hipaa.app updates, status and compliance updates
A five-minute skin adhesive closure generates photos, a lot number, a consent, and a records trail that three different requesters will come looking for. Here is the capture, retention, and release workflow your staff should be running.
Carl B. Johnson
A practical look at the front-desk privacy exposure created by nail fungus fingernails treatment visits: sign-in sheets, waiting room acoustics, clinical photography, referral hand-offs, and the vendors that touch all of it.
Carl B. Johnson
A single elevated calcium result can move a patient's chart through six or more outside organizations in two weeks. Here's how to inventory that data flow and confirm every stop has a signed BAA behind it.
Carl B. Johnson
A single portal thread about an antibiotic follow-up can pull in a lab, a specialist, a pharmacy, and two vendors you never signed a BAA with. Here is the administrative workflow that keeps it contained.
Carl B. Johnson
Every NPI verification your staff performs leaves an artifact somewhere — a screenshot, a credentialing file note, a clearinghouse log. Here is how long to keep those records, who owns the clock, and how to destroy them defensibly.
Carl B. Johnson
A single adult immunization encounter moves identifiable data through a clearinghouse, a payer, a state registry, and two or three vendors. Here is how to map that path and close the BAA gaps it exposes.
Carl B. Johnson
When a lab flags high bilirubin, a chart leaves your building within hours. This is the administrative workflow behind that transfer: permitted disclosures, fax and HIE controls, vendor BAAs, and what to log.
Carl B. Johnson
A lab-review telehealth visit touches five data paths, four of them outside your walls. Here's the intake, consent, vendor, and records workflow that keeps a subclinical hypothyroidism encounter from becoming a privacy incident.
Carl B. Johnson
A single orthostatic hypotension workup can push PHI through six or seven outside organizations. Here is how to map those handoffs, decide which ones need a BAA, and close the gaps before OCR asks.
Carl B. Johnson
A same-day dysuria visit produces labs, a referral, and eventually a records request. Here is the 30-day clock, the verification script, the state-law traps, and the vendor paperwork your practice needs before the request lands.
Carl B. Johnson