hipaa.app updates, status and compliance updates
Pharmacies lose HIPAA cases at the counter, the courier handoff, and the unsigned vendor contract. A practical checklist for pharmacy owners, PICs, and privacy officers heading into 2026.
Carl B. Johnson
Home health agencies carry PHI into driveways, kitchens, and personal phones. Here is what your agency must document, who owns each task, and what the evidence looks like when OCR asks.
Carl B. Johnson
Chiropractic clinics get investigated over records requests, missing BAAs, and open adjusting bays. Here's who does what, by when, and what documentation actually satisfies an OCR investigator.
Carl B. Johnson
A working checklist for therapy practice owners and privacy officers: psychotherapy notes, business associate agreements, the 30-day records clock, telehealth vendors, and the 42 CFR Part 2 compliance date in February 2026.
Carl B. Johnson
A practical breakdown of what HIPAA actually requires from a dental office — vendor agreements, records deadlines, breach clocks, training records — and what the documented evidence has to look like when OCR asks.
Carl B. Johnson
A practical, month-by-month approach to small practice HIPAA compliance for offices with no dedicated compliance staff — what to document, who owns it, and which deadlines actually bite.
Carl B. Johnson
The Privacy Rule requires you to name one person and document it. Here is what that person owes you every month, every deadline they own, and the paper trail that proves the job is actually being done.
Carl B. Johnson
The Security Rule creates the Security Officer role in one sentence and then hands that person a dozen jobs. Here is what those duties actually look like in a working practice, with timelines and the evidence an auditor asks for.
Carl B. Johnson
HIPAA names two required officials and gives them specific, dated obligations. Here is what those duties look like on a calendar, in a file cabinet, and during an OCR investigation.
Carl B. Johnson
No federal agency certifies HIPAA compliance. Here's what the certificate on your vendor's website actually means, what OCR asks for during an investigation, and how to build the evidence file that survives one.
Carl B. Johnson