hipaa.app updates, status and compliance updates
Pulmonary function testing generates records in four places at once — paper tracings, PDF reports, device memory, and a third-party over-read. Here is how to set retention clocks and destroy each one defensibly.
Carl B. Johnson
A single two-month well-child visit generates a claim, a registry submission, a state program inventory record, and a daycare form request. Here's who touches the PHI at each step and where your BAA list and disclosure log usually fall short.
Carl B. Johnson
A single heel pain referral can move chart data through primary care, imaging, podiatry, physical therapy, and a DME supplier inside two weeks. Here's the permitted-disclosure workflow, BAA map, and audit checklist your practice needs.
Carl B. Johnson
A telehealth follow-up for a pessary device touches your intake form vendor, your video platform, your e-signature tool, and often a supplier. Here's how to map the consent, records, and BAA workflow before the next appointment block fills.
Carl B. Johnson
One newly documented MS diagnosis can touch a dozen outside organizations in ninety days. Here is how to inventory those disclosures, decide who needs a BAA, and close the gaps before a records request or a breach forces the question.
Carl B. Johnson
A records request for a patient treated with Dificid pulls in specialty pharmacy, prior authorization, and outside consult records. Here's how to verify the requester, hold the 30-day clock, and keep your vendor paperwork clean.
Carl B. Johnson
A muscle relaxant encounter generates a portal thread, an e-prescribing transmission, and a records request from a workers' comp adjuster six weeks later. Here's the capture, retention, and release workflow your staff needs.
Carl B. Johnson
Sign-in sheets, check-in phone calls, and corridor whiteboards create the most common privacy complaints in a vein practice. Here is what HIPAA actually permits at the front desk, and how to document the safeguards you already use.
Carl B. Johnson
A short, low-acuity encounter can still touch eight or nine outside vendors. Here's how to trace the data flow behind an emotional support animal letter request and decide which vendors need a signed business associate agreement.
Carl B. Johnson
Antibiotic follow-up messages are among the highest-volume, highest-risk threads in a patient portal. Here's how to route them, who may touch them, and which vendor agreements have to be in place first.
Carl B. Johnson