HIPAA Compliance and Breach Communications: Helpful Tips for SMBs

On December 15, North Country Communications launched as a consultancy dedicated to helping small and mid-sized HIPAA-regulated entities comply with HIPAA’s privacy, security, and breach notification requirements, a move discussed in an interview with DataBreaches[.]net. The piece emphasises that business associates are often the weak link, and covered entities should retain responsibility for patient notifications, with the entity’s leadership signing letters to patients.

It notes that OCR has begun enforcement actions in initiatives such as the Right of Access Initiative, and that OCR’s enforcement emphasis has included a 54th action in its Right of Access Enforcement Initiative, highlighted by a December 2025 press release. The interview also warns that there is no government-recognised HIPAA certification or private seal, and that a vendor’s badge does not replace a covered entity’s own risk analysis and oversight.

Costs for SMBs to achieve compliance are broken down, with typical ranges for enterprise-wide risk analyses, security remediation, incident response planning, and annual training, and it is suggested that many SMBs spend roughly 3–7% of their operating budget on these requirements. Finally, the piece stresses plain-language breach communications and transparency, including the responsibility to disclose if patient data has been leaked on the dark web.