HIPAA explained where patient care meets risk.
Help Me With HIPAA treats HIPAA as a patient-care discipline, not a paperwork ritual. Donna Grendel and David Sims connect breach stories, OCR settlement lessons, AI consent questions, routers, MSP habits, and aging medical devices to the decisions healthcare organizations actually make.
PRESS PLAY
Help Me With HIPAA is built around the uncomfortable middle ground between healthcare compliance language and the everyday choices that create risk. Donna Grendel and David Sims keep returning to one operating idea: HIPAA work only matters if it protects patient care. The show is not slick. It is direct, conversational, and willing to stop on a basic distinction until the distinction is usable. A risk analysis is not a gap analysis. Risk acceptance is not a private shrug. Buying a tool is not the same thing as governing a process. Recent episodes use healthcare security cases as working material, including patient-safety reports, OCR settlement lessons, CISA hardening guidance, and cyber incidents affecting healthcare business associates. The hosts move from headlines to consequences quickly. When generative AI enters a clinical workflow, the question becomes patient consent, disclosure, opt-out language, and enough appointment time for a real conversation. When a home router sits outside the office perimeter, the question becomes whether the organization has pretended risk stops at the building door. When a healthcare supplier experiences disruption, the question becomes what recovery promises are actually based on. The show also spends time on older problems that refuse to go away. Security awareness training still fails when people treat security as optional inconvenience. Legacy medical devices keep aging into bigger operational problems. Windows end-of-life issues, DICOM and PACS exposure, endpoint management, MFA, least privilege, and admin-role hygiene all become patient-safety issues once care delivery depends on connected systems. The pacing is brisk but not tidy. Side jokes and old-technology tangents appear, then the conversation snaps back to the practical lesson. The best fit is a listener who has to make or support real compliance decisions and does not need them softened. It is especially useful for healthcare operators, MSPs, compliance leads, and security teams serving healthcare organizations or business associates. The differentiator is the mix of regulatory memory and implementation pressure. Help Me With HIPAA makes the boring documentation questions feel operational, because in this world the boring questions are where the failures usually start.
Made for: For healthcare operators, MSPs, compliance staff, security teams, and business associates who need practical HIPAA and cybersecurity judgment. It suits listeners who prefer blunt operational lessons over polished policy talk.
What sets it apart: The show connects enforcement, governance, technical controls, and patient-care consequences without pretending they are separate lanes. Its strength is making documentation, risk tolerance, AI consent, routers, MFA, and legacy devices sound like parts of the same operational system.
In today's environment of data breaches, identity theft, fraud, and increasing connectivity, HIPAA Privacy and Security rules are a responsibility to your patients and your clients. HIPAA isn't about compliance, it's about patient care.
Based on 6 episodes we listened to · August 2026
Help Me With HIPAA turns health care privacy and security rules into practical technology risk decisions for healthcare IT, MSPs, and compliance-minded teams.
Help Me With HIPAA sits at the point where health care compliance turns into everyday security work. The sampled episodes are conversational and practical, with discussions of the Verizon DBIR, CISA guidance, an OCR settlement, risk analysis, AI use around patient care, and the…
That $79 home router may make you reconsider every other risk you filed under 'fine.'
Press play if you want
Short reviews from the PlayNext desk, based on the episodes we processed.
AI governance and patient safety are treated as a practical, process-first set of concerns in ECRI's 2026 list.
ECRI's 2026 top 10 patient safety concerns give Donna Grendel and David Simms a useful frame for looking at what changed since the report they covered almost exactly a year earlier.
A settlement analysis turns recurring risk work from paperwork into an operating responsibility.
Risk analysis only matters when an organization can produce it, revisit it, and show that the findings led somewhere. Help Me With HIPAA uses the Top of the World Ranch Treatment Center SRA settlement to focus on what OCR expects: an accurate, thorough look at risks and…
A milestone episode that turns HIPAA risk talk into a practical reminder for MSPs and healthcare IT teams.
