hipaa.app updates, status and compliance updates
A practical walkthrough of the HIPAA breach reporting timeline: when the 60-day clock starts, who gets notified in what order, the March 1 annual filing, and the documentation OCR will ask for.
Carl B. Johnson
A letter from an OCR regional office typically gives you about 30 days to produce policies, your risk analysis, BAAs, and training records. Here's how to organize an OCR investigation response that holds up — owners, timelines, and the evidence you actually need to attach.
Carl B. Johnson
When a regulator, a health plan, or a hospital system asks you to prove HIPAA compliance, they want dated documents with names on them. Here is the file you should already have, who builds each piece, and how long you keep it.
Carl B. Johnson
Your risk analysis produced a list of gaps. A HIPAA remediation plan is what converts that list into dated, assigned, evidenced work — and it's the document investigators ask for second.
Carl B. Johnson
A practical walkthrough of how to run a HIPAA gap analysis inside a working practice — the inventory, the standard-by-standard review, the remediation plan, and the documentation that survives an OCR request.
Carl B. Johnson
A HIPAA risk register turns your risk analysis into tracked, owned, date-stamped remediation. Here are the exact fields, scoring rules, review cadence, and evidence auditors expect to see.
Carl B. Johnson
Your marketing agency wants your patient list, your website pixel, and your review responses. Here's exactly when a BAA is required, what clauses to insist on, and what your audit file needs to show.
Carl B. Johnson
Your practice runs on cloud services your compliance file has never seen. Here's how HIPAA applies to cloud vendors, what belongs in the BAA, and what evidence an OCR investigator will ask for.
Carl B. Johnson
Your managed service provider holds domain admin, touches every workstation, and can read any chart on the network. Here is what HIPAA requires of them, what belongs in the contract, and what evidence you need on file.
Carl B. Johnson
Medical billing companies are business associates with direct liability under HIPAA. Here is what your BAA, risk analysis, breach clock, and audit file need to contain — and who owns each piece.
Carl B. Johnson