Servicing all the devices across a large Midwest health system meant the IT team needed reliable endpoint management that improved efficiency.

3 Reasons Why FCC Behavioral Health Upgraded its Mobile Device Management

3 Reasons Why FCC Behavioral Health Upgraded its Mobile Device Management - Digital Health Insights

Home

Digital Health Insights is the healthcare industry’s most trusted source for data, analytics, and executive knowledge.

Digital Health Insights

https://dhix.dhinsights.org/wp-content/uploads/2022/02/dhi-logo-regular-mix.png

A leading regional provider with a complex network used a unified platform to bring together automation, reporting, and real-time monitoring.

How Blanchard Valley Transformed Healthcare IT Operations with a Unified Platform Approach

How Blanchard Valley Transformed Healthcare IT Operations with a Unified Platform Approach - Digital Health Insights

Identity for AI is the trust layer for the agentic era. This guide covers the frameworks, protocols, and governance models to get it right.

The Ultimate Guide to Identity for AI

The Ultimate Guide to Identity for AI - Digital Health Insights

Most enterprises aren't ready to govern AI agents. This brief tells you what AI readiness looks like and how to get there in 90 days.

Are You AI Ready?

Are You AI Ready? - Digital Health Insights

64 staff hours saved monthly. 82% ROI above $500K. Find out what separates high-performing healthcare AI Agent deployments from the rest.

2026 Healthcare AI Agent Benchmark Report

2026 Healthcare AI Agent Benchmark Report - Digital Health Insights

Explore this solution brief to learn how to reduce identity friction and speed time-to-care with passwordless access for clinical staff.

Tap-and-Login with Verified Trust: Modernizing Clinical Identity for Faster, Safer Care

Tap-and-Login with Verified Trust: Modernizing Clinical Identity for Faster, Safer Care - Digital Health Insights

Reduce healthcare security risk and costs with modern identity governance and automated access control.

Strengthening Healthcare Security and Reducing Costs Through Modern IGA

Strengthening Healthcare Security and Reducing Costs Through Modern IGA - Digital Health Insights

Learn how top organizations turn infrastructure into a strategic driver of modern care delivery and resilience beyond the data center.

Most Wired Strategic Intelligence Report: Infrastructure

Most Wired Strategic Intelligence Report: Infrastructure - Digital Health Insights

Discover how AI-powered communications help healthcare providers improve care, coordination, and patient satisfaction.

Transforming Patient Engagement with AI-Powered Communications

Transforming Patient Engagement with AI-Powered Communications - Digital Health Insights

Fragmented communication impacts patient care. Learn how FQHCs can modernize and improve outcomes with unified platforms.

Transforming Patient Care: How FQHCs Can Leverage Modern Communication Solutions

Transforming Patient Care: How FQHCs Can Leverage Modern Communication Solutions - Digital Health Insights

Gain valuable insights from Rubrik and leading healthcare organizations in this summit on building a robust cyber resilience framework.

Healthcare strikes back: Summit on cyber resilience and recovery

Healthcare strikes back: Summit on cyber resilience and recovery - Digital Health Insights

Hear about top threats, secure cloud migration strategies, and the importance of automation and employee training in this on-demand webinar.

Healthcare cybersecurity: Best practices and approaches (Webinar)

Healthcare cybersecurity: Best practices and approaches (Webinar) - Digital Health Insights

Webinar will review findings from the Cognizant 2023 Healthcare Provider Automation Survey and improving healthcare via automation and AI.

Beyond the Hype: Surprise Insights from the 2023 Healthcare Provider Automation Survey

Beyond the Hype: Surprise Insights from the 2023 Healthcare Provider Automation Survey - Digital Health Insights

Join this event to learn strategies to prepare for and respond to ransomware attacks, and hear insights from C-level healthcare leaders.

Webinar: Ransomware Preparedness for Healthcare: Enhancing Resilience Amid Growing Threats

Webinar: Ransomware Preparedness for Healthcare: Enhancing Resilience Amid Growing Threats - Digital Health Insights

Explore the growing efforts to enhance health equity through emerging technologies (techquity), and the effects on patient populations.

Webinar: How to Make Techquity a Reality

Webinar: How to Make Techquity a Reality - Digital Health Insights

This April 26 webinar will discuss how to prepare for an Epic data center upgrade and the case for high performance compute.

Webinar: Preparing for an EPIC upgrade

Webinar: Preparing for an EPIC upgrade - Digital Health Insights

Digital Transformation in healthcare will require some fundamental changes to cybersecurity in healthcare.

