hipaa.app Blog

Business Associate Agreements

Stress Fracture in Foot: Vendor Risk When Data Leaves

One foot injury encounter can move protected health information through six or seven outside organizations in ten days. Here is how to tell which of them are business associates, and what your agreements need to say before the data moves.

Carl B. Johnson

— 15 Jun 2026

HIPAA

How to Get Rid of a Canker Sore: Records Request Rules

A five-minute oral lesion visit can generate a portal photo, a referral letter, and a records request with a 30-day clock attached. Here's the operational workflow for handling it correctly.

Carl B. Johnson

— 15 Jun 2026

HIPAA

Infant Botulism Records: What Your Practice Must Keep

A suspected infant botulism case generates a public health disclosure, an emergency transfer packet, a specialty program record trail, and a parent access request — usually within a week. Here is the administrative workflow that keeps all four defensible.

Carl B. Johnson

— 14 Jun 2026

HIPAA Compliance

What Is B12 Good For? Front-Desk Privacy Gaps to Fix

Walk-in injection visits push clinical detail onto your sign-in sheet and into your lobby. Here's how to audit the check-in workflow, apply reasonable safeguards, and document the whole thing.

Carl B. Johnson

— 14 Jun 2026

Business Associate Agreements

Boniva Care Pathway: Mapping Vendors That Need a BAA

An osteoporosis medication pathway routes PHI through imaging centers, labs, pharmacies, benefit verification services, and reminder tools. Here is how to map every third-party data flow and decide which ones require a signed BAA.

Carl B. Johnson

— 14 Jun 2026

HIPAA Compliance

Vaginal Atrophy Portal Messages: Front-Desk Safeguards

Follow-up for vaginal atrophy generates portal messages, refill requests, and specialist records transfers — all of which pass through non-clinical staff. Here is the messaging policy, proxy-access control, and vendor documentation that keeps that traffic defensible.

Carl B. Johnson

— 13 Jun 2026

HIPAA Compliance

HEART Score Records: Retention Clocks and Disposal Rules

A HEART score encounter leaves fragments in six systems and three organizations. Here is how to set the retention clock, track every copy, and destroy them defensibly when the clock runs out.

Carl B. Johnson

— 13 Jun 2026

HIPAA Compliance

Fungal Infection on Skin: Coding, Claims, and PHI Flow

One short dermatology visit can push protected health information through eight or more organizations before the claim clears. Here is the administrative map — coding, images, vendors, BAAs, and the records requests that follow.

Carl B. Johnson

— 13 Jun 2026

HIPAA Compliance

Lipase Levels: Sharing Lab Results Between Providers

A referral that includes lipase levels moves PHI between two organizations in under an hour. Here's the disclosure authority, the vendor layer, the release timing, and the failure modes your referral log should catch.

Carl B. Johnson

— 12 Jun 2026

HIPAA Compliance

High Liver Enzymes Telehealth Intake: A Privacy Guide

One telehealth follow-up for an abnormal liver panel can touch six vendors and three organizations in two weeks. Here is the intake, consent, referral, and BAA workflow that keeps that trail defensible.

Carl B. Johnson

— 12 Jun 2026