hipaa.app updates, status and compliance updates
HIPAA recognizes only two de-identification methods: Safe Harbor and expert determination. Here's what each requires, why limited data sets aren't the same thing, and what documentation your practice needs on file.
Carl B. Johnson
HIPAA gives your practice 30 calendar days to fulfill a patient's request for their record, plus one 30-day extension with written notice. Here's the operational workflow, the fee rules, and the evidence you need on file.
Carl B. Johnson
A practical walkthrough of the HIPAA right of access for practice owners and privacy officers: the 30-day clock, what you may charge, the only lawful denial grounds, and the documentation OCR asks for when a patient complains.
Carl B. Johnson
Nine standards under 45 CFR 164.308 carry most of the Security Rule's weight — and most of the documentation burden. Here's who owns each one in a working practice and what evidence an investigator will actually ask for.
Carl B. Johnson
A working breakdown of the five technical safeguard standards in 45 CFR 164.312 — who owns each one in your practice, what the documented evidence looks like, and how to close the common gaps in 90 days.
Carl B. Johnson
Facility access controls, workstation security, and device and media controls are the three standards behind §164.310 — here's who does what, on what schedule, and what the documentation has to show.
Carl B. Johnson
HIPAA training is judged on documentation, not good intentions. Here are the two rules that govern it, the three events that start a clock, and the exact records you need to produce on request.
Carl B. Johnson
Two separate HIPAA rules require you to sanction workforce members who violate your policies — and to document it. Here is the tier structure, the role map, and the file OCR will ask to see.
Carl B. Johnson
Your Security Rule obligation isn't to prevent every incident — it's to have a documented, tested response. Here are the roles, the clocks, and the evidence file that survives an OCR request.
Carl B. Johnson
Section 164.308(a)(7) requires five contingency plan components, three of them non-negotiable. Here is what each one looks like in a real practice, who owns it, and what evidence survives an OCR request.
Carl B. Johnson