--- title: "Joe Gellatly (@joegellatly) | Hashnode" description: "HIPAA compliance and healthcare cybersecurity. Co-founder at Medcurity. Read the latest articles by Joe Gellatly on Hashnode." url: "https://hashnode.com/@joegellatly" --- @joegellatly # Joe Gellatly @joegellatly · Joined April 2026 HIPAA compliance and healthcare cybersecurity. Co-founder at Medcurity. ### [If You're a Healthcare Vendor, a Signed BAA Is the Start of Your HIPAA Job, Not the End](https://medcurity.hashnode.dev/if-you-re-a-healthcare-vendor-a-signed-baa-is-the-start-of-your-hipaa-job-not-the-end?utm_source=hashnode&utm_medium=feed) If your company handles protected health information for healthcare clients, you are a business associate, and your clients are starting to ask a harder question than "will you sign a BAA?" They want 4 min read · [medcurity.hashnode.dev](https://medcurity.hashnode.dev/if-you-re-a-healthcare-vendor-a-signed-baa-is-the-start-of-your-hipaa-job-not-the-end?utm_source=hashnode&utm_medium=feed) [Aug 31](https://hashnode.com/posts/if-you-re-a-healthcare-vendor-a-signed-baa-is-the-start-of-your-hipaa-job-not-the-end/6a95e917299291a6837d1f87) ### [The Business Associate Inventory Nobody Keeps](https://medcurity.hashnode.dev/the-business-associate-inventory-nobody-keeps?utm_source=hashnode&utm_medium=feed) Ask a healthcare organization for its list of business associates and you will usually get one of two answers. A folder of signed PDFs, or a spreadsheet somebody built two years ago and stopped updati 4 min read · [medcurity.hashnode.dev](https://medcurity.hashnode.dev/the-business-associate-inventory-nobody-keeps?utm_source=hashnode&utm_medium=feed) [Aug 27](https://hashnode.com/posts/the-business-associate-inventory-nobody-keeps/6a8fa7bb047a15ed1b6b8934) ### [HIPAA Compliance for Business Associates: What Vendors Handling PHI Need in 2026](https://medcurity.hashnode.dev/hipaa-compliance-for-business-associates-what-vendors-handling-phi-need-in-2026?utm_source=hashnode&utm_medium=feed) If a healthcare provider or health plan pays your company to handle protected health information, you are a business associate under HIPAA. That status comes from 45 CFR 160.103 and from what your sys 4 min read · [medcurity.hashnode.dev](https://medcurity.hashnode.dev/hipaa-compliance-for-business-associates-what-vendors-handling-phi-need-in-2026?utm_source=hashnode&utm_medium=feed) [Aug 21](https://hashnode.com/posts/hipaa-compliance-for-business-associates-what-vendors-handling-phi-need-in-2026/6a88a2ed8488db48f2d53ce3) ### [SOC 2 Is Not HIPAA: Choosing Between Horizontal GRC and Healthcare-Native SRA](https://medcurity.hashnode.dev/soc-2-is-not-hipaa-choosing-between-horizontal-grc-and-healthcare-native-sra?utm_source=hashnode&utm_medium=feed) SOC 2 Is Not HIPAA: Choosing Between Horizontal GRC and Healthcare-Native SRA There is a conversation happening in health-tech companies and healthcare organizations everywhere right now, and it usual 6 min read · [medcurity.hashnode.dev](https://medcurity.hashnode.dev/soc-2-is-not-hipaa-choosing-between-horizontal-grc-and-healthcare-native-sra?utm_source=hashnode&utm_medium=feed) [Aug 4](https://hashnode.com/posts/soc-2-is-not-hipaa-choosing-between-horizontal-grc-and-healthcare-native-sra/6a7173441124acfd1fe14e22) ### [A Hospital HIPAA Risk Analysis Is Not an Evidence Scan: Why 45 CFR 164.310 Requires Someone Onsite](https://medcurity.hashnode.dev/a-hospital-hipaa-risk-analysis-is-not-an-evidence-scan-why-45-cfr-164-310-requires-someone-onsite?utm_source=hashnode&utm_medium=feed) A HIPAA Security Risk Analysis and automated compliance-evidence monitoring are different deliverables, and a hospital should know which one it is buying. The risk analysis is required of every covere 4 min read · [medcurity.hashnode.dev](https://medcurity.hashnode.dev/a-hospital-hipaa-risk-analysis-is-not-an-evidence-scan-why-45-cfr-164-310-requires-someone-onsite?utm_source=hashnode&utm_medium=feed) [Jul 29](https://hashnode.com/posts/a-hospital-hipaa-risk-analysis-is-not-an-evidence-scan-why-45-cfr-164-310-requires-someone-onsite/6a698e282768d7d01b016eb7)