hipaa.app updates, status and compliance updates
One orthopedic claim can touch six organizations before it pays. Here's the disclosure trail behind a shoulder impingement syndrome encounter, and the BAA, minimum-necessary, and access obligations attached to each hop.
Carl B. Johnson
A specialist referral for osteochondritis dissecans moves a chart through five or six organizations in a week. Here is the records, consent, and vendor workflow that keeps those disclosures defensible.
Carl B. Johnson
One flagged lab value can move a patient's PHI through six organizations before noon. Here's how to map those handoffs, decide which ones need a business associate agreement, and document the answer.
Carl B. Johnson
A single Ludwig's angina encounter can scatter records across a dental office, an emergency department, and a surgical service. Here is the records-request workflow that keeps your practice inside the 30-day access clock.
Carl B. Johnson
A single controlled-substance prescription change generates artifacts in your EHR, your state PDMP, your e-prescribing gateway, and a payer's prior authorization queue. Here's how to document, retain, and release each one without stepping on state law.
Carl B. Johnson
The most common privacy failures in a PCOS-focused practice happen at the check-in window, not in the EHR. Here is how to audit sign-in sheets, waiting-room scripts, and vendor-run kiosks before a patient complains.
Carl B. Johnson
A single adnexal imaging finding pulls a chart through six to ten outside organizations. Here's how to inventory those data flows and sort them into BAA-required, BAA-exempt, and problem categories.
Carl B. Johnson
Anticoagulation follow-up generates more portal traffic than almost any other outpatient workflow. Here is the routing, access, and vendor policy your front desk needs before the queue fills up Monday morning.
Carl B. Johnson
A practical retention and destruction policy for the paper, images, and billing files generated by a minor in-office procedure — including who signs the vendor agreement and what your destruction log must capture.
Carl B. Johnson
One immunization encounter can move identifiable data through eight or more systems before the claim pays. Here is the full administrative trail, who needs a BAA, and where practices get it wrong.
Carl B. Johnson