hipaa.app updates, status and compliance updates
A health system's procurement portal wants your "HIPAA certification certificate" in ten business days. No such federal credential exists. Here's what to send instead, and what documentation actually holds up under an OCR investigation.
Carl B. Johnson
A practical breakdown of HIPAA vs GDPR for practice owners and privacy officers: who each law covers, the two breach clocks, contract differences, and how to document which regime applies to your patient data.
Carl B. Johnson
A school district asks for a student's chart. Whether HIPAA or FERPA controls that record changes who signs, what you may release, and what documentation you keep on file.
Carl B. Johnson
HIPAA rarely wipes out your state's privacy statutes — it sets a minimum. Here's how to run a preemption analysis, build a state-law matrix, and keep documented evidence your practice followed the stricter rule.
Carl B. Johnson
A medical assistant forwards chart screenshots to the state health department. Here is what 45 CFR 164.502(j) actually permits, what 160.316 forbids you from doing next, and the documentation that proves you handled it correctly.
Carl B. Johnson
Patients can complain to you and to the HHS Office for Civil Rights. Here's how the HIPAA complaint process actually unfolds, what OCR asks for, and the records your practice needs on file before the letter arrives.
Carl B. Johnson
A signed form is not automatically a valid authorization. Here are the required elements, the situations that always demand one, and the documentation an OCR investigator will ask for.
Carl B. Johnson
A HIPAA authorization form that's missing an expiration date or a revocation statement is invalid — and disclosing on it is an impermissible disclosure. Here's the full element checklist, the four defect conditions, and the workflow that keeps your releases defensible.
Carl B. Johnson
A practical breakdown of when patient authorization is required before you email, text, or advertise — plus the exceptions, the vendor contracts, and the documentation your privacy officer needs on file.
Carl B. Johnson
OCR has settled multiple cases over practices responding to online reviews with patient details. Here's the social media policy, consent workflow, and vendor paperwork that keeps your practice out of that pile.
Carl B. Johnson