Colington Consulting

Call Directions Website

Colington Consulting Helping Organizations Achieve HIPAA Compliance™ All assessments will include an action plan to prevent unauthorized access, tampering and theft.

HIPAA RISK ASSESSMENTS
The risk analysis is the first step to identify vulnerabilities and risks; determine the potential impact and provide a gap analysis. Our assessment is formatted to cover all the addressable and required specifications in the Code of Federal Regulations for the HIPAA Security Rule. HIPAA RISK MANAGEMENT PLAN
We develop and help your practice or business implement a Risk Management Plan. Think of your risk plan as your overall policies and procedures manual on how to make decisions to address security risk and vulnerabilities for HIPAA Security Rule compliance. Your completed plan will address all the required topics to include administrative, technical, and physical safeguards. Regardless of practice or business size, a Risk Management Plan is required. This may be one of the first documents OCR will request if there is a breach of electronic patient records or if a compliance audit is conducted. HIPAA PRIVACY POLICIES AND PROCEDURES MANUAL
The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information and applies to healthcare providers that conduct certain healthcare related transactions. The Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without authorization. The best way to ensure your staff is familiar with the appropriate safeguards is by having a HIPAA Privacy Policies and Procedures Manual. We develop and help your practice or business implement a Privacy Manual. HIPAA SECURITY AWARENESS & PRIVACY TRAINING
We can develop security awareness & privacy training specifically for your practice or business office environment. We offer web based HIPAA training available through our website. HIPAA DOCUMENTATION REVIEW
If your practice or business already has documentation in place, we can conduct a review of those documents to ensure you are meeting the current HIPAA Security Rule and HITECH compliance requirements for patient electronic health records. This cost effective review can determine if all high risk areas for compliance are being properly addressed.

What is a HIPAA violation, and when would your organization be investigated?Many organizations assume that an investigat...
10/15/2026

What is a HIPAA violation, and when would your organization be investigated?

Many organizations assume that an investigation requires a major cyberattack. OCR's 2026 enforcement record shows otherwise. A solo dental practice settled for $140,000 after a single patient complaint about access to her records. OCR investigated a business associate after a complaint about an incident it had not reported. Four ransomware settlements, totaling $1,165,000, shared one finding: no accurate, thorough risk analysis.

Our latest article explains:

• What constitutes a HIPAA violation under the Privacy, Security, and Breach Notification Rules
• Why a breach is not the same as a violation
• The three ways OCR investigations begin: breach reports, complaints, and compliance reviews
• Why breaches affecting 500 or more individuals are posted publicly by HHS and, in most cases, investigated

Colington Consulting helps covered entities and business associates build the documented, defensible compliance program OCR expects to see before an investigation begins, including organizations already under OCR investigation. Schedule a free HIPAA Risk Review by using the link on our website.

What is a HIPAA violation, and when will OCR investigate? Learn the three investigation triggers and what recent 2026 OCR settlements reveal.

Attesting for MIPS in 2026? The security risk analysis measure just changed.CMS now requires two separate "Yes" attestat...
10/05/2026

Attesting for MIPS in 2026? The security risk analysis measure just changed.

CMS now requires two separate "Yes" attestations under Promoting Interoperability: one for conducting or reviewing a HIPAA security risk analysis, and another for conducting security risk management activities. Miss either one, and the entire Promoting Interoperability category scores zero.

A risk analysis that identifies problems but never leads to a documented plan no longer supports a clean attestation, and OCR requests that same documentation in any HIPAA investigation.

Colington Consulting's lead consultants have conducted more than 1,000 HIPAA risk assessments. Our extensive, accurate, and thorough process maps ePHI across every system, vendor, and location and delivers the documented risk management plan your attestation requires.

Read what changed and book a free HIPAA Risk Review.

For 2026, CMS MIPS requires two attestations: a HIPAA security risk analysis and risk management. Learn what changed and how to attest with confidence.

OCR just settled with Ambry Genetics for $700,000 over a 2020 phishing attack that exposed the health data of 225,370 pe...
09/18/2026

OCR just settled with Ambry Genetics for $700,000 over a 2020 phishing attack that exposed the health data of 225,370 people: names, Social Security numbers, diagnoses, lab results, treatment information, the full picture. The breach itself began with a single compromised employee email account. What drove the settlement, though, was what OCR found beneath the incident: no accurate, thorough risk analysis; no process for cutting off system access when someone's employment ended; and no unique user IDs to track who was doing what within systems that hold ePHI.

