-weight: 400\"> These devices create files that must be stored and transferred securely.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Because dental offices run on tight schedules, downtime hurts immediately. A seventy-two-hour recovery goal can feel generous until you realize how many patients are rescheduled each day the schedule is unavailable.<\/span><\/p>\n<h2><b>A 90-Day Preparation Plan<\/b><\/h2>\n<p><span style=\"font-weight: 400\">You do not need to do everything at once. Use this timeline to build momentum.<\/span><\/p>\n<p><b>Days 1 to 30: Discover and document<\/b><\/p>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Complete or refresh your risk analysis.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Build an inventory of devices, software, and vendors that touch patient data.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Draw a basic map of how ePHI moves through your office.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Turn on MFA for email, remote access, and administrator accounts.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Confirm that business associate agreements are signed and current.<\/span><\/li>\n<\/ul>\n<p><b>Days 31 to 60: Close the biggest gaps<\/b><\/p>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Enable encryption on laptops, mobile devices, and backups.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Separate guest Wi-Fi and clinical devices from administrative systems.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Eliminate shared accounts and set up a same-day offboarding process.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Schedule vulnerability scans and review patching practices.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Run a test restore of your most important system and record the time.<\/span><\/li>\n<\/ul>\n<p><b>Days 61 to 90: Prove and sustain<\/b><\/p>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Hold staff training and document attendance.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Write or update your incident response plan, and run a tabletop exercise.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Review vendor security documentation and tighten access.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Create a compliance calendar for recurring tasks.<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Assemble your audit evidence folder.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Long-term planning matters as much as quick fixes. <\/span><span style=\"font-weight: 400\">Ongoing<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/it-guidance\/\"> <span style=\"font-weight: 400\">strategic IT guidance<\/span><\/a><span style=\"font-weight: 400\"> helps you connect compliance work to equipment refreshes, new locations, and budget cycles.<\/span><\/p>\n<h2><b>Common Mistakes to Avoid<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Many practices repeat the same errors:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b><\/b><b>Treating &#8220;addressable&#8221; as &#8220;optional.&#8221;<\/b><span style=\"font-weight: 400\"> The proposal would end that interpretation.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Using a template risk analysis.<\/b><span style=\"font-weight: 400\"> A generic checklist rarely reflects your real environment.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Skipping documentation.<\/b><span style=\"font-weight: 400\"> If it is not written down, an auditor may treat it as not done.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Ignoring old equipment.<\/b><span style=\"font-weight: 400\"> Unsupported imaging and clinical devices are common weak points.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Relying on backups that were never tested.<\/b><span style=\"font-weight: 400\"> An untested backup is only a hope.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Sharing logins.<\/b><span style=\"font-weight: 400\"> It breaks accountability and weakens every other control.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Forgetting vendors.<\/b><span style=\"font-weight: 400\"> Your responsibility continues when data leaves your office.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Waiting for the final rule.<\/b><span style=\"font-weight: 400\"> Most proposed controls are already best practice.<\/span><\/li>\n<\/ul>\n<h2><b>Why a Local Partner Makes Preparation Easier<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Clinicians and office managers did not enter healthcare to become compliance experts. Patient care fills every hour, yet the proposed rule would demand more documentation, more testing, and more proof. A trusted technology partner can carry much of that load.<\/span><\/p>\n<p><span style=\"font-weight: 400\">CMIT Solutions of Long Beach works with local organizations to assess where they stand, prioritize the most important fixes, and keep evidence organized for audits and insurers. <\/span><span style=\"font-weight: 400\">A dependable<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/managed-it-services\/\"> <span style=\"font-weight: 400\">managed IT services<\/span><\/a><span style=\"font-weight: 400\"> approach brings patching, monitoring, backup oversight, and reporting together under one team that learns your environment.