State of Cybersecurity in Healthcare Virtual Summit (On Demand)

State of Cybersecurity in Healthcare Virtual Summit (On Demand) - Digital Health Insights

Webinar on how Scripps Health is improving pop health and maximizing value in direct-to-employer arrangements through digital health.

Webinar: Digital Health Impact on Health System Employer Partnerships and Pop Health

Webinar: Digital Health Impact on Health System Employer Partnerships and Pop Health - Digital Health Insights

Experts from Deloitte and Google Fitbit will discuss the impact of technology advancements on early diagnostics and intervention.

Webinar: A wellness-first world: How early diagnostics and connected technology can shape the future of health

Webinar: A wellness-first world: How early diagnostics and connected technology can shape the future of health - Digital Health Insights

Health care leaders must consider digital inequity when making investments in digital consumer experience.

Webinar: How digital inequity will undermine health care consumer experience

Webinar: How digital inequity will undermine health care consumer experience - Digital Health Insights

How do you move millions of clinical documents into Epic Gallery without a provider ever noticing? We go inside the engineering of a DMS migration built to stay invisible.

DMS migration at scale: Balancing speed with minimal patient care impact

Comment

DMS migration at scale: Balancing speed with minimal patient care impact - Digital Health Insights

https://secure.gravatar.com/avatar/c365a0fd44b0ce76bb91f544a3f837c38f8db4043bf2b2a0abbfbf3c1f914e05?s=96&d=mm&r=g

Davey Rowan

Medicare is moving to pay directly for algorithmic clinical work, while bedside nursing is still booked at cost, leaving some nurses concerned about unfavorable staffing incentives.

New billing codes would let hospitals charge for clinical AI analysis, raising concerns from nurses

New billing codes would let hospitals charge for clinical AI analysis, raising concerns from nurses - Digital Health Insights

https://secure.gravatar.com/avatar/aa42324f12904079e10641bb8ddfc1f70ab0e633b6ef0e65d4f52b31243ff0f4?s=96&d=mm&r=g

Pete Pappas

The average cost of a healthcare data breach is $6.64 million, according to a new report from IBM.

Healthcare breaches are still the most expensive of any industry

Healthcare breaches are still the most expensive of any industry - Digital Health Insights

https://secure.gravatar.com/avatar/f34ba031cc2ebe143e7fb4aa7b7b7ed3b31f4de1d0d51d659c2c45e2a2a020d5?s=96&d=mm&r=g

Carrie Pallardy

Physicians see value in consumer wearable data, but health systems lack the workflows, payment pathways, and liability protections to make it work.

What's keeping wearable data out of care? Not doctors, a new AMA survey finds

What&#8217;s keeping wearable data out of care? Not doctors, a new AMA survey finds

What's keeping wearable data out of care? Not doctors, a new AMA survey finds - Digital Health Insights

A proposed 2027 rule would cut off Medicare payment for outsourced RPM. Systems built on vendors have until Jan. 1 to rethink the model.

CMS proposed rule would end vendor-run remote monitoring. Here's what breaks for health systems.

CMS proposed rule would end vendor-run remote monitoring. Here&#8217;s what breaks for health systems.

CMS proposed rule would end vendor-run remote monitoring. Here's what breaks for health systems. - Digital Health Insights

Colorado's HB26-1195 takes effect August 12, joining a wave of state laws that welcome AI for administrative work and bar it from clinical judgment.

Mental healthcare is becoming the proving ground for AI regulation

Mental healthcare is becoming the proving ground for AI regulation - Digital Health Insights

https://secure.gravatar.com/avatar/779082e10ef3d2b24bc8e9c0428b01bcb904a659a3ba03554919bbfff12717bc?s=96&d=mm&r=g

Jennifer Bresnick

Explanations are supposed to increase transparency, but their very existence may be overly persuasive to users.

When AI explains itself, does it help or hurt clinical decision-making?

When AI explains itself, does it help or hurt clinical decision-making? - Digital Health Insights

The AI arriving through the front door gets a committee. The AI switching on inside the ERP doesn't. Health IT leaders in LA argued that's about to redefine what a vendor partnership is.

Health systems stood up AI governance for launch. Now comes the art of maintenance.

Health systems stood up AI governance for launch. Now comes the art of maintenance. - Digital Health Insights

A new report from Mozilla Foundation reveals how data privacy varies among six different period tracking apps.

Mozilla report reveals wide privacy gaps among popular period tracking apps

Mozilla report reveals wide privacy gaps among popular period tracking apps - Digital Health Insights

From ambient capture to coding support, AI scribes are becoming clinical care partners — if health systems choose wisely.

