hipaa.app updates, status and compliance updates
The clipboard at your front desk probably holds three legally distinct documents stapled together. Here's how to separate them, retain them for six years, and handle the vendor exposure that comes with digital intake.
Carl B. Johnson
A practice-operations walkthrough of the chart-to-claim path: who touches PHI at each handoff, which coding vendors need BAAs, and how to document code selection without stepping into clinical territory.
Carl B. Johnson
An operations guide to the trigger finger injection CPT code family: how coders determine and document code selection, where the modifier decisions live, and every vendor that touches the claim.
Carl B. Johnson
What the 99221 CPT code description covers, how practices document level selection under the post-2023 inpatient E/M rules, and where the PHI and vendor risk sits in a hospital-based billing workflow.
Carl B. Johnson
A two-visit tuberculin skin test creates two encounters, two documentation trails, and at least three places your practice can leak information. Here's the operational and privacy playbook for administrators.
Carl B. Johnson
E/M code selection touches your clinicians, coders, outside auditors, clearinghouse, and increasingly your ambient documentation vendor. Here is how practice administrators run the workflow and lock down the privacy exposure that comes with it.
Carl B. Johnson
A practice-operations guide to home visit CPT codes: how coders determine levels, why place of service sinks claims, and what leaves your building when PHI rides along with the clinician.
Carl B. Johnson
Advance care planning generates a time-based billing record, a consent note, and a legal directive document — three artifacts with different retention, access, and vendor implications. Here's how to run the workflow without creating an audit or privacy problem.
Carl B. Johnson
An operations guide to CPT code 95117 for practice administrators: shot-room workflow, documentation, denial patterns, and the PHI exposures and vendor agreements that come with running an allergy injection program.
Carl B. Johnson
How the G20 code family works in a movement disorder clinic, and where code selection collides with minimum necessary, caregiver disclosures, BAAs, and your 30-day records clock.
Carl B. Johnson