<\/span><span style=\"font-weight: 400\"> When a workstation locks up in the middle of a patient visit, responsive<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/it-support\/\"> <span style=\"font-weight: 400\">help desk support<\/span><\/a><span style=\"font-weight: 400\"> gets your team moving again quickly. If you want a<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/\"> <span style=\"font-weight: 400\">Long Beach IT partner<\/span><\/a><span style=\"font-weight: 400\"> that understands the pace of medical and dental practices, an early conversation saves both time and money.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Strong healthcare technology protects people as well as systems, and learning how<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/healthcare-it-that-protects-patients-and-physicians-not-just-systems\/\"> <span style=\"font-weight: 400\">healthcare IT protection<\/span><\/a><span style=\"font-weight: 400\"> supports both patients and physicians helps you see the bigger picture. Practices that fall behind should also consider why providers must<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/why-healthcare-providers-must-upgrade-their-technology-to-protect-patient-data\/\"> <span style=\"font-weight: 400\">upgrade technology for patient data<\/span><\/a><span style=\"font-weight: 400\"> before an incident forces the issue.<\/span><\/p>\n<p><span style=\"font-weight: 400\">When evaluating any provider, look for:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Experience with HIPAA and healthcare environments<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Around-the-clock monitoring and fast response<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Clear reporting that practice leaders can understand<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Help preparing documentation and audit evidence<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">A proactive approach instead of waiting for things to break<\/span><\/li>\n<\/ul>\n<h2><b>Conclusion: Prepare Now, Not After the Deadline<\/b><\/h2>\n<p><span style=\"font-weight: 400\">The proposed HIPAA Security Rule changes signal a clear direction. Regulators expect healthcare practices to protect patient data with specific, documented, and tested safeguards, not vague good intentions. For Long Beach medical and dental offices, the most useful response is steady progress: understand your risks, know your systems, protect logins, encrypt data, segment your network, test your backups, train your team, and hold your vendors accountable.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Practices that start early will spread the work and cost over time, while those that wait may face a rush when requirements become official. CMIT Solutions of Long Beach can review your current environment, identify the gaps that matter most, and help you build a practical readiness plan. <\/span><span style=\"font-weight: 400\">Take the first step today and<\/span><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/contact-us\/\"> <span style=\"font-weight: 400\">Schedule a consultation<\/span><\/a><span style=\"font-weight: 400\"> to start preparing your practice.<\/span><\/p>\n<div style=\"width: 100%;background: #f4f8fa;padding: 60px 20px;font-family: Segoe UI,Arial,sans-serif\">\n<h2 style=\"text-align: center;color: #000;font-size: 40px;line-height: 1.2;font-weight: 800;margin: 0 0 45px\">Frequently Asked Questions<\/h2>\n<div style=\"width: 100%;max-width: 1100px;margin: 0 auto\">\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">1. What are the proposed HIPAA Security Rule changes?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">HHS proposed updates that would make most safeguards mandatory, require written documentation, and add specific controls such as MFA, encryption, network segmentation, regular testing, and faster recovery. The goal is to raise the cybersecurity baseline across healthcare.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">2. Are the new HIPAA Security Rule requirements final?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">The changes began as a proposal released for public comment. Because the status can change, confirm the current stage with HHS and your legal counsel before relying on any specific deadline.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">3. Do the changes apply to small medical and dental offices?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Yes. The Security Rule covers all covered entities and business associates, regardless of size. The final rule may allow some flexibility, but small practices should expect to meet the core requirements.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">4. What does removing the addressable category mean?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">It means controls that were once flexible would become required in nearly all cases. Practices could no longer skip a safeguard simply by documenting that it seemed unnecessary.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">5. Will multi-factor authentication be required?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">The proposal would require MFA for access to systems that contain ePHI, with limited exceptions. Starting with email, remote access, and administrator accounts is a smart first step.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">6. Will encryption be mandatory?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">The proposal would require encryption of ePHI at rest and in transit in most situations. Practices should begin with laptops, mobile devices, servers, backups, and data transfers.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">7. What is an asset inventory and network map?