Joe Gellatly (@joegellatly)

@joegellatlyJoined April 2026

Co-founder at Medcurity, helping healthcare organizations achieve and maintain HIPAA compliance. Writing about healthcare cybersecurity, security risk analysis, and compliance automation.

@joegellatlyJoined April 2026

Co-founder at Medcurity, helping healthcare organizations achieve and maintain HIPAA compliance. Writing about healthcare cybersecurity, security risk analysis, and compliance automation.

Joe Gellatly

About

Available for

Joe Gellatly's blogs

Recently published

HIPAA Compliance for Business Associates: What Vendors Handling PHI Need in 2026

SOC 2 Is Not HIPAA: Choosing Between Horizontal GRC and Healthcare-Native SRA

A Hospital HIPAA Risk Analysis Is Not an Evidence Scan: Why 45 CFR 164.310 Requires Someone Onsite

Physical Safeguards Are in Scope for Your SRA. A Questionnaire Cannot Assess Them.

Multi-Site HIPAA Security Risk Analysis: One Engagement, Every Location

Joe Gellatly

About

Available for

Joe Gellatly's blogs

Recently published

HIPAA Compliance for Business Associates: What Vendors Handling PHI Need in 2026

SOC 2 Is Not HIPAA: Choosing Between Horizontal GRC and Healthcare-Native SRA

A Hospital HIPAA Risk Analysis Is Not an Evidence Scan: Why 45 CFR 164.310 Requires Someone Onsite

Physical Safeguards Are in Scope for Your SRA. A Questionnaire Cannot Assess Them.

Multi-Site HIPAA Security Risk Analysis: One Engagement, Every Location

Joe Gellatly

About

Available for

Joe Gellatly's blogs

Recently published

HIPAA Compliance for Business Associates: What Vendors Handling PHI Need in 2026

SOC 2 Is Not HIPAA: Choosing Between Horizontal GRC and Healthcare-Native SRA

A Hospital HIPAA Risk Analysis Is Not an Evidence Scan: Why 45 CFR 164.310 Requires Someone Onsite

Physical Safeguards Are in Scope for Your SRA. A Questionnaire Cannot Assess Them.

Multi-Site HIPAA Security Risk Analysis: One Engagement, Every Location

Search Hashnode

Joe Gellatly

About

Available for

Joe Gellatly's blogs

Recently published

HIPAA Compliance for Business Associates: What Vendors Handling PHI Need in 2026

SOC 2 Is Not HIPAA: Choosing Between Horizontal GRC and Healthcare-Native SRA

A Hospital HIPAA Risk Analysis Is Not an Evidence Scan: Why 45 CFR 164.310 Requires Someone Onsite

Physical Safeguards Are in Scope for Your SRA. A Questionnaire Cannot Assess Them.

Multi-Site HIPAA Security Risk Analysis: One Engagement, Every Location