hipaa.app updates, status and compliance updates
The nine clauses HIPAA requires in every BAA, the terms you should negotiate but aren't required to, and the signature and review workflow that produces defensible evidence.
Carl B. Johnson
HIPAA never says "wet ink." It says the assurances must be documented in writing. Here's who can sign a business associate agreement, what makes it enforceable evidence, and how to fix an unsigned vendor file before someone asks.
Carl B. Johnson
HIPAA names nine things every BAA must do. Here's what each provision has to say, the timelines worth writing in, and the documentation that proves you did it.
Carl B. Johnson
Cloud storage, transcription, scheduling, and backup vendors are business associates — even the ones that never look at your data. Here's how to get a defensible BAA for cloud providers on file, and what evidence to keep.
Carl B. Johnson
A practical breakdown of which vendors require a signed business associate agreement, the nine clauses regulators expect to see, and the paper trail that proves you did it.
Carl B. Johnson
A two-question test for deciding whether a vendor needs a Business Associate Agreement, which common vendors fall outside the rule, and what your signed-agreement evidence should look like when OCR asks.
Carl B. Johnson
A clause-by-clause breakdown of what a compliant business associate agreement contains, which terms HIPAA mandates, which ones you should negotiate, and how to prove the signed file exists when OCR asks.
Carl B. Johnson
Your billing company's offshore coder is not your vendor — but the PHI is still yours. Here's who owes a subcontractor BAA, what it must contain, and what evidence survives an OCR request.
Carl B. Johnson
The mandatory clauses, subcontractor obligations, and breach-notification clocks that every BAA must contain — plus the documentation an OCR investigator will ask your practice to produce.
Carl B. Johnson
An NDA protects your secrets. A BAA protects your patients — and satisfies 45 CFR 164.504(e). Here's how to tell which document a vendor actually needs, and what happens when you sign the wrong one.
Carl B. Johnson