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">It is a written list of every device and system that touches ePHI, plus a diagram showing how data flows between them. It would need regular review and updates.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">8. How often would vulnerability scans and penetration tests be required?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">The proposal calls for scans at least every six months and penetration tests at least every twelve months. Exact requirements may differ in the final rule.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">9. What is the seventy-two-hour restoration requirement?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">The proposal would require practices to restore critical systems and data within seventy-two hours after a loss. Meeting it requires tested backups, prioritized recovery steps, and documented procedures.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">10. How should we back up patient data?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Keep multiple copies, including one that is offline or immutable, encrypt them, and test restores regularly. Store backup credentials separately from your everyday network logins.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">11. What is a business associate?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">It is any outside company that handles ePHI on your behalf, such as an EHR vendor, billing service, or IT provider. You need a signed agreement with each one.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">12. What new duties would business associates have?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">They would need to verify their safeguards annually and notify covered entities within twenty-four hours of activating contingency plans. Covered entities should request and keep this documentation.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">13. How quickly must we remove access when someone leaves?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">The proposal contemplates notification within twenty-four hours of changes to a workforce member\u2019s access. The safest approach is same-day account removal.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">14. Does network segmentation require expensive equipment?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Not necessarily. Many offices can achieve it using properly configured business-grade firewalls and switches. The key is thoughtful design and ongoing monitoring.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">15. Are dental imaging devices covered by the Security Rule?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">If they store or transmit patient information, yes. Digital sensors, scanners, and imaging servers should be included in your inventory, risk analysis, and security controls.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">16. Can we use AI scribes or chatbots with patient information?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Only after careful vetting. Confirm the vendor will sign a business associate agreement, does not train on your data, and meets your security requirements.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">17. How often should we update our risk analysis?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">At least annually, and whenever you add systems, change vendors, open locations, or experience a significant incident. The proposal emphasizes regular, documented reviews.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">18. What happens if we do not comply?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Consequences can include investigations, corrective action plans, and financial penalties. A breach can also trigger notification costs, lawsuits, and lasting reputational harm.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">19. How does cyber insurance connect to HIPAA compliance?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Insurers ask about the same controls regulators care about, including MFA, backups, and training. Inaccurate application answers can lead to denied claims.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">20. How can an IT partner help us prepare?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">A partner can conduct risk analyses, build asset inventories, deploy security controls, manage patching and monitoring, test backups, and organize the documentation auditors expect.<\/div>\n<\/details>\n<\/div>\n<\/div>\n<p><a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/contact-us\/\"><img decoding=\"async\" class=\"aligncenter size-full wp-image-941\" src=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2025\/04\/Blue-and-White-Bold-Call-To-Action-LinkedIn-Banner-1200-x-300-px-7-1024x256-1.png\" alt=\"\" width=\"1024\" height=\"256\" srcset=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2025\/04\/Blue-and-White-Bold-Call-To-Action-LinkedIn-Banner-1200-x-300-px-7-1024x256-1.png 1024w, https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2025\/04\/Blue-and-White-Bold-Call-To-Action-LinkedIn-Banner-1200-x-300-px-7-1024x256-1-300x75.png 300w, https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2025\/04\/Blue-and-White-Bold-Call-To-Action-LinkedIn-Banner-1200-x-300-px-7-1024x256-1-768x192.png 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>For more than twenty years, the HIPAA Security Rule has guided how&#8230;<\/p>\n","protected":false},"author":1042,"featured_media":2581,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[16,82,80,22,24,23,18,89,88,50,52,54,44,28,29],"class_list":["post-2580","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-local-it","tag-cmit-solutions","tag-long-beach-small-business-it-services","tag-long-beach-technology-solutions-for-businesses","tag-longbeach-it-services","tag-longbeach-it-support","tag-managed-it-in-longbeach","tag-managed-it-services","tag-managed-it-services-for-hotels-cmit-solutions-of-long-beach","tag-managed-services-for-multi-location-businesses","tag-network-resilient","tag-security-awareness-2-0","tag-strategic-it-planning","tag-tech-debt","tag-windows-10-risks","tag-windows-update"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.5.