Beyond dictation: Why health systems are rethinking the AI scribe

Beyond dictation: Why health systems are rethinking the AI scribe - Digital Health Insights

Dr. Cibotti is a primary care physician with extensive experience in healthcare leadership and innovation. She received her undergraduate degree from Harvard and medical degree at Brown University. After her primary care residency at New York Hospital she returned to Boston and spent 20 years at Massachusetts General Hospital and on the teaching faculty at Harvard Medical School. Subsequently, Dr Cibotti joined Iora Health where she served as the Market Medical Director and opened 2 new primary care practices serving the needs of frail elders. In the past 8 years, she has held multiple roles at Beth Israel Lahey Health including Chief Innovation Officer of Primary Care and Associate Chief Medical Information Officer. Her accomplishments include launching BILH’s virtual primary care program, implementing ambient AI scribes and helping to lead a system wide Epic implementation. In January 2026, Dr. Cibotti joined Heidi Health as the US based Chief Medical Information Officer.

https://secure.gravatar.com/avatar/e702f6f4fe19d44cce4974d7b0b1bdf2356ca9047bd8714bf63292b7618e55ef?s=96&d=mm&r=g

Nancy Cibotti, MD

dhc_network

This article is part of a series, sponsored by Nexcess, examining the risks specialty practices face when AI and other IT implementations sit on infrastructure nobody is actively managing for compliance, security, or performance. This series names that gap, frames what it costs, and teaches leaders how to close it.

Your hosting contract probably says the environment supports HIPAA-regulated workloads. An auditor from the Office for Civil Rights won’t argue with that line, and won’t spend much time on it either. What they want is narrower and harder to produce: what a specific system held on a specific date, and who touched it along the way. A contract can’t answer that, so the answer has to come from the systems underneath it. 

That gap is hard to see during evaluation and procurement, because the compliance language on a vendor’s website rarely maps to anything an examiner can inspect. OCR wants evidence from the systems themselves, not from the paperwork describing them. 

OCR’s <a href="https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html">audit protocol</a> is organized by rule and provision, and every document request covers the version in use on the date of the audit notice. That reaches the Business Associate Agreement, the record of who held access to which system, and proof that the control was operating at the time. The Security Rule’s <a href="https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308">contingency plan standard</a> goes further, requiring retrievable exact copies of ePHI and procedures for testing the plan that produces them. 
<h2 aria-level="2">Moving from legal shield to operational proof </h2>
Many specialty networks treat a signed agreement with a hosting vendor as a legal shield that sits in a procurement file until something goes wrong. 

The practices that clear compliance reviews without drama treat the BAA as a baseline, backed by a matrix that says, system by system, who restores the patient portal database, who holds credentials to the digital intake storage, who rotates keys on the analytics warehouse, and who gets called when any of it fails on a Saturday night. 

During a review, a BAA without that matrix leaves a practice reconstructing ownership on the fly. The agreement allocates liability after a failure, but it can’t pull a verified system-state backup out of an unmanaged cloud environment when an examiner asks what the scheduling database held on the day of an incident. 

Audit defensibility lives in the storage architecture and in whether the recovery workflow has been tested recently enough to trust. 
<h2 aria-level="2">The shift toward active documentation standards </h2>
That expectation has widened as PHI has spread into patient portals, digital intake platforms, online scheduling, and remote monitoring tools sitting outside the clinical platform. When OCR settled <a href="https://www.hhs.gov/press-room/ocr-settles-four-ransomware-investigations.html">four ransomware investigations in April 2026</a>, covering more than 427,000 individuals and $1,165,000 in payments, the first item on its list of recommendations was identifying where ePHI sits, including how it enters, flows through, and leaves an organization’s systems. 

A policy manual describes intent, while the Security Rule’s <a href="https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312">audit controls standard</a> requires mechanisms that record and examine activity in the systems holding ePHI. On the ground that means knowing which identity accessed protected health information, when, from which network, and what they did with it once they had it. 

