Healthcare, dental, and veterinary groups
The risk analysis, an OCR investigation, the business associate agreement, and the cyber renewal. We know the paper each one arrives on.
What arrives
- The risk analysis, or the SRA
- HIPAA Security Rule risk analysis, 45 CFR 164.308(a)(1)(ii)(A). Enterprise-wide, and covering every location a group operates.
- OCR
- The HHS Office for Civil Rights Risk Analysis Initiative, opened October 2024, whose first test is whether a thorough risk analysis exists.
- The BAA
- The HIPAA Business Associate Agreement, 45 CFR 164.504(e), including the 60-day breach notification a business associate owes.
- The renewal
- The cyber-insurance renewal application. Multi-factor authentication across the practice management system and remote access, and a plan refreshed within twelve months.
What the Institute has found here
The Vigil LibraryInstitute
Email Spoofability Across Veterinary Practices
Field finding · June 2026
Read itInstitute
The Compliance Mirage: Why Regulatory Checkboxes Fail to Predict Breach Outcomes
Policy · June 2026
Read itInstitute
The Vendor as the Vector: Third-Party Risk Management Across Veterinary and Insurance Networks
Field notes · June 2026
Read itStart the conversation
A short, plain conversation about the outside view, with an advisor who knows the paper.