When a major internet provider like Cloudflare has an outage, many healthcare organizations discover the hard way that their "mission-critical" systems are only as reliable as the invisible vendors behind them. This webinar uses the recent Cloudflare incident as a real-world case study to show how availability fits into the HIPAA Security Rule, why third-party and "fourth-party" dependencies belong in every risk analysis, and how to prepare so the next big internet disruption is a controlled event, not a scramble.

Key Topics:

• Use the Cloudflare outage as a practical, real-world example of how infrastructure failures affect patient portals, telehealth, logins, and day-to-day healthcare operations, and why availability is a compliance issue, not just an IT headache.
• Connect the dots between the HIPAA Security Rule's requirements for availability, risk analysis, and contingency planning, and learn how to document third- and fourth-party dependencies in a way that stands up to audits and real incidents.
• Walk through practical, non-technical steps to strengthen downtime planning, vendor oversight, and internal communication so your teams know exactly what to do the next time "the internet breaks."

Resources:

• Learn more about healthcare compliance systems: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠
• Explore healthcare compliance training and weekly webinars: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com/training-in...⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

Originally Recorded: December 2, 2025.

When your compliance program lives inside EPICompliance, every form you complete becomes part of your evidence trail. In this practical session, we focus on some of the more complex EPICompliance forms and walk you through completing them step-by-step. You'll see what each field is really asking, how to avoid common mistakes, and how to make sure your entries match what is actually happening in your day-to-day operations. The goal is more clarity, faster form completion, and stronger, audit-ready documentation across your entire compliance program.

Key Topics:

• Walk through complex EPICompliance forms field by field, including compliance program setup, Security Risk Assessment inputs, incident and breach logs, and Business Associate documentation, with clear explanations of what belongs in each section.
• Compare examples of "good" entries versus common mistakes so you can document real-world operations accurately, avoid inconsistencies, and strengthen your evidence in case of audits or investigations.
• Build a repeatable approach to completing and updating forms that improves consistency across your organization, reduces rework, and ensures your EPICompliance data supports HIPAA, OIG, and payer expectations.

Resources:

• Learn more about healthcare compliance systems: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠
• Explore healthcare compliance training and weekly webinars: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com/training-in...⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

Originally Recorded: November 25, 2025.

When AI enters clinical and administrative workflows, privacy rules and safety expectations come with it. In this practical session, we translate HIPAA requirements into plain English and apply an "AI-assisted, not AI-controlled" model to real-world scenarios. You'll see how to use AI tools without disclosing more PHI than necessary, how to apply Minimum Necessary and de-identification in everyday workflows, and how to keep clinicians clearly in charge.

Key Topics:

• Identify appropriate AI use cases in healthcare and apply Minimum Necessary, de-identification, and data minimization in each workflow.
• Know when a Business Associate Agreement (BAA) is required, what to ask vendors about data use, logging, and model training, and how to build clear audit trails for scribe, coding, and prior auth tools.
• Close policy gaps, monitor accuracy and drift, and retain evidence for six years to satisfy HIPAA and payer expectations.

Resources:

• Learn more about healthcare compliance systems: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠
• Explore healthcare compliance training and weekly webinars: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com/training-in...⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

Originally Recorded: November 18, 2025.

When AI enters clinical and administrative workflows, benefits and risks arrive together. This practical session, we translate HIPAA and safety expectations into plain English and apply an "AI-assisted, not AI-controlled" model to everyday use cases. You will see where AI delivers real gains, what can go wrong without human review, and the simple guardrails that keep care safe and liability low. We showcase to to require from vendors, how to document human-in-the-loop decisions, how to prevent algorithm-only denials and upcoding, and where to file proof so you are audit-ready.

Key Topics:

• Pick the right AI use cases, set human-in-the-loop checkpoints, and document a one-line reconciliation note in the record.
• Require transparency and compliance from vendors, including BAAs when PHI is involved, data minimization, and clear audit trails for coding, prior auth, and scribe tools.
• Close policy gaps, monitor accuracy and drift, and retain evidence for six years to satisfy HIPAA and payer expectations.

Resources:

• Learn more about healthcare compliance systems: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠
• Explore healthcare compliance training and weekly webinars: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com/training-in...⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

Originally Recorded: November 11, 2025.

When leases end, copier/MFP hard drives can walk out the door with ePHI. In this practical session, we translate HIPAA device/media controls into plain English and apply NIST SP 800-88 (Clear, Purge, Destroy) to everyday returns, swaps, and disposals. You'll see what to require from vendors, how to verify sanitization, how to document chain of custody, and where to file proof so you're audit-ready.

Key Topics:

• Choose the right NIST 800-88 method for copiers and MFPs.
• Demand proper documentation (method, verification, serials, chain of custody).
• Close policy gaps and retain proof for six years to satisfy HIPAA.

Resources:

• Learn more about healthcare compliance systems: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠
• Explore healthcare compliance training and weekly webinars: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com/training-in...⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

Originally Recorded: November 4, 2025.

Every October, some compliance stories are just too haunting to forget. This session reveals recent HIPAA breach cases to show exactly where controls failed and what would have prevented the incident. We'll cover phishing and access control gaps, missing or weak audit trails, vendor and copier/MFP risks, and documentation shortfalls.