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"For more than twenty years, the HIPAA Security Rule has guided how healthcare practices protect electronic patient information. During that time, the threats have changed completely. Practices that once worried about a lost filing cabinet now face ransomware crews, stolen logins, cloud misconfigurations, and phishing messages written by artificial intelligence. The rule itself, however, has Learn what the proposed HIPAA Security Rule changes mean for medical and dental offices, and how Long Beach practices can prepare with practical steps.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Michel Abraham\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.5.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Long Beach, CA 1217 | CMIT Solutions\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices | HIPAA Security Rule Changes: Medical and Dental Guide\" \/>\n\t\t<meta property=\"og:description\" content=\"For more than twenty years, the HIPAA Security Rule has guided how healthcare practices protect electronic patient information. During that time, the threats have changed completely. Practices that once worried about a lost filing cabinet now face ransomware crews, stolen logins, cloud misconfigurations, and phishing messages written by artificial intelligence. The rule itself, however, has Learn what the proposed HIPAA Security Rule changes mean for medical and dental offices, and how Long Beach practices can prepare with practical steps.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-11-13T12:25:27+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-11-12T12:32:36+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices | HIPAA Security Rule Changes: Medical and Dental Guide\" \/>\n\t\t<meta name=\"twitter:description\" content=\"For more than twenty years, the HIPAA Security Rule has guided how healthcare practices protect electronic patient information. During that time, the threats have changed completely. Practices that once worried about a lost filing cabinet now face ransomware crews, stolen logins, cloud misconfigurations, and phishing messages written by artificial intelligence. The rule itself, however, has Learn what the proposed HIPAA Security Rule changes mean for medical and dental offices, and how Long Beach practices can prepare with practical steps.\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/#blogposting\",\"name\":\"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices | HIPAA Security Rule Changes: Medical and Dental Guide\",\"headline\":\"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices\",\"author\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/author\\\/cmitlongbeachdm\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/wp-content\\\/uploads\\\/sites\\\/234\\\/2026\\\/11\\\/01-Bulk-1-Copy-of-Bulk-1-Copy-of-Bulk-1-Copy-of-Bulk-1-Copy-of-Copy-of-Bulk-1-Copy-of-longbea.png\",\"width\":640,\"height\":335},\"datePublished\":\"2026-11-13T06:25:27-06:00\",\"dateModified\":\"2026-11-12T06:32:36-06:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/#webpage\"},\"articleSection\":\"Local IT, CMIT Solutions, Long Beach Small Business IT Services, Long Beach Technology Solutions for Businesses, longbeach it services, Longbeach it support, Managed it in longbeach, Managed IT Services, Managed IT Services for Hotels \\u2013 CMIT Solutions of Long Beach, Managed Services for Multi-Location Businesses, Network Resilient, Security Awareness 2.0, Strategic IT Planning, Tech Debt, windows 10 risks, windows update\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/category\\\/local-it\\\/#listItem\",\"name\":\"Local IT\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/category\\\/local-it\\\/#listItem\",\"position\":2,\"name\":\"Local IT\",\"item\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/category\\\/local-it\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/#listItem\",\"name\":\"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/#listItem\",\"position\":3,\"name\":\"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/category\\\/local-it\\\/#listItem\",\"name\":\"Local IT\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/#organization\",\"name\":\"CMIT Solutions Long Beach\",\"description\":\"CMIT Solutions\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"http:\\\/\\\/cmitsolutions.com\\\/template\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/09\\\/CMMIT-Solutions-Logo.png\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/author\\\/cmitlongbeachdm\\\/#author\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/author\\\/cmitlongbeachdm\\\/\",\"name\":\"Michel Abraham\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c32c917cd326dde9c14a5a6a480453a1e84acd72039cc8c7c9faf67b4a6a9075?