None of those three findings are unusual. They are the same gaps I see walking into risk assessments for practices and organizations of every size, not just genetics labs with 225,000 records on the line. OCR's Director said it plainly in the announcement: a compliant risk analysis, real risk management, and full Security Rule implementation are the foundation of effective cyberdefense, not a checkbox exercise. If it has been a while since your last one, or you have never been fully sure it would hold up, that is exactly what a HIPAA Risk Review is for. Schedule now through our website, and we would be happy to talk through what this means for your organization.

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) today announced a settlement with Ambry Genetics Corporation (Ambry).

OCR just updated its free Security Risk Assessment Tool, and it's a genuine improvement. But a software update doesn't f...
09/15/2026

OCR just updated its free Security Risk Assessment Tool, and it's a genuine improvement. But a software update doesn't fix the bigger issue: OCR has never confirmed that the tool's output meets its own “accurate and thorough” risk-analysis standard, and it doesn't prevent you from saving an assessment while sections are still incomplete.

OCR has also described the SRA Tool as built with small and medium-sized providers in mind, without ever saying where that line actually falls. If your practice has used the free tool and checked the box on your risk analysis, it's worth finding out whether it would actually hold up.

Colington Consulting's lead consultants have personally completed more than 1,000 HIPAA risk assessments. Get a free HIPAA Risk Review and see exactly where a generic tool would leave gaps in your compliance program.

Schedule your free HIPAA Risk Review. The link to schedule is in the article.

Quick answer: On September 10, 2026, OCR and ONC released version 3.7 of the Security Risk Assessment (SRA) Tool, adding new content on remote access, telework, and system activity logging, as well as expanded asset examples and revised reports. The update is genuinely useful, but it doesn’t chang...

Last week, Colington Consulting attended OCR and NIST's 2026 "Safeguarding Health Information" conference held in Gaithe...
09/09/2026

Last week, Colington Consulting attended OCR and NIST's 2026 "Safeguarding Health Information" conference held in Gaithersburg, MD. Here's what OCR made clear: enforcement is not slowing down, risk analyses remain one of the most commonly cited deficiencies in investigations, and most organizations still lack documented policies and procedures to support their risk analysis findings.

A few numbers from OCR itself: 21 completed ransomware investigations, 14 completed Risk Analysis Enforcement Initiative investigations, and 55 completed Right of Access enforcement actions. Breach data also show that hacking and network server incidents now account for 75% and 68% of reported breaches, respectively, a sharp jump from prior years.

OCR's guidance was direct: don't wait for a breach, or a completed OCR investigation, before conducting a compliant risk analysis.

Get a free HIPAA Risk Review, and we'll help you see exactly where your risk analysis and policies stand. Use the link on our website homepage to book your free 30-minute HIPAA Risk Review.

Quick answer: At the OCR/NIST “Safeguarding Health Information” conference held September 2 to 3, 2026, in Gaithersburg, Maryland, HHS’s Office for Civil Rights delivered a consistent message across sessions: enforcement is not slowing down; risk analyses remain the most commonly cited deficie...

"Our IT company handles our HIPAA compliance." It's one of the most common things we hear from healthcare practices, and...
08/25/2026

"Our IT company handles our HIPAA compliance." It's one of the most common things we hear from healthcare practices, and one of the most understandable, since a good managed service provider really does handle a lot: firewalls, patching, backups, monitoring.

Here's the catch. HIPAA compliance isn't only a technical question. It also requires your practice's own risk analysis, written policies, workforce training, and a signed business associate agreement with every vendor touching patient data, including your IT partner. None of that transfers from your MSP, no matter how good they are.

A recent survey found that 98% of IT leaders and practice managers believed their email was encrypted by default, and over 80% were confident in their HIPAA compliance posture. That gap between confidence and reality is exactly where practices get caught off guard.

We break down where a good MSP's job ends and your practice's own compliance obligations begin, and why Colington Consulting only refers clients to MSP partners who genuinely understand HIPAA's requirements.

Not sure where your practice stands? Get a free HIPAA Risk Review. You can schedule using the link on our website homepage.

