hipaa.app updates, status and compliance updates
A signed BAA is the first thing an investigator asks for after a vendor breach. Here are the required clauses, the timelines worth tightening, and the retention rules for every business associate agreement PDF in your files.
Carl B. Johnson
A vendor sends 30 days' notice and your PHI is still sitting in their cloud storage. Here is what a BAA termination clause has to cover, who does what, and what the documentation file looks like afterward.
Carl B. Johnson
Your billing company's cloud host is a downstream business associate — and the chain of BAAs has to reach it. Here's who contracts with whom, what breach notice timelines apply, and what documentation holds up under an OCR investigation.
Carl B. Johnson
If your organization runs a clinic alongside programs that never touch PHI, hybrid entity designation can shrink your HIPAA footprint — but only if you document it correctly and maintain the firewalls.
Carl B. Johnson
A fax-to-email vendor says it won't sign a BAA because it's "just a conduit." Here's the transient-versus-persistent test HHS actually applies, which vendors qualify, and how to document the determination in your file.
Carl B. Johnson
Since 2013, HIPAA business associates answer to OCR directly — but that does not move risk off your practice. Here is exactly which obligations belong to your vendor, which stay with you, and what the paper trail looks like.
Carl B. Johnson
Your managed service provider can read every chart on every workstation. This is the concrete checklist for the BAA for an IT vendor — required clauses, breach clocks, subcontractor language, and the evidence OCR asks for.
Carl B. Johnson
Your billing vendor touches every chart that generates a claim. Here is exactly what the business associate agreement must contain, which terms to negotiate, and what evidence to keep on file.
Carl B. Johnson
Email hosting providers, encryption gateways, e-fax services, and form tools all touch PHI. Here's which ones need a signed BAA, what clauses to check, and what your auditor expects to see in the file.
Carl B. Johnson
The 60-day federal floor for business associate reporting leaves your practice almost no time to notify patients. Here is the BAA breach notification clause language, timeline math, and documentation that actually protects you.
Carl B. Johnson