hipaa.app updates, status and compliance updates
A routine ENT referral moves protected health information across organizational lines. Here's the permitted-disclosure workflow, the verification step most front desks skip, and the vendor contracts sitting in the middle of it.
Carl B. Johnson
A practical, step-by-step walkthrough of the Security Rule risk analysis requirement — scoping, asset inventory, scoring, remediation, and the documentation OCR actually asks to see.
Carl B. Johnson
A televisit for a spermatic cord complaint touches your intake form, your image storage, your referral packet, and four vendors you may not have papered. Here is the administrative workflow behind it.
Carl B. Johnson
A single serum protein electrophoresis order can touch eight outside organizations before the result lands back in your chart. Here is how to map which of them are business associates, which are not, and what your contracts need to say.
Carl B. Johnson
A single foot-pain workup can generate records across four organizations. Here's how to run the request intake, verification, fee, and vendor workflow without missing the 30-day access deadline.
Carl B. Johnson
A single serum protein electrophoresis order can generate a requisition, a numeric report, a graphical tracing, an interpretive narrative, and reflex add-on results across three organizations. Here is the records, retention, and vendor workflow that keeps all of it releasable.
Carl B. Johnson
A working guide to the HIPAA risk analysis requirement under 45 CFR 164.308(a)(1)(ii)(A) — the nine elements OCR looks for, who owns each step, and what defensible documentation actually contains.
Carl B. Johnson
Sign-in sheets, name callouts, and check-in tablets are legal under HIPAA — until they aren't. A practical audit of the front-desk workflows around thyroid follow-up visits, with scripts, vendor questions, and breach-decision steps.
Carl B. Johnson
One fluid-status workup can move protected health information through a dozen outside organizations. Here is how to inventory them, decide which require a Business Associate Agreement, and close the gaps before an auditor finds them.
Carl B. Johnson
Portal threads, message pools, and cosignature workflows behave differently depending on which clinician handles a follow-up. Here is the routing, audit, and vendor policy your front desk actually needs.
Carl B. Johnson