Are your IT or cloud providers handling your security? Does your site claim you're "HIPAA Compliant"? Donna Grindle, CEO of Kardon and co-host of Help Me With HIPAA, delivers a massive reality check for small business owners. We break down the difference between gap analysis and a true SRA, why IT speaks a different language, and how the "CREMATE" method finds your data.

Key Takeaways

• Responsibility Can't Be Outsourced: Cloud apps and IT companies don't make you secure; you outsource liability, not responsibility.
• Real SRA vs. Gap Analysis: If your risk analysis lacks likelihood, impact, and strategy, it’s just a gap analysis—and you're exposed.
• CREMATE Your Data: Map PHI by tracking where you Create, Receive, Maintain, and Transmit it
• Business Associates (BA): If unauthorized access by a vendor would count as a breach, they are a BA.
• Documentation & AI: Use AI to draft policies from your bullets, but treat it like a fallible assistant and always verify the output.
• Frameworks: Use HICP 405(d) to get IT and management speaking the same security language.

"If you put on your website that you're HIPAA compliant, immediately I'm concerned." — Donna Grindle

Links:

Kardon: https://kardonhq.com

Help Me With HIPAA Podcast: https://helpmewithhipaa.com/

HHS Website: https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html

HICP 405(d) Guidelines: https://405d.hhs.gov/

Timestamps

0:00 – Why a "HIPAA Compliant" Badge is a Red Flag

1:26 – Understanding HIPAA Covered Entities & Obligations

2:14 – The Difference Between Awareness Training and Security

3:18 – Why Your SRA Might Just Be a Gap Analysis

4:40 – Building an Inventory: You Can’t Protect What You Don’t Find

6:22 – Using the "CREMATE" Method for Data Mapping

8:21 – Why IT Cannot Be the "Department of No"

9:40 – Standardizing Communication with the HICP 405(d) Framework

10:41 – How to Document Your Policies (and Use AI to Help)

12:39 – The Easy Way to Tell if a Partner is a Business Associate

13:50 – Business Associate Red Flags

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

If you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place

But if you just want to learn how to protect yourself for free, start here: https://academy.securitymetrics.com/