Posts tagged with ""
One postpartum recovery encounter can push PHI to six or more outside organizations. Here is how to inventory those vendors, decide who needs a BAA, and tighten the breach-notice clock in your contracts.
Carl B. Johnson
Herbal and supplement documentation lives in odd corners of the chart — intake forms, scanned outside labs, referral letters. Here is how to fulfill a records request that touches all of them without missing the 30-day deadline.
Carl B. Johnson
A practical front-desk privacy audit for practices that see pregnant patients for headache workups: sign-in sheets, waiting room scripts, check-in tablets, and the referral paper trail that leaves your building.
Carl B. Johnson
A single prenatal antiemetic prescription can generate nine or more outbound data flows. Here's how to identify which of those vendors are business associates, which aren't, and how to close the gaps before an auditor or a plaintiff's firm finds them.
Carl B. Johnson
OCR's first document request after a breach is almost always your risk analysis. Here's what a defensible HIPAA risk assessment template contains, who fills out each section, and how long you keep it.
Carl B. Johnson
A routine ENT referral moves protected health information across organizational lines. Here's the permitted-disclosure workflow, the verification step most front desks skip, and the vendor contracts sitting in the middle of it.
Carl B. Johnson
A practical, step-by-step walkthrough of the Security Rule risk analysis requirement — scoping, asset inventory, scoring, remediation, and the documentation OCR actually asks to see.
Carl B. Johnson
A televisit for a spermatic cord complaint touches your intake form, your image storage, your referral packet, and four vendors you may not have papered. Here is the administrative workflow behind it.
Carl B. Johnson
A single serum protein electrophoresis order can touch eight outside organizations before the result lands back in your chart. Here is how to map which of them are business associates, which are not, and what your contracts need to say.
Carl B. Johnson
A single foot-pain workup can generate records across four organizations. Here's how to run the request intake, verification, fee, and vendor workflow without missing the 30-day access deadline.
Carl B. Johnson