Healthcare Now & Next

Healthcare compliance is assessed by three different audiences who do not share notes.

HIPAA Readiness Accelerator — the whole HIPAA programme in 23 tabs: the Privacy Rule, Breach Notification and all three safeguard sets, plus the IoMT, telemedicine, clinical-AI, biometric and paediatric registers that generic templates never model.

HIPAA Security Rule 2027 Readiness Kit — the rule change: "addressable" disappearing, MFA and encryption becoming required, the asset inventory with a network map, 72-hour restoration, annual audits and business-associate verification. The proposed text has been public since January 2025 and OMB targets July 2027, so this is work you can start now that counts twice.

PCI DSS for Healthcare Kit — the payment side: the SAQ decision vendors keep getting wrong, the crosswalk that stops you running PCI and HIPAA as two programmes, the service-provider and business-associate register, and the dual clock when an incident touches PHI and cardholder data at once.

Why the three. Around 70% of PCI's controls are already the HIPAA Security Rule's, and the HIPAA proposed rule moves further toward PCI — required MFA, encryption, inventory and network map, patching windows, scans, annual verification. Run them as three programmes and you build the same control three times and evidence it three ways. Run them as one and each assessment is a different view of the same work.

The sequence is the point: the programme you have now, the rule that changes it, and the standard nobody in a health system expects to be assessed against until the acquirer asks.