Compliance Shouldn't Keep You Up at Night

HIPAA Compliance for Medical & Dental Practices

The Health Insurance Portability and Accountability Act (HIPAA) requires any healthcare provider handling Protected Health Information (PHI) to implement administrative, physical, and technical safeguards — and to document them.

HIPAA violations are investigated by the HHS Office for Civil Rights. You don't have to suffer a patient breach to be penalized — an audit finding inadequate safeguards is enough.

What HIPAA requires from your practice

• Annual Security Risk Analysis (documented and updated)
• Written security policies and procedures
• Workforce security training records
• Access controls — minimum necessary access per role
• Audit logs for all PHI access
• Automatic logoff on workstations and devices
• Encryption of PHI at rest and in transit
• Business Associate Agreements (BAAs) with all vendors
• Breach notification procedures (60-day HHS notification)
• Disaster recovery and backup procedures

What Xintel manages for you

• Annual Security Risk Analysis (HHS-compliant documentation)
• HIPAA Security Rule gap assessment and remediation
• Policy and procedure documentation library
• BAA review and vendor security questionnaires
• Workforce training and attestation records
• Technical safeguard implementation (encryption, MFA, audit logs)
• Breach notification guidance and HHS reporting support

NY SHIELD Act Compliance for Law Firms & All NY Businesses

New York's Stop Hacks and Improve Electronic Data Security (SHIELD) Act applies to any business — regardless of size or location — that handles private information of New York residents. That means you.

SHIELD requires "reasonable" administrative, technical, and physical safeguards. The NY Attorney General enforces it and has issued significant penalties against small businesses.

Who must comply

• Any business that handles NY resident data — employees or customers
• Applies whether your business is based in NY or not
• Small business provision: scaled requirements based on size
• No exemption for attorneys, accountants, or healthcare providers

SHIELD Act requirements

• Designated employee(s) responsible for security program
• Risk assessment to identify threats and vulnerabilities
• Technical safeguards: encryption, access controls, MFA
• Vendor management and contractual security requirements
• Employee training on cybersecurity practices
• Incident response and breach notification procedures
• Data disposal procedures for private information

Breach notification requirements

• Notify affected NY residents "in the most expedient time possible"
• Notify NY Attorney General of breaches affecting 500+ NY residents
• Expanded definition of "private information" includes biometrics, financial account data, username/password combinations

FTC Safeguards Compliance for Accounting & Financial Firms

The updated FTC Safeguards Rule (effective June 2023) significantly expanded requirements for "financial institutions" — a category that includes CPA firms, tax preparers, mortgage brokers, and financial advisors.

Non-compliance is enforced by the FTC and can result in substantial civil penalties, mandatory audits, and reputational damage that threatens client relationships.

9 required elements of your security program

• Designate a qualified individual (QI) responsible for the program
• Conduct a written risk assessment
• Implement safeguards to control identified risks
• Monitor and test effectiveness of safeguards
• Oversee service providers who access customer data
• Keep security program current with changes in operations/threats
• Create a written incident response plan
• Report to board of directors (or senior officer) annually
• Encrypt customer data at rest and in transit

Technical requirements (200+ customer records)

• Multi-factor authentication for all information systems
• Encryption of customer financial data
• Secure development practices for in-house applications
• Penetration testing and vulnerability assessments
• Access controls and audit logging
• Secure data disposal procedures