Servicing all the devices across a large Midwest health system meant the IT team needed reliable endpoint management that improved efficiency.

3 Reasons Why FCC Behavioral Health Upgraded its Mobile Device Management

3 Reasons Why FCC Behavioral Health Upgraded its Mobile Device Management - Digital Health Insights

Home

Digital Health Insights is the healthcare industry’s most trusted source for data, analytics, and executive knowledge.

Digital Health Insights

https://dhix.dhinsights.org/wp-content/uploads/2022/02/dhi-logo-regular-mix.png

A leading regional provider with a complex network used a unified platform to bring together automation, reporting, and real-time monitoring.

How Blanchard Valley Transformed Healthcare IT Operations with a Unified Platform Approach

How Blanchard Valley Transformed Healthcare IT Operations with a Unified Platform Approach - Digital Health Insights

Identity for AI is the trust layer for the agentic era. This guide covers the frameworks, protocols, and governance models to get it right.

The Ultimate Guide to Identity for AI

The Ultimate Guide to Identity for AI - Digital Health Insights

Most enterprises aren't ready to govern AI agents. This brief tells you what AI readiness looks like and how to get there in 90 days.

Are You AI Ready?

Are You AI Ready? - Digital Health Insights

64 staff hours saved monthly. 82% ROI above $500K. Find out what separates high-performing healthcare AI Agent deployments from the rest.

2026 Healthcare AI Agent Benchmark Report

2026 Healthcare AI Agent Benchmark Report - Digital Health Insights

Explore this solution brief to learn how to reduce identity friction and speed time-to-care with passwordless access for clinical staff.

Tap-and-Login with Verified Trust: Modernizing Clinical Identity for Faster, Safer Care

Tap-and-Login with Verified Trust: Modernizing Clinical Identity for Faster, Safer Care - Digital Health Insights

Reduce healthcare security risk and costs with modern identity governance and automated access control.

Strengthening Healthcare Security and Reducing Costs Through Modern IGA

Strengthening Healthcare Security and Reducing Costs Through Modern IGA - Digital Health Insights

Learn how top organizations turn infrastructure into a strategic driver of modern care delivery and resilience beyond the data center.

Most Wired Strategic Intelligence Report: Infrastructure

Most Wired Strategic Intelligence Report: Infrastructure - Digital Health Insights

Discover how AI-powered communications help healthcare providers improve care, coordination, and patient satisfaction.

Transforming Patient Engagement with AI-Powered Communications

Transforming Patient Engagement with AI-Powered Communications - Digital Health Insights

Fragmented communication impacts patient care. Learn how FQHCs can modernize and improve outcomes with unified platforms.

Transforming Patient Care: How FQHCs Can Leverage Modern Communication Solutions

Transforming Patient Care: How FQHCs Can Leverage Modern Communication Solutions - Digital Health Insights

Gain valuable insights from Rubrik and leading healthcare organizations in this summit on building a robust cyber resilience framework.

Healthcare strikes back: Summit on cyber resilience and recovery

Healthcare strikes back: Summit on cyber resilience and recovery - Digital Health Insights

Hear about top threats, secure cloud migration strategies, and the importance of automation and employee training in this on-demand webinar.

Healthcare cybersecurity: Best practices and approaches (Webinar)

Healthcare cybersecurity: Best practices and approaches (Webinar) - Digital Health Insights

Webinar will review findings from the Cognizant 2023 Healthcare Provider Automation Survey and improving healthcare via automation and AI.

Beyond the Hype: Surprise Insights from the 2023 Healthcare Provider Automation Survey

Beyond the Hype: Surprise Insights from the 2023 Healthcare Provider Automation Survey - Digital Health Insights

Join this event to learn strategies to prepare for and respond to ransomware attacks, and hear insights from C-level healthcare leaders.

Webinar: Ransomware Preparedness for Healthcare: Enhancing Resilience Amid Growing Threats

Webinar: Ransomware Preparedness for Healthcare: Enhancing Resilience Amid Growing Threats - Digital Health Insights

Explore the growing efforts to enhance health equity through emerging technologies (techquity), and the effects on patient populations.

Webinar: How to Make Techquity a Reality

Webinar: How to Make Techquity a Reality - Digital Health Insights

This April 26 webinar will discuss how to prepare for an Epic data center upgrade and the case for high performance compute.

Webinar: Preparing for an EPIC upgrade

Webinar: Preparing for an EPIC upgrade - Digital Health Insights

Digital Transformation in healthcare will require some fundamental changes to cybersecurity in healthcare.

