hipaa.app updates, status and compliance updates
NPI lookups generate credentialing files, referral logs, and disclosure records that outlive the encounter. Here's how to set retention clocks and secure destruction rules for every artifact a doctors NPI number search leaves behind.
Carl B. Johnson
A single in-office nebulizer treatment generates a claim that passes through six or more organizations. Here's the PHI map for levalbuterol billing, and which of those handoffs actually needs a Business Associate Agreement.
Carl B. Johnson
A practical workflow for the records that move when a patient is referred between primary care, sleep medicine, and behavioral health — what needs an authorization, what doesn't, and which vendors touch the file along the way.
Carl B. Johnson
A single telehealth visit for a skin infection can touch six vendors before the clinician logs on. Here's how to build intake, consent, image retention, and BAA coverage that survives an audit.
Carl B. Johnson
A single home exercise program can touch five outside vendors before the patient reaches the parking lot. Here's how to inventory them, decide who needs a BAA, and close the gaps.
Carl B. Johnson
A GI complaint like bleeding hemorrhoids scatters records across primary care, specialist, endoscopy suite, and pathology. Here's how to answer the request inside 30 days without over-verifying, overcharging, or leaking to the wrong household.
Carl B. Johnson
Tonsil stone encounters generate patient-submitted photos, cross-organization referral packets, and outside operative reports. Here is how to capture, retain, and release those records without tripping over access timelines or missing a BAA.
Carl B. Johnson
A PPROM encounter compresses intake, transfer, and records release into minutes. Here's how to keep your sign-in sheet, waiting room scripts, and vendor list from turning that urgency into a reportable disclosure.
Carl B. Johnson
A single postpartum visit can touch eight or nine outside organizations before the claim closes. Here's how to map the third-party data flows in a mastitis care pathway and identify every vendor that requires a signed business associate agreement.
Carl B. Johnson
Post-procedure portal traffic is where front-desk staff most often step outside scope, misroute PHI, or create records nobody realizes are records. Here is the administrative workflow for cyst removal follow-up messaging.
Carl B. Johnson