hipaa.app updates, status and compliance updates
A practice-operations guide to running telehealth counseling: vendor inventories, consent scripts, code-selection documentation, psychotherapy notes, and the February 2026 Part 2 compliance date.
Carl B. Johnson
TB skin testing looks like a two-minute encounter until you trace the paperwork: a return visit, an employer results letter, an employee file that isn't PHI, and three vendors touching the data. Here's the operational map.
Carl B. Johnson
CPT billing codes are PHI the moment they attach to a patient. Here's how they move through your practice, which vendors touch them, and the HIPAA obligations that follow — restriction requests, records requests, appeals, and BAAs.
Carl B. Johnson
A practice-operations walkthrough of shave biopsy CPT coding — what documentation your coder needs, how add-on codes stack, and where specimen handling, photos, and vendor contracts create HIPAA exposure.
Carl B. Johnson
An operations guide to CPT 96374 for practice administrators: the documentation your coders need, the vendor chain that touches infusion records, and the privacy obligations that follow.
Carl B. Johnson
The code most staff search for isn't a CPT code at all. A practice-operations guide to B12 injection coding, documentation, payer rules, and the vendor exposure that comes with a high-volume injection program.
Carl B. Johnson
A practical guide to CPT 99497 for administrators and billing staff: what the time documentation has to show, how the annual wellness visit overlap works, and how to control the vendor and records-request exposure an advance care planning note creates.
Carl B. Johnson
CPT 99459 is a practice-expense add-on code tied to pelvic examinations. Here's how administrators build the workflow, and why the documentation it depends on creates records-request and vendor exposure most practices haven't mapped.
Carl B. Johnson
Health risk assessment screening generates sensitive PHI at scale, often through a third-party tablet app nobody has a BAA with. Here's how administrators handle documentation, records requests, and vendor exposure around 96160.
Carl B. Johnson
A level-five office consultation stands or falls on paperwork your front desk controls: the request, the reason, and the written report back. Here is how to build that workflow — and close the vendor gaps it creates.
Carl B. Johnson