State of Cybersecurity in Healthcare Virtual Summit (On Demand)

State of Cybersecurity in Healthcare Virtual Summit (On Demand) - Digital Health Insights

Webinar on how Scripps Health is improving pop health and maximizing value in direct-to-employer arrangements through digital health.

Webinar: Digital Health Impact on Health System Employer Partnerships and Pop Health

Webinar: Digital Health Impact on Health System Employer Partnerships and Pop Health - Digital Health Insights

Experts from Deloitte and Google Fitbit will discuss the impact of technology advancements on early diagnostics and intervention.

Webinar: A wellness-first world: How early diagnostics and connected technology can shape the future of health

Webinar: A wellness-first world: How early diagnostics and connected technology can shape the future of health - Digital Health Insights

Health care leaders must consider digital inequity when making investments in digital consumer experience.

Webinar: How digital inequity will undermine health care consumer experience

Webinar: How digital inequity will undermine health care consumer experience - Digital Health Insights

The agent lied to developers to get malicious code approved and kept the act up until it ran out of tokens.

An AI agent faked identities and doctored its own history in a UK government safety test

Comment

An AI agent faked identities and doctored its own history in a UK government safety test - Digital Health Insights

https://secure.gravatar.com/avatar/aa42324f12904079e10641bb8ddfc1f70ab0e633b6ef0e65d4f52b31243ff0f4?s=96&d=mm&r=g

Pete Pappas

Doctors trusted an AI's patient classifications over their own evidence in two experiments — including one where the treatment did nothing at all.

Research suggests that doctors trust AI over evidence

Research suggests that doctors trust AI over evidence - Digital Health Insights

https://secure.gravatar.com/avatar/7142977f744eb740df152ef54ead95bd4719ca21b0f910df15b86a68d968a31e?s=96&d=mm&r=g

Richard Pallardy

Hackensack Meridian Health has become the first to earn the Joint Commission’s new certification aimed at demonstrating AI governance, safeguards, and use.

Hackensack Meridian earns first Joint Commission AI certification and says every tool gets traced like a hospital survey

Hackensack Meridian earns first Joint Commission AI certification and says every tool gets traced like a hospital survey - Digital Health Insights

https://secure.gravatar.com/avatar/779082e10ef3d2b24bc8e9c0428b01bcb904a659a3ba03554919bbfff12717bc?s=96&d=mm&r=g

Jennifer Bresnick

Shorter vendor contracts, pooled purchasing through the Ohio High Value Network, and a seat at the advocacy table: Linda Stevenson's plan for doing more with less.

How a rural Ohio health system is absorbing OBBBA's impact

How a rural Ohio health system is absorbing OBBBA&#8217;s impact

How a rural Ohio health system is absorbing OBBBA's impact - Digital Health Insights

https://secure.gravatar.com/avatar/18172c596718523f0c4bbe9ae4122841245197c9a3a03a77140851d04b0dab5f?s=96&d=mm&r=g

Kate Gamble

Abbott, Stryker, Intuitive, Medtronic and other medtech companies disclosed cyberattacks this year. None involved a device — and the pattern should reshape how hospitals assess vendor risk.

Medtech breaches keep hitting corporate IT, not devices — and that's a blind spot in hospital vendor risk

Medtech breaches keep hitting corporate IT, not devices — and that&#8217;s a blind spot in hospital vendor risk

Medtech breaches keep hitting corporate IT, not devices — and that's a blind spot in hospital vendor risk - Digital Health Insights

https://secure.gravatar.com/avatar/f34ba031cc2ebe143e7fb4aa7b7b7ed3b31f4de1d0d51d659c2c45e2a2a020d5?s=96&d=mm&r=g

Carrie Pallardy

As health care pushes forward with AI, lawsuits like this highlight the tension between innovation and oversight.

Whistleblower lawsuit claims Mayo Clinic's AI puts patient data, safety at risk

Whistleblower lawsuit claims Mayo Clinic&#8217;s AI puts patient data, safety at risk

Whistleblower lawsuit claims Mayo Clinic's AI puts patient data, safety at risk - Digital Health Insights

Google is integrating video analysis into its AI medical system to add audio and visual cues to its diagnostic processes.

What happens when AI diagnostic tools start hearing and seeing patients?

What happens when AI diagnostic tools start hearing and seeing patients? - Digital Health Insights

The Golden State’s Attorney General said the company violated laws prohibiting the corporate practice of medicine. Carbon Health faces fines and restructuring – and the settlement offers other reasons for caution.

