hipaa.app updates, status and compliance updates
Personal phones are already in your clinic. This is the operator's guide to writing, enforcing, and documenting a HIPAA BYOD policy that survives an OCR investigation.
Carl B. Johnson
A working HIPAA mobile device policy names owners, sets encryption and enrollment rules, and tells your staff exactly what happens in the first hour after a phone goes missing. Here is how to build and document one.
Carl B. Johnson
The COVID-era telehealth enforcement discretion ended in 2023. Here's what your practice owes now — vendor agreements, risk analysis entries, remote workforce controls, and the evidence an OCR investigator will actually ask to see.
Carl B. Johnson
The COVID-era enforcement discretion for telehealth ended in August 2023. Here is what actually makes a video platform defensible in 2026: the BAA, the configuration settings, and the documentation your privacy officer signs.
Carl B. Johnson
Cloud storage vendors don't make your practice compliant — contracts, configuration, and documentation do. Here's the split of responsibility, the evidence regulators ask for, and a 30-day cleanup plan.
Carl B. Johnson
Fax is still the default channel for referrals, prior auth, and records requests. Here is what a HIPAA compliant fax setup actually requires — vendor BAA terms, workflow controls, and the documentation an OCR investigator will ask for.
Carl B. Johnson
Encryption alone doesn't make email HIPAA compliant. Here's the full stack — BAA, configuration, patient consent, audit logs — and the documentation your privacy officer needs to produce on demand.
Carl B. Johnson
Texting patients is permitted under HIPAA — but only with a documented warning, a recorded patient preference, a signed BAA with your messaging platform, and a risk analysis that mentions SMS. Here's the workflow and the paper trail.
Carl B. Johnson
Paper in the dumpster, hard drives in the copier, labeled specimen containers in the regular trash. A practical walkthrough of HIPAA disposal of PHI: acceptable methods, vendor contracts, role assignments, and the destruction records that prove you did it.
Carl B. Johnson
A marketing vendor asks for "de-identified" data and your billing team exports a CSV with dates of service and full ZIP codes. That file is still PHI. Here's exactly what safe harbor de-identification requires, where practices fail it, and what to document.
Carl B. Johnson