hipaa.app updates, status and compliance updates
One yeast culture can pass through six organizations before the result lands in your chart. Here's how to map that trail, decide which vendors are business associates, and close the gaps before OCR asks.
Carl B. Johnson
A single musculoskeletal episode can generate records at four organizations. Here is how to run the request, verify the requester, price the copy, and document the file so an access complaint never reaches OCR.
Carl B. Johnson
An LPR reflux workup spreads chart data across specialists, scope capture systems, and device vendor portals. Here's how to define the designated record set, meet the access clock, and get the BAAs in place before a request lands.
Carl B. Johnson
Sign-in sheets, waiting-room callbacks, and check-in tablets create disclosure risk long before a patient reaches an exam room. A practical front-desk privacy walkthrough for gynecology and women's health practices.
Carl B. Johnson
A single pediatric immunization visit can push data to a dozen outside organizations. Here's how to map those flows, sort business associates from public health authorities, and close the BAA gaps before an auditor finds them.
Carl B. Johnson
A single splint check generates portal photos, employer note requests, and records moving to a hand specialist. Here's how to assign roles, set response windows, and paper the vendor relationships behind it.
Carl B. Johnson
Records from an SA node evaluation live in more places than your EHR. Here's how to build a retention schedule, assign the clocks, and destroy media in a way you can defend three years later.
Carl B. Johnson
A single renal colic episode generates records at six or seven organizations before the claim adjudicates. Here is the administrative map: who touches the PHI, which handoffs need a BAA, and which ones do not.
Carl B. Johnson
Provider-to-provider treatment disclosures don't require patient authorization, yet most primary care offices still delay referrals waiting for a signature. Here's the records-sharing workflow that keeps referrals moving and your disclosure log defensible.
Carl B. Johnson
A practical walkthrough of the intake fields, consent documents, vendor agreements, and records routing behind a chronic-care telehealth follow-up — written for the administrator who owns the paperwork, not the prescription.
Carl B. Johnson