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Michel Abraham\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/#webpage\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/\",\"name\":\"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices | HIPAA Security Rule Changes: Medical and Dental Guide\",\"description\":\"For more than twenty years, the HIPAA Security Rule has guided how healthcare practices protect electronic patient information. During that time, the threats have changed completely. Practices that once worried about a lost filing cabinet now face ransomware crews, stolen logins, cloud misconfigurations, and phishing messages written by artificial intelligence. The rule itself, however, has Learn what the proposed HIPAA Security Rule changes mean for medical and dental offices, and how Long Beach practices can prepare with practical steps.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/author\\\/cmitlongbeachdm\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/author\\\/cmitlongbeachdm\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/wp-content\\\/uploads\\\/sites\\\/234\\\/2026\\\/11\\\/01-Bulk-1-Copy-of-Bulk-1-Copy-of-Bulk-1-Copy-of-Bulk-1-Copy-of-Copy-of-Bulk-1-Copy-of-longbea.png\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/#mainImage\",\"width\":640,\"height\":335},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/blog\\\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\\\/#mainImage\"},\"datePublished\":\"2026-11-13T06:25:27-06:00\",\"dateModified\":\"2026-11-12T06:32:36-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/#website\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/\",\"name\":\"CMIT Solutions Long Beach\",\"description\":\"CMIT Solutions\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/long-beach-ca-1217\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices | HIPAA Security Rule Changes: Medical and Dental Guide<\/title>\n\n","aioseo_head_json":{"title":"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices | HIPAA Security Rule Changes: Medical and Dental Guide","description":"For more than twenty years, the HIPAA Security Rule has guided how healthcare practices protect electronic patient information. During that time, the threats have changed completely. Practices that once worried about a lost filing cabinet now face ransomware crews, stolen logins, cloud misconfigurations, and phishing messages written by artificial intelligence. The rule itself, however, has Learn what the proposed HIPAA Security Rule changes mean for medical and dental offices, and how Long Beach practices can prepare with practical steps.","canonical_url":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/#blogposting","name":"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices | HIPAA Security Rule Changes: Medical and Dental Guide","headline":"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices","author":{"@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/author\/cmitlongbeachdm\/#author"},"publisher":{"@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2026\/11\/01-Bulk-1-Copy-of-Bulk-1-Copy-of-Bulk-1-Copy-of-Bulk-1-Copy-of-Copy-of-Bulk-1-Copy-of-longbea.png","width":640,"height":335},"datePublished":"2026-11-13T06:25:27-06:00","dateModified":"2026-11-12T06:32:36-06:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/#webpage"},"isPartOf":{"@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/#webpage"},"articleSection":"Local IT, CMIT Solutions, Long Beach Small Business IT Services, Long Beach Technology Solutions for Businesses, longbeach it services, Longbeach it support, Managed it in longbeach, Managed IT Services, Managed IT Services for Hotels \u2013 CMIT Solutions of Long Beach, Managed Services for Multi-Location Businesses, Network Resilient, Security Awareness 2.0, Strategic IT Planning, Tech Debt, windows 10 risks, windows update"},{"@type":"BreadcrumbList","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/#listItem","position":1,"name":"Home","item":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/","nextItem":{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/category\/local-it\/#listItem","name":"Local IT"}},{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/category\/local-it\/#listItem","position":2,"name":"Local IT","item":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/category\/local-it\/","nextItem":{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/#listItem","name":"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices"},"previousItem":{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/#listItem","position":3,"name":"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices","previousItem":{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/category\/local-it\/#listItem","name":"Local IT"}}]},{"@type":"Organization","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/#organization","name":"CMIT Solutions Long Beach","description":"CMIT Solutions","url":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/","logo":{"@type":"ImageObject","url":"http:\/\/cmitsolutions.com\/template\/wp-content\/uploads\/sites\/2\/2022\/09\/CMMIT-Solutions-Logo.png","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/#organizationLogo"},"image":{"@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/author\/cmitlongbeachdm\/#author","url":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/author\/cmitlongbeachdm\/","name":"Michel Abraham","image":{"@type":"ImageObject","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/c32c917cd326dde9c14a5a6a480453a1e84acd72039cc8c7c9faf67b4a6a9075?s=96&d=mm&r=g","width":96,"height":96,"caption":"Michel