Episode 550 is presented as a milestone, but the real value is in its steady focus on a common HIPAA challenge: MSPs looking for a fast entry into healthcare IT, and the pushback against the idea that compliance can be handled within three months.
Legacy medical devices make HIPAA a patient-care and cyber-safety issue.
Choices Have Consequences frames legacy medical technology as a patient-care problem before it is a compliance problem. Donna Grendel and David Sims connect Windows-based medical devices, DOS running through emulators, DICOM and PAX exposures, expensive equipment, strained…
A practical guide to spending on security without pretending every control deserves the same budget.
This conversation treats the updated CISA CPGs as a workable small-business security guide, not a grand theory piece. Donna and David spend time on the part that usually gets skipped: what a control costs, what it takes to put in place, and what it keeps costing after the…
The router in the corner is part of the perimeter, whether anyone treats it that way or not.
Donna Grendel and David Sims make a simple but useful point: the home router belongs in the security perimeter, not off to the side as a harmless appliance.
A sharp tour of Verizon's DBIR that pairs breach trends with a skeptical look at HIPAA enforcement.
Donna Grindle and David Sims use Verizon's DBIR as a grounded way into what threat actors are after and why personal data keeps ending up at the center of the story.
Election talk that shows its math.
Former CIA acting director Michael Morell interviews intelligence veterans on Iran, China, and Ukraine.
This episode discusses recent cybersecurity incidents, including a civil money penalty against Warby Parker and a report card on Fortune 500 healthcare companies' security practices.
Donna Grindle and David Sims review the Verizon Data Breach Investigations Report (DBIR) 2024 on the Help Me With HIPAA podcast.
Hosts Donna Grendel and David Sims warn listeners that home routers pose significant cybersecurity risks, including being part of botnets and potential spying.
This episode discusses a sophisticated AI-driven attack, based on Anthropic's report, highlighting its ingenuity and the alarming frequency and tracking capabilities.
This episode discusses gentle hacking techniques like social engineering, using examples such as mail forwarding scams and password reset requests to highlight human vulnerabilities in cybersecurity.
The show opens with a joke about paper and pencil.
This episode discusses the importance of cybersecurity for home routers, emphasizing that threats extend beyond the office and many people unknowingly use routers provided by their internet service provider.
This episode discusses a 15 million record cover-up and CISA's recent alert urging endpoint management and hardening after a cyber attack.
This episode discusses a recent cyberattack on Stryker, a healthcare business associate, highlighting its global disruption to Microsoft systems and the unusual absence of ransomware or malware.
This episode explores why security awareness training often fails, focusing on inconvenient security practices and introducing foundational concepts like Donna's three rules.
["Donna Grendel and David Sims use the Top of the World Ranch Treatment Center settlement to show why OCR treats risk analysis as mandatory after a March 2023 phishing breach that exposed email PHI for roughly 1,980 patients.", "They argue that if PHI or PII should not be sent through email, email encryption is not the core fix, even when people assume they need it.", "The discussion spells out what the settlement expects: a complete inventory of electronic equipment, data systems, offsite storage, applications, vulnerability scans, penetration testing, annual review, and a written risk management plan.", "They also press the point that policies, training records, sanctions, and reportable events have to be documented because HIPAA security is about patient care, not just checkbox compliance."]
Help Me With HIPAA marks episode 550 with a loose conversation about how long the show has been running.
Donna Grendel and David Sims use Help Me With HIPAA's Choices Have Consequences to connect Health ISAC's 2025 ransomware data, legacy medical devices, and AI governance.
Donna and David talk through CISA's CPGs version two as a practical answer for small and medium-sized businesses.
This episode previews the Health Sector Coordinating Council's AI security efforts with guest Donna Grindle, discussing upcoming public releases and the challenges of talking about ongoing work in healthcare cybersecurity.
This episode discusses the importance of keeping up with new and existing cyber laws at both federal and state levels, including specific mentions like Oklahoma and pending bills in Congress.