Joe Gellatly (@joegellatly)

@joegellatlyJoined April 2026

Co-founder at Medcurity, helping healthcare organizations achieve and maintain HIPAA compliance. Writing about healthcare cybersecurity, security risk analysis, and compliance automation.

@joegellatlyJoined April 2026

Co-founder at Medcurity, helping healthcare organizations achieve and maintain HIPAA compliance. Writing about healthcare cybersecurity, security risk analysis, and compliance automation.

Joe Gellatly

About

Available for

Joe Gellatly's blogs

Recently published

If You're a Healthcare Vendor, a Signed BAA Is the Start of Your HIPAA Job, Not the End

The Business Associate Inventory Nobody Keeps

HIPAA Compliance for Business Associates: What Vendors Handling PHI Need in 2026

SOC 2 Is Not HIPAA: Choosing Between Horizontal GRC and Healthcare-Native SRA

A Hospital HIPAA Risk Analysis Is Not an Evidence Scan: Why 45 CFR 164.310 Requires Someone Onsite

Joe Gellatly

About

Available for

Joe Gellatly's blogs

Recently published

If You're a Healthcare Vendor, a Signed BAA Is the Start of Your HIPAA Job, Not the End

The Business Associate Inventory Nobody Keeps

HIPAA Compliance for Business Associates: What Vendors Handling PHI Need in 2026

SOC 2 Is Not HIPAA: Choosing Between Horizontal GRC and Healthcare-Native SRA

A Hospital HIPAA Risk Analysis Is Not an Evidence Scan: Why 45 CFR 164.310 Requires Someone Onsite

Joe Gellatly

About

Available for

Joe Gellatly's blogs

Recently published

If You're a Healthcare Vendor, a Signed BAA Is the Start of Your HIPAA Job, Not the End

The Business Associate Inventory Nobody Keeps

HIPAA Compliance for Business Associates: What Vendors Handling PHI Need in 2026

SOC 2 Is Not HIPAA: Choosing Between Horizontal GRC and Healthcare-Native SRA

A Hospital HIPAA Risk Analysis Is Not an Evidence Scan: Why 45 CFR 164.310 Requires Someone Onsite

Search Hashnode

Joe Gellatly

About

Available for

Joe Gellatly's blogs

Recently published

If You're a Healthcare Vendor, a Signed BAA Is the Start of Your HIPAA Job, Not the End

The Business Associate Inventory Nobody Keeps

HIPAA Compliance for Business Associates: What Vendors Handling PHI Need in 2026

SOC 2 Is Not HIPAA: Choosing Between Horizontal GRC and Healthcare-Native SRA

A Hospital HIPAA Risk Analysis Is Not an Evidence Scan: Why 45 CFR 164.310 Requires Someone Onsite