Is Your Practice Really HIPAA Compliant? A Real Talk – a Special SNACK Episode, EP 284
Ninety-eight percent of small healthcare practices believe they're HIPAA compliant. Far fewer actually are — and that gap tends to sit quietly until an audit, a complaint, or a data breach forces it open.
In this SNACK episode of The Thriving Practice Podcast, Miranda Dorta turns the mic on Tracy Cherpeski for an unscripted conversation about the compliance question providers ask quietly, long after everything else has been covered: How do I actually know if I'm in compliance?
This isn't a deep technical breakdown of HIPAA rules — it's a real talk about why so many independent practice owners wait until something goes wrong to ask about compliance, where the most common blind spots hide, and a simple, low-cost first step any practice can take today.
Key Takeaways
“No news is good news” is a risky mindset. Many providers assume they're covered simply because nothing has gone wrong yet — not because they've verified it.
Patient communications are a common blind spot. Providers are most likely to assume they're covered here when they haven't actually confirmed it.
The stakes are real. A breach can mean a lawsuit, reputational damage, or in a worst-case scenario, the practice itself.
Don't wait for the audit. Regular self-audits — not reactive fixes — are the better bet, especially for smaller-scale practices.
You don't need to overspend to get started. A simple system (like Google Alerts for regulatory changes) or one consultation with a specialist can be enough to close the gap.
Q&A
How do I know if my practice is actually HIPAA compliant?
Tracy says this is the question she hears most often, quietly, after everything else has been discussed. Her answer: if you're not sure, “get sure” — start by identifying where not knowing carries the highest risk.
Why do so many practice owners wait until something goes wrong to look into compliance?
Tracy points to a “no news is good news” mindset — providers assume that because nothing bad has happened, they must be covered, rather than actively verifying it.
Where do practices most often assume they're covered but aren't?
Patient communications, according to Tracy — an area that's easy to overlook until it becomes a problem.
What's a low-cost first step for a provider who's worried about compliance?
Setting up something as simple as Google Alerts to track regulatory changes in their state. If that raises real concerns, the next step is talking to a compliance professional directly.
Episode Highlights
The compliance question Tracy hears most often — and why providers ask it quietly
Why “no news is good news” isn't actually a compliance strategy
The real financial and legal risk of getting compliance wrong
Reference to a prior episode on proactive self-audits (guest name pending verification)
When to DIY compliance tracking vs. bring in a specialist
Payer agreements named as another high-risk blind spot
A simple, low-cost way to start closing the gap today
Memorable Quotes
“We're doing everything we can, or we're trying to stay on top of things... so it must be no news is good news.” — Tracy Cherpeski
“It's really important to be sure. Better safe than sorry.” — Tracy Cherpeski
“It's not like you have to pour your life savings into having a consultation with somebody who can give you some insights.” — Tracy Cherpeski
“If you don't know what to do with it, that's a whole nother area.” — Tracy Cherpeski
You don't have to wait for an audit, a complaint, or a breach to find out where you stand. A quick self-check — or one conversation with the right professional — can close the gap between thinking you're compliant and knowing you are. If this hit close to home, visit practicesuccess.co to schedule a consultation, or thrivingpracticecommunity.com to learn more about the community.
Miranda’s Bio:
Miranda Dorta, B.F.A. (she/her/hers) is the Manager of Operations and PR at Tracy Cherpeski International. A graduate of Savannah College of Art and Design with expertise in writing and creative storytelling, Miranda brings her skills in operations, public relations, and communication strategies to the Thriving Practice community. Based in the City of Oaks, she joined the team in 2021 and has been instrumental in streamlining operations while managing the company's public presence since 2022.
Tracy’s Bio:
Tracy Cherpeski, MBA, MA, CPSC (she/her/hers) is the Founder of Tracy Cherpeski International and Thriving Practice Community. As a Business Consultant and Executive Coach, Tracy helps healthcare practice owners scale their businesses without sacrificing wellbeing. Through strategic planning, leadership development, and mindset mastery, she empowers clients to reclaim their time and reach their potential. Tracy designs and delivers CME-accredited wellness retreats and workshops in partnership with medical associations, bringing burnout prevention and sustainable practice management to physicians nationwide. Based in Chapel Hill, NC, Tracy serves clients worldwide and is the Executive Producer and Host of the Thriving Practice podcast. Her guiding philosophy: Survival is not enough; life is meant to be celebrated.
Connect With Us: