hipaa.app updates, status and compliance updates
HIPAA's six-year clock does not govern the chart. Here is how to build a defensible retention and destruction schedule for intertrigo treatment records, including the photos and referral packets that live outside your EHR.
Carl B. Johnson
One nail complaint generates a coded claim, a specimen requisition, clinical photos, and a prior authorization — each one a disclosure. Here is who sees the PHI and which agreements you need on file.
Carl B. Johnson
A cardiology referral for diastolic heart failure moves records between organizations within hours. Here is the permitted-disclosure rule, the vendor chain, and the audit trail your practice needs to have in place before the phone rings.
Carl B. Johnson
A single shoulder telehealth visit can touch six or seven vendors before the clinician says hello. Here is how to map consent, BAAs, and records routing for that encounter without leaving gaps.
Carl B. Johnson
One chronic cardiac co-management encounter can touch a dozen outside organizations. Here is how to trace where that record goes, which vendors need a BAA, and how to close the gaps in 90 days.
Carl B. Johnson
A single episode of foot care can scatter records across four organizations. Here is how to run the 30-day access clock, verify requesters, cap your fees, and keep your vendor paperwork clean.
Carl B. Johnson
An incidental adnexal mass finding pulls imaging, labs, referral packets, and outside records across organizational lines within days. Here's what your practice must capture, retain, release, and paper with a BAA.
Carl B. Johnson
Thyroid ultrasound clinics run high-volume, referral-heavy schedules — which puts most of the privacy risk at the check-in counter, not the scanner. Here's how to audit sign-in sheets, call-back scripts, and vendor touchpoints.
Carl B. Johnson
One compression fracture encounter can push PHI into nine or more outside organizations. Here's how to map those third-party data flows and decide, vendor by vendor, who requires a signed business associate agreement.
Carl B. Johnson
A neck-node workup moves records across imaging centers, specialists, and your portal in a matter of days. Here is the messaging, access, and vendor policy your staff needs before the messages pile up.
Carl B. Johnson