hipaa.app updates, status and compliance updates
A single free-text intake box can route protected health information through five vendors before a clinician opens the chart. Here's the consent, BAA, and records workflow that has to sit underneath a telehealth gynecology visit.
Carl B. Johnson
A specialty test order like genesyte pulls in couriers, portals, interface vendors, and release-of-information services. Here is how to inventory that chain, decide who needs a BAA, and manage the breach clock when a downstream vendor fails.
Carl B. Johnson
A practical workflow for handling right-of-access requests when the encounter involves cardiology co-management and nutrition counseling: designated record set scope, verification, fees, the 30-day clock, and the vendor contracts underneath it.
Carl B. Johnson
A practical records and vendor workflow for practices that bill or document neurofeedback therapy sessions: what belongs in the designated record set, what the 30-day access clock covers, and where the BAA gaps usually sit.
Carl B. Johnson
Surgical and GI practices that handle pneumoperitoneum findings move records fast and talk loudly. Here is where the front desk leaks PHI — and the specific controls that hold up under an OCR complaint review.
Carl B. Johnson
A low-acuity respiratory visit moves PHI through scheduling, telehealth, e-prescribing, labs, transcription, and billing in under ten minutes. Here's how to map those flows and identify every vendor that requires a signed Business Associate Agreement.
Carl B. Johnson
Contraception follow-up creates portal messages, appointment reminders, EOBs, and audit trails that can all leak into a household. Here's the front-desk and vendor workflow that keeps them contained.
Carl B. Johnson
Three separate clocks run on a chest-wall-pain chart: the HIPAA six-year documentation rule, your state's medical record law, and payer contract terms. Here's how to build a retention and destruction schedule that holds up.
Carl B. Johnson
A growth-restriction referral pulls records across an OB practice, an MFM group, a hospital, a NICU, and a pediatric office in days. Here's the permitted-disclosure and vendor workflow that has to hold up.
Carl B. Johnson
A telehealth visit that ends in a lab order moves protected health information through six or more organizations. Here is the consent, BAA, and records workflow an administrator actually has to own.
Carl B. Johnson