hipaa.app Blog

HIPAA Compliance

Diaphragm Contraception Portal Policy: Staff Safeguards

Follow-up for a diaphragm fitting usually arrives as a portal message or a callback request — often to a shared household login. Here are the proxy access, confidential communications, retention, and vendor controls your front desk needs in writing.

Carl B. Johnson

— 17 Aug 2026

Records Retention

Drugs for Polycystic Ovaries: Chart Retention Clocks

A practical retention and destruction policy for the records that pile up around long-running medication management — retention clocks, NIST-grade destruction, shredding vendor BAAs, and legal holds.

Carl B. Johnson

— 16 Aug 2026

HIPAA Compliance

Otorrhea Claims: Who Touches PHI in Your Billing Chain

A single ear-drainage visit generates a claim that passes through nine or more hands before it is paid. Here is who touches the PHI, which agreements you need in place, and where the disclosure risk actually sits.

Carl B. Johnson

— 16 Aug 2026

HIPAA Compliance

Topical Steroids for Lichen Planus: Referral Records

A cross-specialty referral moves the chart, the photos, and the consult note between three organizations. Here's the permitted-disclosure workflow, the vendor list, and the paperwork your practice actually needs.

Carl B. Johnson

— 16 Aug 2026

Telehealth Compliance

PROM Premature Telehealth Visits: Intake and Consent

A prom premature call can move PHI across four organizations in under two hours. Here is the intake, consent, vendor, and records workflow that keeps that transfer clean.

Carl B. Johnson

— 15 Aug 2026

Business Associate Agreements

Swimmer's Ear Drops and Your Business Associate List

A single otic drops encounter can touch six or more outside organizations before the patient leaves the parking lot. Here is how to map that chain, decide which links need a BAA, and document the answer.

Carl B. Johnson

— 15 Aug 2026

Right of Access

Why Does It Hurt When I Pee: Records Request Timelines

Urinary symptom visits scatter records across your EHR, a reference lab, and a urology referral. Here's the right-of-access workflow that keeps a routine request from becoming an OCR complaint.

Carl B. Johnson

— 12 Aug 2026

HIPAA Compliance

Why Does Urinating Hurt: Records Workflow for Staff

The administrative workflow behind painful-urination visits: cash-pay restrictions, lab result routing, minimum necessary release decisions, retention schedules, and the vendors that need a BAA.

Carl B. Johnson

— 12 Aug 2026

HIPAA Compliance

At Home Sleep Study Front Desk: Privacy Gaps to Close

Take-home diagnostic devices push more traffic through your lobby than a standard visit. Here's how sign-in sheets, return bins, and counter conversations create disclosure risk — and the front-desk controls that fix them.

Carl B. Johnson

— 12 Aug 2026

Business Associate Agreements

AST and ALT Results: Mapping Every Vendor That Needs a BAA

A single hepatic panel order moves protected health information through eight or more outside systems. Here is how to map that pathway, decide which vendors need a signed BAA, and document the ones that don't.

Carl B. Johnson

— 11 Aug 2026