The Medcurity Podcast: HIPAA Compliance | Security | Technology | Healthcare

Finding a risk in your Security Risk Analysis is only half the job. The other half is fixing it, proving you fixed it, and closing the loop. This episode walks through the full lifecycle of a corrective action plan, from identifying the gap to building a remediation plan, assigning ownership, gathering proof, and formally closing it out. We also cover the common mistakes that stall progress or lea...

Small changes in legislative language can create major consequences for healthcare organizations. In this webinar recording, healthcare attorney and former Idaho legislator Luke Malek joins Kyle Rooks of the Idaho Community Health Center Association to discuss how new bills can shift compliance expectations, alter legal obligations, and create unintended operational challenges for providers. The c...

For years, the SRA measure under MIPS Promoting Interoperability was a single yes/no attestation. Did you conduct or review a Security Risk Analysis? Check. Done. Starting with the 2026 performance year, CMS added a second required attestation: did you conduct security risk management activities in accordance with the HIPAA Security Rule? A "no" on either attestation zeros out your entir...

Bidemi "Bid" Ologunde is a cybercrime and threat-intelligence specialist who spends his days in the middle of the conversations most organizations aren't having yet. He returns to the Medcurity Podcast for a wide-ranging conversation with Joe Gellatly on what's changed in the world of artificial intelligence.  Connect with Bid on LinkedIn: https://www.linkedin.com/in/bidemiologun...

Jeff Zimbalist, CEO and Founder of Applied Technology Solutions, has spent over 25 years in IT serving healthcare, education, and small business. In this webinar recording, he joins Medcurity to talk through what small practices are up against right now and where compliance gaps tend to show up when it counts. Connect with Jeff on LinkedIn: https://www.linkedin.com/in/jeff-zimbalist/ The session c...

Download Dr. Guess's free checklist, "The 5 HIPAA Operational Gaps That Lead to Breach Exposure": https://drive.google.com/file/d/1Ihgye3OhxdJGK9pFafEu-w4egYJJTKp0/view?usp=sharing Most compliance gaps don't start with a policy failure. They start with a workflow that drifted. Dr. Natasha Guess, founder of Guess Compliance Consulting, joins the podcast to discuss why small and mi...

The Security Risk Analysis is one of the most talked-about requirements in HIPAA, but it's also one of the most misunderstood. This episode breaks down what an SRA actually is, what it's meant to accomplish, and why regulators treat it as the foundation of every compliance program. If you've ever been unsure where to start or what "complete" really looks like, this is a good...

There isn’t a single checklist for compliance. There are three safeguard categories, and it’s not just a technology problem. HIPAA security involves people, processes, and the environment around your systems. This episode walks through what these categories mean and how they work together, the safeguards healthcare organizations are expected to have in place, and how to tell whether your organizat...

Most breaches don’t unfold the way people expect. The conversation covers common misconceptions about how incidents begin, what typically happens in the early response, and how teams can approach the situation more clearly when something does go wrong. If you’d like support completing or updating your Security Risk Analysis, our team is here to help: https://medcurity.com #Healthcare #Cybersecurit...

Physical safeguards don’t always get talked about as often as technical controls, but they show up consistently in our Security Risk Analysis walkthroughs. This episode looks at the physical side of HIPAA, how leadership perspective shapes day-to-day habits, and how small, intentional changes can reduce unnecessary exposure. It’s a reminder that what happens in the building matters just as much as...

AI is no longer theoretical in healthcare. It’s already shaping how organizations operate, make decisions, and support patients across clinical and operational environments. In this episode, Mel Nevala of Medcurity moderates a discussion with three healthcare leaders bringing different perspectives to AI adoption: Joe Gellatly, CEO of Medcurity, focused on compliance strategy and how AI intersects...

The most reliable compliance programs are the ones people actually use. In this episode, Mel Nevala, Margaret Karatzas, and Naseem Dastgerdi discuss what helps HIPAA and security habits stick across a team—without turning it into a constant fire drill. They get into personal privacy basics, where organizations usually get tripped up (especially with legacy systems), how teams are thinking about AI...