How California’s Carbon Health ruling impacts MSOs, tech companies

How California’s Carbon Health ruling impacts MSOs, tech companies - Digital Health Insights

https://secure.gravatar.com/avatar/f36591cff0965852db21cb152a56c963405dfaee1dd23b0b7098c3fc0cd932ad?s=96&d=mm&r=g

Brian Eastwood

The agency wants clinical RPM services to be provided by health system employees. Experts say third-party providers should rethink their business models – and prepare their public comments.

CMS proposal to end third-party RPM puts vendors on their heels

CMS proposal to end third-party RPM puts vendors on their heels - Digital Health Insights

How do you move millions of clinical documents into Epic Gallery without a provider ever noticing? We go inside the engineering of a DMS migration built to stay invisible.

DMS migration at scale: Balancing speed with minimal patient care impact

DMS migration at scale: Balancing speed with minimal patient care impact - Digital Health Insights

https://secure.gravatar.com/avatar/c365a0fd44b0ce76bb91f544a3f837c38f8db4043bf2b2a0abbfbf3c1f914e05?s=96&d=mm&r=g

Davey Rowan

dhc_network

This article is part of a series, sponsored by Nexcess, examining the risks specialty practices face when AI and other IT implementations sit on infrastructure nobody is actively managing for compliance, security, or performance. This series names that gap, frames what it costs, and teaches leaders how to close it.

Your hosting contract probably says the environment supports HIPAA-regulated workloads. An auditor from the Office for Civil Rights won’t argue with that line, and won’t spend much time on it either. What they want is narrower and harder to produce: what a specific system held on a specific date, and who touched it along the way. A contract can’t answer that, so the answer has to come from the systems underneath it. 

That gap is hard to see during evaluation and procurement, because the compliance language on a vendor’s website rarely maps to anything an examiner can inspect. OCR wants evidence from the systems themselves, not from the paperwork describing them. 

OCR’s <a href="https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html">audit protocol</a> is organized by rule and provision, and every document request covers the version in use on the date of the audit notice. That reaches the Business Associate Agreement, the record of who held access to which system, and proof that the control was operating at the time. The Security Rule’s <a href="https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308">contingency plan standard</a> goes further, requiring retrievable exact copies of ePHI and procedures for testing the plan that produces them. 
<h2 aria-level="2">Moving from legal shield to operational proof </h2>
Many specialty networks treat a signed agreement with a hosting vendor as a legal shield that sits in a procurement file until something goes wrong. 

The practices that clear compliance reviews without drama treat the BAA as a baseline, backed by a matrix that says, system by system, who restores the patient portal database, who holds credentials to the digital intake storage, who rotates keys on the analytics warehouse, and who gets called when any of it fails on a Saturday night. 

During a review, a BAA without that matrix leaves a practice reconstructing ownership on the fly. The agreement allocates liability after a failure, but it can’t pull a verified system-state backup out of an unmanaged cloud environment when an examiner asks what the scheduling database held on the day of an incident. 

Audit defensibility lives in the storage architecture and in whether the recovery workflow has been tested recently enough to trust. 
<h2 aria-level="2">The shift toward active documentation standards </h2>
That expectation has widened as PHI has spread into patient portals, digital intake platforms, online scheduling, and remote monitoring tools sitting outside the clinical platform. When OCR settled <a href="https://www.hhs.gov/press-room/ocr-settles-four-ransomware-investigations.html">four ransomware investigations in April 2026</a>, covering more than 427,000 individuals and $1,165,000 in payments, the first item on its list of recommendations was identifying where ePHI sits, including how it enters, flows through, and leaves an organization’s systems. 

A policy manual describes intent, while the Security Rule’s <a href="https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312">audit controls standard</a> requires mechanisms that record and examine activity in the systems holding ePHI. On the ground that means knowing which identity accessed protected health information, when, from which network, and what they did with it once they had it. 

