Healthcare Compliance for Chicago Practices & Organizations

Patient trust is built over years and can be lost in a single breach. HIPAA turns that trust into specific duties, and the federal Office for Civil Rights (OCR) investigates complaints and breach reports, reaches settlements, imposes penalties and publishes the results. Illinois adds its own confidentiality, breach and biometric statutes. Lincoln Square Law serves as healthcare compliance counsel to Chicago practices and organizations, and our role is to help you build a program that holds up when a regulator, a payer or a patient asks to see it, without slowing care or growth.

Healthcare compliance beyond HIPAA

HIPAA is an important part of healthcare compliance, but it is not the whole framework. A practice also has to coordinate professional licensure, state confidentiality rules, data security, vendor contracts, telehealth, records, employment and the structure of the practice itself. We organize those duties into one operating program instead of treating each rule as a separate checklist.

Ownership, entity and licensing questions are covered on our pages for dental practices, physician practices, behavioral health practices and other IDFPR-licensed professionals. If you are opening a new practice, start with our healthcare practice startup page.

What the HIPAA rules require

HIPAA applies to a health care provider that transmits health information electronically in connection with a standard transaction such as an insurance claim, and to the business associates that handle protected health information for that provider (45 C.F.R. 160.103). Three rules do most of the work.

• The Privacy Rule (45 C.F.R. Part 164, Subpart E) governs when protected health information may be used and disclosed. It also requires a designated privacy official, written policies, workforce training and a notice of privacy practices (45 C.F.R. 164.530, 164.520).
• The Security Rule (Subpart C) requires administrative, physical and technical safeguards for electronic protected health information. It begins with an accurate and thorough risk analysis (45 C.F.R. 164.308(a)(1)(ii)(A)) and continues with risk management, a named security official, security training, incident procedures, a contingency plan and periodic evaluation.
• The Breach Notification Rule (Subpart D) sets out who must be told, and by when, after unsecured protected health information is compromised.

A rule cannot be applied to information nobody has located. OCR’s own guidance to regulated entities starts with identifying where electronic protected health information sits and how it enters, moves through and leaves the organization’s systems. We begin there as well: what the practice collects, where it is stored, which staff roles can see it and which vendors receive it. A tool described internally as a scheduling system often turns out to hold messages, recordings or patient identifiers too.

HHS proposed a broad revision of the Security Rule in January 2025 (90 Fed. Reg. 898, proposed). As of this writing the proposal has not been made final, the federal regulatory agenda lists it as a long-term action, and the current rule remains in effect. Our recommendation is to close gaps under the current rule first, because those are the requirements OCR enforces today.

Illinois law that applies alongside HIPAA

HIPAA is a floor, not a ceiling. Four Illinois statutes change what a compliant program looks like here.

• Mental health records. Under the Mental Health and Developmental Disabilities Confidentiality Act, records and communications may be disclosed only with a written consent that contains the elements the statute lists, unless one of its exceptions applies (740 ILCS 110/5). A person aggrieved by a violation may sue (740 ILCS 110/15). Practices that add behavioral health services need consent forms and release procedures written to this Act, not only to HIPAA.
• Breach notice to the Attorney General. A covered entity or business associate that complies with the HIPAA privacy and security standards is deemed to comply with the Personal Information Protection Act, provided that it sends the Illinois Attorney General its breach notification within 5 business days of notifying the Secretary of HHS (815 ILCS 530/50).
• Biometric timeclocks. The Biometric Information Privacy Act excludes information captured from a patient in a health care setting (740 ILCS 14/10), so the usual exposure is the workforce. Before collecting an employee’s fingerprint or face scan, a practice needs a written retention and destruction policy, written notice of the purpose and duration, and a written release (740 ILCS 14/15(a), (b)). The Act provides a private right of action with liquidated damages (740 ILCS 14/20).
• Genetic test results. The Genetic Information Privacy Act makes genetic testing information confidential (410 ILCS 513/15). It lets a HIPAA covered entity use it for treatment, payment and health care operations and share it with a business associate under a compliant agreement (410 ILCS 513/31, 513/31.3), and it gives patients a private right of action (410 ILCS 513/40). It matters to practices that order or store genetic tests.

Business associate agreements

A vendor that creates, receives, maintains or transmits protected health information on your behalf is a business associate. Common examples are a billing company, a cloud or records platform, an IT contractor and an outside accountant or consultant who sees patient data (45 C.F.R. 160.103). You may share information with a business associate only after obtaining satisfactory assurances in a written agreement that meets the regulation (45 C.F.R. 164.502(e), 164.504(e)). The required terms include limits on use and disclosure, safeguards, reporting of breaches, the same restrictions for subcontractors, support for patient access and amendment rights, and return or destruction of the information when the contract ends.