Producing those logs gets difficult on standard cloud hosting, where secondary storage and automated backups for every application land in the same pool. A practice in that arrangement can restore a server, but it can’t isolate what the intake form database held at 4:15 p.m. on the Tuesday an examiner is asking about, and that timestamp is usually the entire question. 
<h2 aria-level="2">Five diagnostic questions to test your infrastructure foundation </h2>
Five questions separate a hosting environment that supports <a href="https://www.nexcess.com/solutions/healthcare-hosting/">HIPAA-regulated workloads</a> from one that only says so in the contract. The same answers do double duty in a first SOC 2 or HITRUST review, where the assessor wants the operating artifact rather than the policy describing it. 
<ol>
 	<li aria-setsize="-1" data-leveltext="%1." data-font="Aptos" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;}" data-aria-posinset="1" data-aria-level="1">Responsibility Matrix Clarity: Does the provider explicitly state where their infrastructure management ends and your application security begins, including who’s responsible for configuring and verifying the daily backups of your edge databases? </li>
 	<li aria-setsize="-1" data-leveltext="%1." data-font="Aptos" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;}" data-aria-posinset="1" data-aria-level="1">Access Log Retention: How long are access logs from patient-facing intake systems retained, in what format do they export, and can a single date range be pulled for an examiner without a support ticket? </li>
 	<li aria-setsize="-1" data-leveltext="%1." data-font="Aptos" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;}" data-aria-posinset="1" data-aria-level="1">Operational BAA Depth: Does the agreement extend protections directly to the localized databases and backup environments orbiting the clinical platform?  </li>
 	<li aria-setsize="-1" data-leveltext="%1." data-font="Aptos" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;}" data-aria-posinset="1" data-aria-level="1">Audit-Season Support: Is there a dedicated team available to assist with technical documentation and to rapidly execute data restoration tests when an active review occurs? </li>
 	<li aria-setsize="-1" data-leveltext="%1." data-font="Aptos" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;}" data-aria-posinset="1" data-aria-level="1">System Portability: Can your compliance records and historical backup archives be migrated or reviewed without forcing a full clinical platform outage?  </li>
</ol>
Providers answer these five differently, which is the reason to ask them. <a href="https://www.nexcess.com/platform/nexcess-platform/">Nexcess</a> describes their managed environments as infrastructure that supports HIPAA-regulated workloads, and that phrasing deserves the same test as any other vendor’s: ask which of the five they can demonstrate rather than describe. 

Most practices learn these answers during the review itself, on a timeline the examiner sets. The alternative costs an ordinary Tuesday: run a restoration test against the systems holding PHI outside the clinical platform, time it, and write down what came back. That one test tells you what no contract can: whether a backup that exists is also a backup that works. 

<hr />
<a href="https://www.linkedin.com/in/michael-a-ohayon/"><img class=" wp-image-10603 alignleft" src="https://dhix.dhinsights.org/wp-content/uploads/2026/08/Michael-Ohayon-300x300.png" alt="" width="164" height="164" />Michael Ohayon</a> is a technology executive with 15+ years of experience scaling organizations from founder-led roots to mid-market enterprises in regulated industries. Known for operational discipline, he aligns mission-critical infrastructure with complex risk management and compliance frameworks. His background spans cloud infrastructure, cybersecurity, data resilience, and M&amp;A integration, guiding teams to optimize efficiency, compliance, and secure customer outcomes.<span class="EOP SCXW211244917 BCX0" data-ccp-props="{&quot;134245417&quot;:false,&quot;335572071&quot;:0,&quot;335572072&quot;:0,&quot;335572073&quot;:4278190080,&quot;335572075&quot;:0,&quot;335572076&quot;:0,&quot;335572077&quot;:4278190080,&quot;335572079&quot;:0,&quot;335572080&quot;:0,&quot;335572081&quot;:4278190080,&quot;335572083&quot;:0,&quot;335572084&quot;:0,&quot;335572085&quot;:4278190080,&quot;335572087&quot;:0,&quot;335572088&quot;:0,&quot;335572089&quot;:4278190080,&quot;469789798&quot;:&quot;none&quot;,&quot;469789802&quot;:&quot;none&quot;,&quot;469789806&quot;:&quot;none&quot;,&quot;469789810&quot;:&quot;none&quot;,&quot;469789814&quot;:&quot;none&quot;}">

“HIPAA compliant” is a claim. “Audit-defensible” is a storage capability. Here’s the difference.

Delivering actionable insights, analysis, and tactical information on the most pressing issues facing healthcare professionals.

Home - Digital Health Insights

OCR auditors want evidence from systems, not contracts. Five questions that test your provider's HIPAA-compliant hosting claims.

“HIPAA compliant” is a claim. “Audit-defensible” is a storage capability. Here’s the difference. - Digital Health Insights

https://secure.gravatar.com/avatar/14f1a353af42bd17a19edc37aa4db86f91dfc012b4f63087352e1ab6c1d03811?s=96&d=mm&r=g

“HIPAA compliant” is a claim. “Audit-defensible” is a storage capability. Here’s the difference.

3 Reasons Why FCC Behavioral Health Upgraded its Mobile Device Management

Are You AI Ready?

Explore Analytics

Resources

How Blanchard Valley Transformed Healthcare IT Operations with a Unified Platform Approach

The Ultimate Guide to Identity for AI

The Latest

Subscribe

Explore

REACH OUR AUDIENCE

Featured Topics