hipaa.app Blog

HIPAA Right of Access

Scaphoid Fracture Records Requests: Timelines & Access

Wrist injury charts get split across urgent care, an imaging center, and a hand surgeon — then a records request arrives asking for all of it. Here's the access timeline, verification standard, fee rules, and vendor paperwork behind that request.

Carl B. Johnson

— 2 Jun 2026

HIPAA Compliance

Cervical Myelopathy Records: A Practice Workflow Guide

Multi-specialty spine encounters generate charts that live in four systems and travel between six organizations. Here is the records, retention, and release workflow your staff needs before the first request arrives.

Carl B. Johnson

— 2 Jun 2026

HIPAA Compliance

Treating Herniated Lumbar Disc: Front-Desk Privacy Gaps

Sign-in sheets, waiting-room callbacks, attorney faxes, and check-in tablets create the most common privacy exposures in a referral-heavy spine practice. Here is the administrative fix list, with role assignments and a 90-day plan.

Carl B. Johnson

— 1 Jun 2026

Business Associate Agreements

Stages of Change Vendors: Mapping Every BAA You Need

Behavioral readiness programs generate PHI across coaching platforms, SMS reminder tools, referral partners, and analytics vendors. Here is how to build the vendor map and close the BAA gaps before an auditor does it for you.

Carl B. Johnson

— 1 Jun 2026

Patient Portal Compliance

Chronic Kidney Disease Stages: Portal Message Policy

A practical portal and secure-messaging policy for practices managing CKD follow-up: front-desk routing rules, proxy access, records-request clocks, vendor BAAs, and audit log review assignments.

Carl B. Johnson

— 1 Jun 2026

HIPAA Compliance

Guanfacine Side Effects: Coding, Claims, and PHI Flow

A single side-effect phone call can touch seven organizations before the month closes. Here is the coding, claims, EOB, and vendor workflow that surrounds an adverse-effect encounter — and where PHI leaks.

Carl B. Johnson

— 31 May 2026

HIPAA

Hip Impingement Referrals: Records Sharing Done Right

A single hip impingement referral can move imaging, office notes, and therapy records across four separate organizations in under two weeks. Here is the permitted-disclosure workflow, the BAA question, and the desk procedure that keeps it clean.

Carl B. Johnson

— 31 May 2026

Telehealth Compliance

PREVENT Calculator Visits: Telehealth Intake Privacy

A telehealth risk-assessment visit touches an intake form vendor, a video platform, a lab feed, and your chart. Here is how to map consent, BAAs, and records handling before the volume arrives.

Carl B. Johnson

— 30 May 2026

HIPAA

Bipolar Depression Treatment Data: Vendor BAA Exposure

A single behavioral health encounter can push protected health information through a dozen outside organizations in 72 hours. Here is how to map that path, reconcile your business associate list, and close the contract gaps before OCR or a breach finds them.

Carl B. Johnson

— 30 May 2026

HIPAA Right of Access

Liver Enzymes Records Requests: Timelines & Verification

A practical workflow for fulfilling right-of-access requests when a patient's liver enzymes results are scattered across your EHR, a reference lab, and a specialist's consult note — timelines, verification, fees, and vendor agreements.

Carl B. Johnson

— 30 May 2026