hipaa.app updates, status and compliance updates
Hypertension diagnosis codes ride on more claims than almost anything else your practice submits — and they travel to clearinghouses, RCM vendors, and analytics tools. Here is the operational and privacy side of managing them.
Carl B. Johnson
Release notes, subprocessor changes, breach disclosures, and rule updates all land in the same inbox and none of them come with instructions. Here is how to triage EHR news into assignable compliance tasks with owners and deadlines.
Carl B. Johnson
Hypertension codes are among the highest-volume diagnoses in most outpatient practices — and they travel through more vendors than almost anything else on your claim. Here's how to run the workflow and control the disclosures.
Carl B. Johnson
The 99213 CPT code drives more established-patient claims than any other office E/M code — and every one of those claims moves PHI through a chain of vendors. Here's the operations and privacy workflow behind it.
Carl B. Johnson
An operations guide to the 99214 CPT code for administrators: how level selection is documented, how to run internal audits without creating new PHI exposure, and which vendors touching the claim need a signed BAA.
Carl B. Johnson
A practice-operations guide to billing physician assistant services: enrollment, supervision documentation, audit response, and the vendor agreements that have to be in place before claims data leaves your building.
Carl B. Johnson
Codes for CPT are protected health information the moment they attach to a patient. Here is how the annual changeover, your vendor list, and records requests intersect — written for administrators, not patients.
Carl B. Johnson
Findings without owners and dates stay open forever. Here is how to write, run, and close a HIPAA corrective action plan that survives an OCR document request — including a worked example and retention rules.
Carl B. Johnson
OCR's public breach portal — the so-called HIPAA wall of shame — lists every breach of 500 or more records, with your practice's name, state, and breach type. Here is what triggers a listing and what your documentation has to prove.
Carl B. Johnson
The 500 record breach threshold determines whether your practice files with HHS within 60 days or on the annual log. Here is how to count, who does what, and what documentation survives an OCR review.
Carl B. Johnson