The Healthcare Compliance Step-By-Step Podcast · EPICompliance

#104 - Navigating BAA Changes Under the 2026 HIPAA Rule

·47 min·1 clip

2026 HIPAA rule: You can't just trust vendors anymore—you need proof they're actually compliant.

Business associate agreements sit at the center here. Ray opens with HIPAA security rule changes that may be coming, then steers the talk toward what that means for business associates. Jose starts with the plain definition: if someone transmits, creates, or stores PHI, electronic or hard copy, they can end up in the business associate lane. That is where the confusion starts. A lot of people seem to think their setup is too small, too informal, or too low risk to need compliance structure. Jose does not leave much room for that. A 1099 provider or contractor cannot shrug off policies, procedures, and work device controls as someone else's paperwork. IT companies do not get to disappear in the background either. Even with simple healthcare clients, they can tighten device security, cover the basics, and stop waiting for the panic call. The radiologist example makes the point without dressing it up. If the whole work setup is a laptop and maybe a tablet, the burden is not mysterious. It is basic controls and a written process. Cost excuses do not get far. Jose frames the monthly spend for policies, procedures, and device support as manageable next to what providers bill practices, and the federal government is not likely to care much about excuses later. That is the warning under the banter: if PHI is in your hands, your paperwork and safeguards need to look like it. Ray keeps the session practical, and the close suggests they will keep covering both small and larger compliance problems as the rule changes get clearer. There is a product mention, but Jose cuts the pitch short by telling listeners to compare competitors. The point is the work, not the vendor. The episode lands like a checklist: figure out whether you are a business associate, write the policies, secure the devices, and stop treating informality like a defense.

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from The Healthcare Compliance Step-By-Step Podcast