Not every outside party is a business associate. Another health care provider that receives information to treat the patient, such as a specialist, a clinical laboratory or a dental laboratory filling a prescription, is not one for that purpose, and the disclosure is permitted as a treatment disclosure (45 C.F.R. 160.103, 164.506(c)(2)). If the same laboratory also performs a service for the practice that is not treatment, that service needs an agreement.

A signed agreement is not the end of vendor diligence. We compare the document to the product you are using: what data the vendor receives, whether subcontractors are involved, how quickly incidents are reported, who controls deletion, and whether the vendor claims a right to use patient information for its own purposes. If you learn of a pattern of activity that materially breaches the agreement, the rule expects reasonable steps to cure it and, if those fail, termination where feasible (45 C.F.R. 164.504(e)(1)(ii)).

Responding to a suspected breach

An impermissible use or disclosure of unsecured protected health information is presumed to be a breach unless the practice can show a low probability that the information was compromised. That showing rests on a documented assessment of four factors: the nature and extent of the information, who received it, whether it was actually acquired or viewed, and how far the risk has been mitigated (45 C.F.R. 164.402). The practice carries the burden of proof (45 C.F.R. 164.414(b)).

The deadlines run from discovery, which is the first day the breach is known or would have been known with reasonable diligence (45 C.F.R. 164.404(a)(2)).

• Affected individuals: notice without unreasonable delay and no later than 60 calendar days after discovery (45 C.F.R. 164.404(b)).
• HHS: for a breach involving 500 or more individuals, at the same time as the individual notices. Smaller breaches are logged and reported no later than 60 days after the end of the calendar year (45 C.F.R. 164.408).
• Media: when more than 500 residents of one state are affected (45 C.F.R. 164.406).
• Business associates: a vendor must notify the practice without unreasonable delay and no later than 60 calendar days after it discovers a breach (45 C.F.R. 164.410). We recommend a much shorter period in the contract, because your own clock may already be running.
• Illinois Attorney General: within 5 business days of the notice to HHS (815 ILCS 530/50).

The first days are spent containing the exposure, preserving logs and messages, and recording each decision. We help practices do that in writing and in order.

How we work with your organization

Abdul Kadir Mohamed, the firm’s founding attorney, has served as in-house general counsel and privacy officer for multi-site healthcare organizations operating under an MSO/PC structure. He is licensed in Illinois and Missouri, holds a J.D. with a Health Law Certificate from Saint Louis University School of Law, and is certified in healthcare compliance and healthcare privacy compliance (CHC, CHPC). That background shapes the work: a policy that staff cannot follow on a normal workday is not a useful policy.

Most engagements include some combination of the following, as a defined project or on a monthly retainer.

• A risk analysis review and a written remediation plan with owners and dates.
• Privacy, security and breach policies fitted to how the practice works, and training built on them.
• A business associate inventory, with review and negotiation of the agreements.
• Incident response and breach analysis, including the notices described above.
• Preparation for an OCR inquiry and help answering one.
• Compliance for MSO/PC structures and ongoing counsel as questions come up.

Common questions about HIPAA and healthcare compliance

We are small. Does HIPAA really apply to us?

Almost certainly. The definition of a covered entity turns on whether a provider transmits health information electronically in connection with a standard transaction, not on headcount or revenue (45 C.F.R. 160.103). OCR’s published enforcement actions include small practices.

Is buying “HIPAA-compliant” software enough?

No. HIPAA regulates how your organization uses a tool: your risk analysis, policies, training and agreements. Software is one part of the program. A vendor that holds patient information also needs a business associate agreement, whatever its marketing says.

Do we need a business associate agreement with our laboratory?

Not for treatment. A clinical or dental laboratory that receives patient information to perform a test or make an appliance on your order is acting as a health care provider, and HHS guidance says a physician is not required to have a business associate contract with a laboratory for that purpose. An agreement is needed only if the laboratory also does work for the practice that is not treatment.

How long do we have to notify patients after a breach?

Without unreasonable delay, and never later than 60 calendar days after discovery (45 C.F.R. 164.404(b)). Sixty days is the outer limit, so a practice that has the facts sooner is expected to send notice sooner. Illinois adds the Attorney General notice described above.

How often should the risk analysis be updated?

The current rule sets no fixed interval. It requires periodic evaluation of your safeguards (45 C.F.R. 164.308(a)(8)). Our recommendation is a review every year and whenever something significant changes, such as a new records system, a new location, a new vendor with access to patient data, or a security incident.

Related resources

General information only; not legal advice and does not create an attorney-client relationship.