Joe Gellatly (@joegellatly)

@joegellatlyJoined April 2026

Co-founder at Medcurity, helping healthcare organizations achieve and maintain HIPAA compliance. Writing about healthcare cybersecurity, security risk analysis, and compliance automation.

@joegellatlyJoined April 2026

Co-founder at Medcurity, helping healthcare organizations achieve and maintain HIPAA compliance. Writing about healthcare cybersecurity, security risk analysis, and compliance automation.

Joe Gellatly

About

Available for

Joe Gellatly's blogs

Recently published

A Hospital HIPAA Risk Analysis Is Not an Evidence Scan: Why 45 CFR 164.310 Requires Someone Onsite

Physical Safeguards Are in Scope for Your SRA. A Questionnaire Cannot Assess Them.

Multi-Site HIPAA Security Risk Analysis: One Engagement, Every Location

The 2026 HIPAA Risk Assessment Pattern for Healthcare APIs

Building a BAA Inventory System That Holds Up Under a 2026 HIPAA Audit

Joe Gellatly

About

Available for

Joe Gellatly's blogs

Recently published

A Hospital HIPAA Risk Analysis Is Not an Evidence Scan: Why 45 CFR 164.310 Requires Someone Onsite

Physical Safeguards Are in Scope for Your SRA. A Questionnaire Cannot Assess Them.

Multi-Site HIPAA Security Risk Analysis: One Engagement, Every Location

The 2026 HIPAA Risk Assessment Pattern for Healthcare APIs

Building a BAA Inventory System That Holds Up Under a 2026 HIPAA Audit

Joe Gellatly

About

Available for

Joe Gellatly's blogs

Recently published

A Hospital HIPAA Risk Analysis Is Not an Evidence Scan: Why 45 CFR 164.310 Requires Someone Onsite

Physical Safeguards Are in Scope for Your SRA. A Questionnaire Cannot Assess Them.

Multi-Site HIPAA Security Risk Analysis: One Engagement, Every Location

The 2026 HIPAA Risk Assessment Pattern for Healthcare APIs

Building a BAA Inventory System That Holds Up Under a 2026 HIPAA Audit

Search Hashnode

Joe Gellatly

About

Available for

Joe Gellatly's blogs

Recently published

A Hospital HIPAA Risk Analysis Is Not an Evidence Scan: Why 45 CFR 164.310 Requires Someone Onsite

Physical Safeguards Are in Scope for Your SRA. A Questionnaire Cannot Assess Them.

Multi-Site HIPAA Security Risk Analysis: One Engagement, Every Location

The 2026 HIPAA Risk Assessment Pattern for Healthcare APIs

Building a BAA Inventory System That Holds Up Under a 2026 HIPAA Audit