hipaa.app updates, status and compliance updates
A single destruction-of-lesion encounter can generate a chart note, clinical photos, a claim, a clearinghouse transaction, an EOB, and a patient statement. Here is who touches that PHI and where the workflow breaks.
Carl B. Johnson
A practical walkthrough of the records-sharing workflow behind specialist referrals: what HIPAA permits without authorization, who owns each step, and where the handoff actually breaks.
Carl B. Johnson
A telehealth visit triggered by an abnormal lab result moves data through five or six systems before the patient logs off. Here is the intake, consent, vendor, and referral workflow that keeps that movement defensible.
Carl B. Johnson
A single vein consult can touch nine outside organizations before lunch. Here's how to inventory those vendors, decide who needs a Business Associate Agreement, and fix the breach-notification clauses most practices sign without reading.
Carl B. Johnson
A practical workflow for handling right-of-access requests when a patient's chart is split across allergy, ENT, and primary care: verification, the 30-day clock, permitted fees, and the vendor contracts that hold the records.
Carl B. Johnson
A practical records-and-release workflow for encounters where the chart includes guanfacine and other co-prescribed medications: what to capture, who owns each step, how long to retain, and which vendors need a BAA.
Carl B. Johnson
Item 3 on almost every OCR data request asks for your most recent risk analysis. Here's what a compliant security risk analysis under HIPAA contains, who performs it, how often it repeats, and what the documented evidence actually looks like.
Carl B. Johnson
OCR's first document request after a breach is almost always your risk analysis. Here's what a defensible HIPAA security risk assessment contains, who owns each step, and what the paper trail looks like six years later.
Carl B. Johnson
Repeat-visit wound and vein clinics create privacy exposure the average practice never faces. Here is how to audit sign-in sheets, waiting room scripts, companion disclosures, and the vendor list behind them.
Carl B. Johnson
A sialorrhea referral touches more outside organizations than most encounters in your schedule. Here is how to map those data flows, decide which vendors are business associates, and close the BAA gaps you find.
Carl B. Johnson