🎯 Special Podcast Offer: Get 20% off CyberHoot for 1 year using coupon code: ‘Medcurity’ Security training can sound straightforward until you're the one trying to get employees to actually care about it. Craig Taylor, Co-Founder and CEO of CyberHoot, joins the podcast to talk about why most cybersecurity training fails—and how to fix it. With nearly 30 years of experience managing risk acros...

Security testing can sound straightforward until you’re the one trying to prove it actually reflects reality. In this episode, the Medcurity team breaks down the difference between an NVA and penetration testing, why “we ran a test” isn’t the same as security validation, and the kinds of gaps that keep showing up when teams look at real environments.  We also share a simple way to think about cade...

Healthcare security issues rarely show up as one big failure. They surface in patterns—small gaps that repeat across organizations, workflows, and teams. In this episode, the Medcurity team shares what’s coming up most often in recent Security Risk Analysis walkthroughs and day-to-day conversations with healthcare organizations. The discussion covers recurring password issues, common breakdowns in...

AI is reshaping healthcare faster than most organizations are prepared for. In this episode, Daniel Schwartz and Joe Gellatly break down what 2025 revealed, where risk is increasing, and what leaders need to pay attention to right now. The original episode can be viewed here: https://www.youtube.com/watch?v=Wntp4jerVgc   Connect with Daniel Schwartz on LinkedIn: https://www.linkedin.com/in/daniel-...

Most security training satisfies compliance expectations, but it doesn’t always translate into safer day-to-day behavior. In this episode, Joe Gellatly talks with cybersecurity expert and private investigator Robert Siciliano about why awareness alone isn’t enough—and why security has to feel personal before it works at all. They discuss how everyday habits create real exposure, why fear-based tra...

Credentialing has long been one of the most inefficient and manual processes in healthcare. In this episode, Dylan Avatar , founder of Credential Network , joins the podcast to discuss why the industry struggles with speed and clarity—and how modern technology is changing that. Credential Network is a healthcare technology company focused on credentialing, compliance, and identity management. Its...

Cybercriminals target healthcare more than any other industry. We break down the reasons attackers focus their efforts here and the specific vulnerabilities they look for. This episode explores what that reality means for the leaders and teams working to protect patient data. Learn more about Medcurity here: https://medcurity.com #Cybersecurity #HealthcareSecurity #HIPAA #Ransomware #HealthcareIT...

If “getting hacked” feels like something that only happens after a big mistake, this webinar is a good reminder. A lot of exposure comes from normal habits: apps with bloated permissions, devices that share more than you think, and settings nobody touches after setup. This session stays practical and non-technical, with simple changes that cut down on spam, scams, and identity-theft risk without t...

Security improvements don’t always require new tools or long projects.    This episode focuses on six practical steps healthcare organizations can take right now to reduce exposure, strengthen everyday security habits, and avoid common gaps that show up during audits and investigations.    If you’re looking for ways to make progress without waiting for next quarter, this is a good place to start....

Have you ever wondered why documentation matters so much in HIPAA and cybersecurity? In this episode, we break down exactly what auditors expect to see, where most practices may go wrong, and how to create documentation that actually protects your organization. We keep this discussion straightforward—perfect if you don’t normally manage HIPAA or still find it a struggle. Walk away with a clear und...

A wide-ranging conversation from the NWRPCA/CHAMPS Annual Primary Care Conference, recorded live in Spokane. This session looks at how health centers are adopting AI today, what’s working on the ground, and where teams are running into challenges. The discussion covers ambient note-taking, revenue recovery tools, on-prem models, governance structures, vendor vetting, staff training, and the securi...

Take a quick look at why the annual Security Risk Analysis is still one of the most useful tools in healthcare. This episode walks through five practical reasons the SRA helps organizations stay organized, stay prepared, and keep their security work moving in the right direction. It also looks at how a solid SRA cuts out the uncertainty that usually surrounds compliance work. This episode touches...

There’s a big gap between organizations that walk confidently into an audit and those that scramble the moment OCR asks for documentation. This episode breaks down six practical steps that make the difference. You’ll hear about the quiet, everyday habits that keep HIPAA programs steady, defensible, and ready when it matters. Find out more about Medcurity here: https://medcurity.com #Healthcare #Cy...