Producing those logs gets difficult on standard cloud hosting, where secondary storage and automated backups for every application land in the same pool. A practice in that arrangement can restore a server, but it can’t isolate what the intake form database held at 4:15 p.m. on the Tuesday an examiner is asking about, and that timestamp is usually the entire question. 
<h2 aria-level="2">Five diagnostic questions to test your infrastructure foundation </h2>
Five questions separate a hosting environment that supports <a href="https://www.nexcess.com/solutions/healthcare-hosting/">HIPAA-regulated workloads</a> from one that only says so in the contract. The same answers do double duty in a first SOC 2 or HITRUST review, where the assessor wants the operating artifact rather than the policy describing it. 
<ol>
 	<li aria-setsize="-1" data-leveltext="%1." data-font="Aptos" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;}" data-aria-posinset="1" data-aria-level="1">Responsibility Matrix Clarity: Does the provider explicitly state where their infrastructure management ends and your application security begins, including who’s responsible for configuring and verifying the daily backups of your edge databases? </li>
 	<li aria-setsize="-1" data-leveltext="%1." data-font="Aptos" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;}" data-aria-posinset="1" data-aria-level="1">Access Log Retention: How long are access logs from patient-facing intake systems retained, in what format do they export, and can a single date range be pulled for an examiner without a support ticket? </li>
 	<li aria-setsize="-1" data-leveltext="%1." data-font="Aptos" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;}" data-aria-posinset="1" data-aria-level="1">Operational BAA Depth: Does the agreement extend protections directly to the localized databases and backup environments orbiting the clinical platform?  </li>
 	<li aria-setsize="-1" data-leveltext="%1." data-font="Aptos" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;}" data-aria-posinset="1" data-aria-level="1">Audit-Season Support: Is there a dedicated team available to assist with technical documentation and to rapidly execute data restoration tests when an active review occurs? </li>
 	<li aria-setsize="-1" data-leveltext="%1." data-font="Aptos" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;}" data-aria-posinset="1" data-aria-level="1">System Portability: Can your compliance records and historical backup archives be migrated or reviewed without forcing a full clinical platform outage?  </li>
</ol>
Providers answer these five differently, which is the reason to ask them. <a href="https://www.nexcess.com/platform/nexcess-platform/">Nexcess</a> describes their managed environments as infrastructure that supports HIPAA-regulated workloads, and that phrasing deserves the same test as any other vendor’s: ask which of the five they can demonstrate rather than describe. 

Most practices learn these answers during the review itself, on a timeline the examiner sets. The alternative costs an ordinary Tuesday: run a restoration test against the systems holding PHI outside the clinical platform, time it, and write down what came back. That one test tells you what no contract can: whether a backup that exists is also a backup that works. 

<hr />
<a href="https://www.linkedin.com/in/michael-a-ohayon/"><img class=" wp-image-10603 alignleft" src="https://dhix.dhinsights.org/wp-content/uploads/2026/08/Michael-Ohayon-300x300.png" alt="" width="164" height="164" />Michael Ohayon</a> is a technology executive with 15+ years of experience scaling organizations from founder-led roots to mid-market enterprises in regulated industries. Known for operational discipline, he aligns mission-critical infrastructure with complex risk management and compliance frameworks. His background spans cloud infrastructure, cybersecurity, data resilience, and M&amp;A integration, guiding teams to optimize efficiency, compliance, and secure customer outcomes.<span class="EOP SCXW211244917 BCX0" data-ccp-props="{&quot;134245417&quot;:false,&quot;335572071&quot;:0,&quot;335572072&quot;:0,&quot;335572073&quot;:4278190080,&quot;335572075&quot;:0,&quot;335572076&quot;:0,&quot;335572077&quot;:4278190080,&quot;335572079&quot;:0,&quot;335572080&quot;:0,&quot;335572081&quot;:4278190080,&quot;335572083&quot;:0,&quot;335572084&quot;:0,&quot;335572085&quot;:4278190080,&quot;335572087&quot;:0,&quot;335572088&quot;:0,&quot;335572089&quot;:4278190080,&quot;469789798&quot;:&quot;none&quot;,&quot;469789802&quot;:&quot;none&quot;,&quot;469789806&quot;:&quot;none&quot;,&quot;469789810&quot;:&quot;none&quot;,&quot;469789814&quot;:&quot;none&quot;}">

“HIPAA compliant” is a claim. “Audit-defensible” is a storage capability. Here’s the difference.

Delivering actionable insights, analysis, and tactical information on the most pressing issues facing healthcare professionals.

Home - Digital Health Insights

OCR auditors want evidence from systems, not contracts. Five questions that test your provider's HIPAA-compliant hosting claims.

“HIPAA compliant” is a claim. “Audit-defensible” is a storage capability. Here’s the difference. - Digital Health Insights

https://secure.gravatar.com/avatar/14f1a353af42bd17a19edc37aa4db86f91dfc012b4f63087352e1ab6c1d03811?s=96&d=mm&r=g

“HIPAA compliant” is a claim. “Audit-defensible” is a storage capability. Here’s the difference.

3 Reasons Why FCC Behavioral Health Upgraded its Mobile Device Management

Are You AI Ready?

Explore Analytics

Resources

How Blanchard Valley Transformed Healthcare IT Operations with a Unified Platform Approach

The Ultimate Guide to Identity for AI

The Latest

Subscribe

Explore

REACH OUR AUDIENCE

Featured Topics