hipaa.app Blog

Business Associate Agreements

Winlevi Records Leave Your Practice: Vendor BAA Risk

One branded topical acne prescription can move patient data through an e-prescribing network, a prior authorization vendor, a pharmacy, and a manufacturer copay program. Only some of those relationships need a BAA — and the ones that don't need something harder.

Carl B. Johnson

— 9 Jun 2026

HIPAA Right of Access

Galactorrhea Disease Records Requests: A 30-Day Guide

A patient's galactorrhea workup generates records across your practice, a reference lab, an imaging center, and a specialist. Here is how to answer the request inside 30 days without over-verifying, over-charging, or under-disclosing.

Carl B. Johnson

— 8 Jun 2026

HIPAA Compliance

Microcytic Anemia Records: What Your Practice Must Keep

A single microcytic anemia workup can touch a reference lab, a GI practice, an imaging center, and three vendors. Here is the records, retention, and release workflow your staff needs to run it cleanly.

Carl B. Johnson

— 8 Jun 2026

HIPAA Compliance

Macrocytic Anemia Clinics: Front-Desk Privacy Risks

Sign-in sheets, lobby call-backs, and check-in tablets create real disclosure risk in a clinic that manages macrocytic anemia workups. Here is the operator's audit, with owners and a 30-day plan.

Carl B. Johnson

— 8 Jun 2026

Business Associate Agreements

Swelling and Pitting Edema: Mapping Your Vendor BAAs

One bilateral leg-swelling encounter can push PHI through a dozen third parties in five days. Here's how to build a vendor map for that pathway and close the BAA gaps it exposes.

Carl B. Johnson

— 7 Jun 2026

HIPAA Compliance

Myxedema Coma Follow-Up: Portal and Messaging Policy

A hospital discharge after a myxedema coma admission sends records, spouses, and portal messages at your front desk all at once. Here is the access, messaging, and vendor policy that keeps the workflow defensible.

Carl B. Johnson

— 7 Jun 2026

Records Retention

Rash Maculo Charts: Retention Clocks and Secure Disposal

Retention clocks for rash maculo encounter records rarely match your purge schedule, and the photos usually live outside the chart. Here is how to build a retention and destruction policy that survives a records request and an OCR inquiry.

Carl B. Johnson

— 7 Jun 2026

HIPAA Compliance

Concussion Treatment Claims: Who Actually Sees the PHI

A single concussion encounter can push PHI through six or more organizations in three weeks. Here's the administrative map: claim path, minimum necessary limits, which vendors need a BAA, and which requests need an authorization instead.

Carl B. Johnson

— 6 Jun 2026

HIPAA Compliance

Lipoma Removal Referrals: What Records You May Share

A practical walkthrough of the referral and records-sharing workflow around a lipoma removal encounter: permitted treatment disclosures, packet contents, transport channels, vendor status, and the results loop back to the referring practice.

Carl B. Johnson

— 6 Jun 2026

HIPAA Compliance

Adnexal Telehealth Intake: Privacy Workflow for Admins

Adnexal telehealth visits pull records from imaging centers, referring clinicians, and specialists before the video window even opens. Here is the intake, consent, vendor, and retention workflow that keeps that traffic defensible.

Carl B. Johnson

— 6 Jun 2026