Key Topics:

• Real breach case reviews and what failed at each step.
• Regulator responses: investigations, settlements, and corrective action plans.
• How to lock the front doors: phishing defense, access controls, and audit logging that sticks.

Resources:

• Learn more about healthcare compliance systems: ⁠⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com⁠⁠⁠⁠⁠⁠⁠⁠⁠
• Explore healthcare compliance training and weekly webinars: ⁠⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com/training-in...⁠⁠⁠⁠⁠⁠⁠⁠⁠

Originally Recorded: October 28, 2025.

This session is designed to cut through the noise on three major forces shaping healthcare in 2026. We'll translate heightened noncompete scrutiny into actionable talent and contracting strategies, unpack the Medicare prior authorization pilots and their operational ripple effects, and clarify how the 2026 Medicare Physician Fee Schedule may affect access, documentation, and margins. You'll leave with a focused 90-day action plan and a practical checklist for contracts, workflows, and analytics designed to protect your organization and keep operations running smoothly.

Key Topics:

• Understand the impact of increased noncompete enforcement on provider contracts, retention strategies, and organizational risk.
• Prepare for new Medicare prior authorization pilots and learn how to strengthen workflows, data tracking, and appeals readiness.
• Assess the 2026 Physician Fee Schedule changes to anticipate revenue shifts, documentation demands, and compliance implications.

Resources:

• Learn more about healthcare compliance systems: ⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com⁠⁠⁠⁠⁠⁠⁠⁠
• Explore healthcare compliance training and weekly webinars: ⁠⁠⁠⁠⁠⁠⁠⁠epicompliance.com/training-in...⁠⁠⁠⁠⁠⁠⁠⁠

Originally Recorded: October 21, 2025.

The 2026 HIPAA Security Rule introduces significant updates to Business Associate Agreements (BAAs), raising the bar for compliance and security. In this session, we'll break down the critical changes, including the mandatory encryption, multi-factor authentication (MFA) requirements, stricter risk analysis, and enhanced oversight of business associates. You'll learn how to revise your BAAs to meet these new requirements, implement effective controls, and reduce your organization's exposure to compliance risks.

Key Topics:

• Identify which BAA clauses must be updated first, encryption/MFA, incident reporting timelines, subcontractor "flow-down" obligations, and termination-for-cause language.
• Translate the new risk analysis and ongoing monitoring expectations into practical BA oversight, evidence logs, attestations, and remediation tracking that satisfy auditors.
• Implement a step-by-step playbook to renegotiate, execute, and operationalize revised BAAs without disrupting patient care, revenue cycle operations, or vendor relationships.

Resources:

• Learn more about healthcare compliance systems: ⁠⁠⁠⁠⁠⁠⁠epicompliance.com⁠⁠⁠⁠⁠⁠⁠
• Explore healthcare compliance training and weekly webinars: ⁠⁠⁠⁠⁠⁠⁠epicompliance.com/training-in...⁠⁠⁠⁠⁠⁠⁠

Originally Recorded: October 14, 2025.

This session translates shutdown mechanics into clear operational steps for providers, payers, and life science teams. We'll map what typically continues under "excepted" operations, what slows or pauses, and how to maintain stability in revenue, compliance, and patient care until complete government services resume. Walk away with a practical checklist to safeguard cash flow, protect deadlines, and communicate confidently with staff and patients.

Key Topics:

• Discover which authorizations, audits, and reconsiderations are most likely to move forward during a shutdown
• Keep your practice in compliance with limited regulatory capacity, including incident response, BA oversight, and record retention
• Learn how to manage communications and actions with manufacturers, sponsors, and academic partners when FDA reviews, trials, or federal grants are delayed or paused

Resources:

• Learn more about healthcare compliance systems: ⁠⁠⁠⁠⁠⁠epicompliance.com⁠⁠⁠⁠⁠⁠
• Explore healthcare compliance training and weekly webinars: ⁠⁠⁠⁠⁠⁠epicompliance.com/training-in...⁠⁠⁠⁠⁠⁠

Originally Recorded: October 7, 2025.

This session explores what a HIPAA Security Risk Analysis (SRA) truly requires, and what it doesn't. We'll unpack the Top 10 myths (like "my EHR vendor handles it" or "we did one year ago, so we're covered") and show how those misconceptions lead to fines, audit exposure, and real security gaps. You'll leave with a clear view of your legal obligations under the Security Rule, the pitfalls to avoid, and practical steps to safeguard ePHI. Our expert speakers, joined by Dr. Jose I. Delgado, CEO of EPICompliance walk through how to recognize and correct SRA errors and implement controls that actually reduce risk.

Key Topics:

• Identify and debunk common SRA myths, and align with what the Security Rule really requires
• Right-size your SRA scope, method, and documentation to meet OCR expectations
• Implement actionable controls that lower risk while supporting patient care

Resources:

• Learn more about healthcare compliance systems: ⁠⁠⁠⁠⁠epicompliance.com⁠⁠⁠⁠⁠
• Explore healthcare compliance training and weekly webinars: ⁠⁠⁠⁠⁠epicompliance.com/training-in...⁠⁠⁠⁠⁠

Originally Recorded: September 30, 2025.