Knowledge CenterFoundations

Foundations.

How HIPAA actually applies to your website. The definitions, penalty tiers, and controlling guidance every other article in the library refers back to.

4 articles

Foundations

What counts as PHI on your website

Protected health information isn't only the chart. OCR treats an IP plus a clinical-context URL as PHI — and a 2024 court ruling narrowed it less than most marketing teams realize.

5 min readRead

Foundations

The OCR Tracking Technologies Bulletin in 800 words

The OCR document that started the pixel-class-action wave. What it says, what AHA v. Becerra narrowed, and what still applies.

6 min readRead

Foundations

Authenticated vs. unauthenticated pages, and why your HIPAA risk depends on it

Patient portals, logged-in MyChart, mobile apps. The AHA v. Becerra carve-out doesn't touch any of them, and it's where the biggest pixel settlements live.

5 min readRead

Foundations

HIPAA penalty tiers, and how OCR decides what to fine you

The four-tier penalty structure under 45 CFR §160.404. From $137 per violation to $2.13M per year — and the three things that decide which tier OCR puts you in.

6 min readRead

See your own posture

Find what’s on your practice’s public surface in 60 seconds.

No script to install, no credentials to share. The same external scan an underwriter or plaintiff firm runs.

Browse all pillars