Abraham"}},{"@type":"WebPage","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/#webpage","url":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/","name":"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices | HIPAA Security Rule Changes: Medical and Dental Guide","description":"For more than twenty years, the HIPAA Security Rule has guided how healthcare practices protect electronic patient information. During that time, the threats have changed completely. Practices that once worried about a lost filing cabinet now face ransomware crews, stolen logins, cloud misconfigurations, and phishing messages written by artificial intelligence. The rule itself, however, has Learn what the proposed HIPAA Security Rule changes mean for medical and dental offices, and how Long Beach practices can prepare with practical steps.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/#website"},"breadcrumb":{"@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/#breadcrumblist"},"author":{"@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/author\/cmitlongbeachdm\/#author"},"creator":{"@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/author\/cmitlongbeachdm\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-content\/uploads\/sites\/234\/2026\/11\/01-Bulk-1-Copy-of-Bulk-1-Copy-of-Bulk-1-Copy-of-Bulk-1-Copy-of-Copy-of-Bulk-1-Copy-of-longbea.png","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/#mainImage","width":640,"height":335},"primaryImageOfPage":{"@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/#mainImage"},"datePublished":"2026-11-13T06:25:27-06:00","dateModified":"2026-11-12T06:32:36-06:00"},{"@type":"WebSite","@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/#website","url":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/","name":"CMIT Solutions Long Beach","description":"CMIT Solutions","inLanguage":"en-US","publisher":{"@id":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/#organization"}}]},"og:locale":"en_US","og:site_name":"Long Beach, CA 1217 | CMIT Solutions","og:type":"article","og:title":"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices | HIPAA Security Rule Changes: Medical and Dental Guide","og:description":"For more than twenty years, the HIPAA Security Rule has guided how healthcare practices protect electronic patient information. During that time, the threats have changed completely. Practices that once worried about a lost filing cabinet now face ransomware crews, stolen logins, cloud misconfigurations, and phishing messages written by artificial intelligence. The rule itself, however, has Learn what the proposed HIPAA Security Rule changes mean for medical and dental offices, and how Long Beach practices can prepare with practical steps.","og:url":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/","article:published_time":"2026-11-13T12:25:27+00:00","article:modified_time":"2026-11-12T12:32:36+00:00","twitter:card":"summary_large_image","twitter:title":"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices | HIPAA Security Rule Changes: Medical and Dental Guide","twitter:description":"For more than twenty years, the HIPAA Security Rule has guided how healthcare practices protect electronic patient information. During that time, the threats have changed completely. Practices that once worried about a lost filing cabinet now face ransomware crews, stolen logins, cloud misconfigurations, and phishing messages written by artificial intelligence. The rule itself, however, has Learn what the proposed HIPAA Security Rule changes mean for medical and dental offices, and how Long Beach practices can prepare with practical steps."},"aioseo_meta_data":{"post_id":"2580","title":"#post_title #separator_sa HIPAA Security Rule Changes: Medical and Dental Guide","description":"#post_excerpt Learn what the proposed HIPAA Security Rule changes mean for medical and dental offices, and how Long Beach practices can prepare with practical steps.","keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-11-13 12:42:37","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-11-12 12:25:27","updated":"2026-11-13 12:43:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/category\/local-it\/\" title=\"Local IT\">Local IT<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tHIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/"},{"label":"Local IT","link":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/category\/local-it\/"},{"label":"HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices","link":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/blog\/hipaa-security-rule-changes-a-preparation-guide-for-long-beach-medical-and-dental-offices\/"}],"_links":{"self":[{"href":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-json\/wp\/v2\/posts\/2580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-json\/wp\/v2\/users\/1042"}],"replies":[{"embeddable":true,"href":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-json\/wp\/v2\/comments?post=2580"}],"version-history":[{"count":0,"href":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-json\/wp\/v2\/posts\/2580\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-json\/wp\/v2\/media\/2581"}],"wp:attachment":[{"href":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-json\/wp\/v2\/media?parent=2580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-json\/wp\/v2\/categories?post=2580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cmitsolutions.com\/long-beach-ca-1217\/wp-json\/wp\/v2\/tags?post=2580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}