"[It] has been a banner year for OCR in HIPAA enforcement, with more settlements and a bigger haul than ever before. Yet, many of the enforcement actions involve relatively straightforward allegations of noncompliance, such as the lack of adequate risk analyses and risk management plans, failure to enter into business associate agreements, or failure to implement appropriate policies and procedures. Covered entities and business associates should be mindful of these enforcement actions and use them as an opportunity to critically evaluate their own compliance efforts."  MORE >>