hipaa.app updates, status and compliance updates
The minimum necessary standard is not a philosophy, it is an access-control obligation with documentable evidence. Here is how to build role classes, disclosure protocols, and the audit trail OCR expects.
Carl B. Johnson
A working list of protected health information examples as they actually appear in a clinic — schedules, voicemails, IP addresses, fax cover sheets — plus the inventory and vendor evidence a surveyor will ask you to produce.
Carl B. Johnson
A working definition of PHI for the people who run the practice: the two-part test, the 18 safe harbor identifiers, six edge cases staff routinely misjudge, and the inventory documentation an investigator will ask to see.
Carl B. Johnson
A practical walkthrough of the covered entity definition at 45 CFR 160.103 — the three-part test, the electronic transaction trigger, hybrid entity elections, and the documentation that proves your status when OCR asks.
Carl B. Johnson
OCR's first document request in almost every investigation is your most recent risk analysis. Here's how to scope, score, document, and defend a HIPAA risk assessment that holds up.
Carl B. Johnson
OCR's first document request in almost every investigation is your risk analysis. Here is what the regulation actually requires, who in your practice owns each step, and what the finished evidence file looks like.
Carl B. Johnson
A practical walkthrough of the HIPAA breach notification rule for practice owners and privacy officers: the 60-day clock, the four-factor assessment, the March 1 small-breach filing, and the documentation OCR asks for first.
Carl B. Johnson
A working breakdown of the HIPAA Privacy Rule for practice owners and privacy officers: the deadlines, the role assignments, and the documentation that survives an OCR inquiry.
Carl B. Johnson
The HIPAA Security Rule is enforced through documents, not intentions. Here's what OCR asks for first, what "addressable" really means, and how to build the evidence file before you need it.
Carl B. Johnson
A working HIPAA compliance checklist organized the way investigators actually request evidence — risk analysis, BAAs, policies, training logs, access requests, and breach timelines, each with an owner and a date.
Carl B. Johnson