hipaa.app updates, status and compliance updates
A virtual visit that ends in a same-week blood draw routes PHI through five or six systems before the tube is labeled. Here is the intake, consent, vendor, and records workflow administrators need to lock down.
Carl B. Johnson
A behavioral health screening result rarely stays in your EHR. Here's how to map the vendors that touch bipolar test data, what your BAAs must cover, and how to run a review cycle that survives an OCR inquiry.
Carl B. Johnson
A records request following a hemorrhoidectomy touches four organizations, three vendors, and one legal deadline. Here is the operator's workflow for timelines, identity verification, fees, and the BAAs that hold it together.
Carl B. Johnson
A cardiology-heavy chart moves across three or four organizations before it closes. Here is the records, retention, and release workflow your staff needs for stenosis aorta encounters — including the imaging vendor chain most practices never paper properly.
Carl B. Johnson
Recurring in-center visits mean the same patients pass your front desk 150 times a year. Here is how to audit sign-in sheets, waiting room layout, transport vendors, and check-in scripts before OCR asks you to.
Carl B. Johnson
One orthopedic-adjacent visit can push PHI through intake, imaging, transcription, referral, billing, and messaging vendors in under an hour. Here is how to map those flows and identify which contracts require a signed BAA.
Carl B. Johnson
Post-referral messages describing symptoms arrive in the portal queue before clinical staff log in. Here's the routing, vendor, and records workflow that keeps a front-desk reply from becoming a complaint or a breach.
Carl B. Johnson
A practical retention and secure-destruction policy for the records a colonoscopy age screening encounter leaves behind — across your practice, your endoscopy partner, your lab, and every vendor holding a copy.
Carl B. Johnson
Behavioral health evaluations move through intake vendors, coders, clearinghouses, and payer portals. Here's a step-by-step map of what leaves your building and who is accountable for it.
Carl B. Johnson
One zoledronic acid infusion order can pull records across four organizations in a week. Here is which disclosures HIPAA permits without authorization, which vendors need a BAA, and how to document the whole chain.
Carl B. Johnson