hipaa.app updates, status and compliance updates
Baseline and post-injury concussion test records scatter across platforms, schools, and paper files. Here is how to build a retention schedule and a destruction workflow your practice can actually defend.
Carl B. Johnson
One thyroid medication adjustment generates a lab claim, an e-prescription, a pharmacy claim, a portal message, and sometimes a prior authorization packet. Here is the full disclosure map, and the vendor agreements it obligates you to hold.
Carl B. Johnson
A practical records-routing workflow for practices that send or receive Savella-related referrals: what HIPAA permits without authorization, which recipients break the pattern, and where your fax and vendor controls fail.
Carl B. Johnson
A telehealth consult for suspected hypermobile Ehlers-Danlos pulls in form builders, video uploads, e-signature tools, and outside records. Here is the intake, consent, and vendor workflow that keeps that traffic defensible.
Carl B. Johnson
A single chest-pain workup can push one chart through six or seven outside organizations in four days. Here is how to map which of those handoffs need a business associate agreement, and what to do about the ones that don't have one.
Carl B. Johnson
A heel pain episode generates records across four organizations. Here's how to run the request workflow — the 30-day clock, verification that doesn't stall, fee limits, and the vendor agreements behind it.
Carl B. Johnson
A single incidental urinalysis finding can generate records across four organizations and a request queue that outlives the encounter. Here's the documentation, vendor, and release workflow your practice needs before the request arrives.
Carl B. Johnson
Same-day eye injury visits push protected health information through your lobby faster than any scheduled appointment. Here's how to audit sign-in sheets, waiting-room audio, and referral handoffs before OCR does it for you.
Carl B. Johnson
A PNES care pathway crosses more organizational boundaries than a routine visit. Here's how to inventory every third-party data flow and confirm you hold a signed BAA for each one.
Carl B. Johnson
A practical portal and messaging policy for chronic rhinitis follow-up encounters: how front-desk staff should triage messages, which vendors need a BAA, and what clocks start when a patient asks for records.
Carl B. Johnson