hipaa.app updates, status and compliance updates
A medical assistant who left 14 months ago still has an active EHR login. That single fact fails four separate Security Rule provisions. Here is what HIPAA access controls require, who owns each task, and what the documentation has to show.
Carl B. Johnson
Encryption is "addressable" under the Security Rule, which trips up practices constantly. Here is what to encrypt, where the breach safe harbor applies, and what documentation OCR expects to see.
Carl B. Johnson
The 2013 HIPAA Omnibus Rule rewrote business associate liability, the breach standard, and your Notice of Privacy Practices. Here is what a privacy officer must have on file in 2025 — and how to close the gaps.
Carl B. Johnson
The HITECH Act is where your 60-day breach clock, your business associate liability, and your penalty exposure all come from. Here's the operator's version: deadlines, role assignments, and the documentation that survives an OCR request.
Carl B. Johnson
OCR HIPAA enforcement rarely starts with a raid. It starts with a data request letter and a 30-day deadline. Here is what investigators ask for, who at your practice has to answer, and what evidence has to already exist.
Carl B. Johnson
A practical HIPAA audit checklist built around the documents investigators actually request — risk analysis, BAAs, training rosters, access logs, breach records — with owners, deadlines, and evidence standards for each.
Carl B. Johnson
HIPAA violation penalties are priced by culpability tier and multiplied per violation. Here is how OCR builds the number, and the documentation that keeps yours small.
Carl B. Johnson
The Privacy Rule and the Security Rule impose two different training obligations, and OCR asks for records covering six years. Here is who must be trained, on what schedule, and what your documentation file needs to contain.
Carl B. Johnson
A practical breakdown of the HIPAA policy set every covered entity must maintain in writing, who owns each document, and the version history and attestation records that prove the policies were real.
Carl B. Johnson
The Part 2 alignment rule sets a February 16, 2026 compliance date for Notice of Privacy Practices changes. Here's what your notice must say, who has to hand it out, and what documentation survives an OCR request.
Carl B. Johnson