hipaa.app updates, status and compliance updates
AI tools, expanding cloud footprints, aggressive breach enforcement, paste site exposures, and mobile device risks — here's what healthcare privacy managers need to know right now.
Carl B. Johnson
The Medicare annual wellness visit generates a health risk assessment, a written prevention plan, and a vendor trail. Here's the operational workflow plus the privacy and BAA obligations administrators own.
Carl B. Johnson
HIPAA compliance requires specific documentation. Here are the nine essential documents every healthcare practice needs — and how to create them without the headache.
Carl B. Johnson
HIPAA compliance doesn't have to be complicated or expensive. Learn how hipaa.app helps healthcare organizations get compliant in under an hour.
Carl B. Johnson
Relative value units drive your fee schedule, your provider compensation model, and a data pipeline full of PHI. Here is how RVUs actually work operationally — and which vendors need a BAA before they touch the file.
Carl B. Johnson
A practice-operations walkthrough of the 99212 CPT code: how level selection gets documented, what happens when a payer requests 30 charts, and which vendors touching those claims need a BAA.
Carl B. Johnson
A practice-operations guide to running Aetna telehealth visits: eligibility verification, how staff document code selection, platform vendor agreements, and what happens when a patient requests the video-visit record.
Carl B. Johnson
Modifier 95 tells every payer that a visit happened over video. That single character pair drives claim edits, audit exposure, and a vendor list your privacy officer needs to reconcile.
Carl B. Johnson
Most practices run on six or seven documents people loosely call "the HIPAA form." Here's what each one does, which elements make an authorization valid, and where the vendor and records-handling risk actually sits.
Carl B. Johnson
A practice-operations guide to the 36415 CPT code: how the collection charge gets documented and billed, and how the requisition, specimen label, courier handoff, and lab portal create privacy obligations most risk analyses never touch.
Carl B. Johnson