Thyra Blog
Technical safeguards, risk assessments, and HIPAA compliance architecture.
The EU's ProtectEU strategy has reignited the encryption backdoor debate. Here is why mandated backdoors are structurally incompatible with HIPAA's Security Rule, and what US clinics should track.
A practical framework for IT admins decommissioning a legacy EHR: how long to keep read-only access, state retention rules, and who stays liable for old-system data requests.
RBAC controls who can open a chart. Audit log monitoring catches employees who technically can but shouldn't. Here's what IT admins should require from an EHR vendor.
Ambient AI scribes record patient conversations, which means wiretapping law, not just HIPAA, applies. Here is what consent, notice, and opt-out workflows should look like state by state.
RBAC misconfiguration in shared endocrinology/primary care EHRs causes both HIPAA exposure and clinician friction. Here's how IT admins should structure roles, scopes, and audits.
AI can draft SOC 2 and ISO 27001 policy language fast, but evidence validation, control testing, and auditor sign-off still require human review. Here's where the line sits.
A practical guide for IT admins on what happens to patient audio after ambient AI scribe transcription, including retention windows, model training risk, and the exact contract language to demand.
A practical comparison of open-source data-exchange APIs and commercial FHIR platforms, covering ONC certification support, maintenance burden, and who owns security risk over time.
A technical breakdown of screen scraping versus FHIR and Direct exchange, why reverse-engineered integrations persist in health IT, and what admins should verify before trusting a vendor's data pipeline.
AI safety in healthcare is now a workflow control problem. Here is what healthcare IT leaders should verify in audit logs, approval workflows, and source grounding before deploying an AI EHR.
AI hallucinations in clinical workflows pose significant patient safety risks. Essential prevention strategies include data grounding, deterministic rules, and audit trails.
ONC certification is the gateway to the US healthcare market. Here is what the process actually involves, what it costs, and where new vendors get stuck.
HIPAA compliance is not a checkbox. For cloud-native EHRs, it requires deliberate architecture decisions around encryption, access control, and audit logging.
Keep exploring
