hipaa.app updates, status and compliance updates
A single tonsil stone removal encounter can touch a dozen outside organizations. Here is how to inventory them, decide which ones are business associates, and close the BAA gaps that show up in an audit.
Carl B. Johnson
A practical workflow for handling records requests tied to alpha thalassemia encounters: the 30-day access clock, verification without over-gatekeeping, fee limits, third-party directives, and the vendor agreements that hold it all together.
Carl B. Johnson
A registry match is not identity verification. Here is the documentation, retention, and vendor workflow your practice needs around every provider NPI lookup that precedes a records release.
Carl B. Johnson
Orthopedic front desks run loud, fast, and in public. Here is how to audit sign-in sheets, check-in scripts, waiting-room layout, and vendor contracts before OCR asks you to.
Carl B. Johnson
One stool test order can move PHI through a dozen organizations. Here's how to inventory the vendors in a calprotectin pathway, decide which ones require a business associate agreement, and close the gaps on a 90-day schedule.
Carl B. Johnson
A practical policy for handling patient portal messages tied to Dayvigo follow-up: message triage, role-based access, proxy accounts, vendor BAAs, and the audit checks that catch problems before OCR does.
Carl B. Johnson
A single procedure encounter generates records in seven or more systems before the claim pays. Here is who touches the chart, where minimum necessary breaks down, and which vendors need a signed BAA.
Carl B. Johnson
A vascular surgery referral pulls imaging, notes, and payer paperwork across three or four organizations in under a week. Here's how to run those permitted disclosures without an authorization scramble, a fax misfire, or a missing BAA.
Carl B. Johnson
A same-day virtual visit for upper abdominal pain creates four to six separate records across three or four vendors. Here is how to map the consent, intake, and referral workflow before it turns into a breach report.
Carl B. Johnson
A single headache visit can touch nine outside systems in a week. Here is how to inventory those vendors, decide which ones need a business associate agreement, and write contract terms that survive a breach.
Carl B. Johnson