hipaa.app updates, status and compliance updates
One postpartum recovery encounter can push PHI to six or more outside organizations. Here is how to inventory those vendors, decide who needs a BAA, and tighten the breach-notice clock in your contracts.
Carl B. Johnson
Your risk analysis is the first document OCR requests after a breach report. Here's who owns it, what the nine required elements look like on paper, and how to build a 12-month cycle your practice can actually sustain.
Carl B. Johnson
Herbal and supplement documentation lives in odd corners of the chart — intake forms, scanned outside labs, referral letters. Here is how to fulfill a records request that touches all of them without missing the 30-day deadline.
Carl B. Johnson
When OCR opens an investigation, the first document they request is your risk analysis. Here's how a small practice scopes, performs, and documents one that survives review.
Carl B. Johnson
A screening encounter generates more record artifacts than most practices realize. Here is the documentation, retention, and release workflow your staff needs before the first request arrives.
Carl B. Johnson
A practical front-desk privacy audit for practices that see pregnant patients for headache workups: sign-in sheets, waiting room scripts, check-in tablets, and the referral paper trail that leaves your building.
Carl B. Johnson
A single prenatal antiemetic prescription can generate nine or more outbound data flows. Here's how to identify which of those vendors are business associates, which aren't, and how to close the gaps before an auditor or a plaintiff's firm finds them.
Carl B. Johnson
OCR's first document request after a breach is almost always your risk analysis. Here's what a defensible HIPAA risk assessment template contains, who fills out each section, and how long you keep it.
Carl B. Johnson
A practical policy guide for practice administrators: how to route, log, and safeguard patient portal and text messages generated by maintenance inhaler follow-up, without pushing front-desk staff into clinical territory.
Carl B. Johnson
High-cost oral antibiotics generate prior authorizations, pharmacy-benefit claims, and appeal packets that move chart data outside your walls. Here is who touches that PHI and which of them need a signed BAA.
Carl B. Johnson