A good MSP isn't automatically a HIPAA compliant MSP. See what still falls on your practice, and where the compliance gaps really hide.

HIPAA has been federal law since 1996, but a lot of small and midsize healthcare practices are still confused about what...
08/19/2026

HIPAA has been federal law since 1996, but a lot of small and midsize healthcare practices are still confused about what it actually requires, and it is usually not because anyone is being careless.

Most practice owners and office managers never got formal HIPAA training. They picked up bits and pieces from a previous job, a software vendor's website, or an online forum, and a surprising amount of that secondhand information turns out to be wrong.

We just published a breakdown of the five HIPAA myths we run into most often with small and midsize practices, including the belief that a "HIPAA compliant" EHR means the whole practice is covered, and the confusion around which patient disclosures actually need a signed authorization versus which ones do not.

Regulators are not only paying attention to big hospital systems either. Small and midsize practices accounted for the majority of OCR's financial penalties in a recent reporting year.

Not sure where your practice stands? Contact our office for a free HIPAA Risk Review.

Quick answer: HIPAA has been federal law since 1996, yet small and midsize providers still get tripped up by it, and the reason is rarely carelessness. Most owners and office managers never received formal HIPAA training; they inherited assumptions from a prior job, a vendor’s marketing page, or a...

Did you know that if your school district bills Medicaid electronically for a student's counseling or therapy services, ...
08/05/2026

Did you know that if your school district bills Medicaid electronically for a student's counseling or therapy services, that can technically make the district subject to HIPAA — the same federal law that governs hospitals and doctors' offices?

Here's the good news: in most cases, the actual student records are still protected under FERPA (the student privacy law schools already follow), not HIPAA's privacy rules. But districts still need the right paperwork and safeguards in place for the billing side of things.

More schools are billing Medicaid for mental health and behavioral health services every year, so this is worth understanding if your district is one of them.

We've worked with several large public school systems on this exact issue, and we wrote up a plain-language breakdown of what applies, what doesn't, and what to check first.

Want help figuring out where your district stands? We offer a free HIPAA Risk Review, and for districts who want to go a step further on the student-privacy side, a FERPA assessment — not something the regulations require, but a service our school clients have found genuinely useful for staying on track.

Check out our website to book a free HIPAA Risk Review.

Schools Are Billing Medicaid for Behavioral Health Services — Does That Make Your District a HIPAA Covered Entity?

🚨 HIPAA Update: The federal government just delayed the HIPAA Security Rule changes to 2027 — but don't let that fool yo...
07/27/2026

🚨 HIPAA Update: The federal government just delayed the HIPAA Security Rule changes to 2027 — but don't let that fool you into thinking you have nothing to do.

The CURRENT HIPAA Security Rule is still fully in effect. That means the same rules, the same audits, and the same penalties still apply today. The only thing that got pushed back is a set of NEW proposed requirements (like mandatory encryption and multi-factor authentication) that haven't been finalized yet.

In other words: this is extra time to get prepared, not a free pass.

We put together a quick, plain-English breakdown of what's actually changing (and what isn't) so you know exactly where you stand 👇

Not sure if your organization has any gaps? We're offering a FREE HIPAA Risk Review to help you find out. The link to book is in the article.

Quick answer: HHS has pushed its target for finalizing the HIPAA Security Rule update from May 2026 to July 2027. But the delay only applies to the proposed new requirements— the current HIPAA Security Rule is still full...

Has your HIPAA compliance program gone on vacation for the summer? Bad threat actors are at it on 24/7 basis and do not ...
07/08/2026

Has your HIPAA compliance program gone on vacation for the summer? Bad threat actors are at it on 24/7 basis and do not take time off. Read our latest blog article on what your organization should be doing right now.

Summer is here — and while your staff rotates through PTO, cyber criminals are not. Ransomware gangs, phishing campaigns, and hacking groups operate 365 days a year, and the data confirms they are not taking July off. If...

Address

Fairfax County, VA
22009

Opening Hours

Monday 9am - 5pm
Tuesday 9am - 5pm
Wednesday 9am - 5pm
Thursday 9am - 5pm
Friday 9am - 5pm

Telephone

+18447407100

Website

Alerts

Be the first to know and let us send you an email when Colington Consulting posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category