HIPAA Right of Access

Scaphoid Fracture Records Requests: Timelines & Access

Wrist injury charts get split across urgent care, an imaging center, and a hand surgeon — then a records request arrives asking for all of it. Here's the access timeline, verification standard, fee rules, and vendor paperwork behind that request.

Carl B. Johnson

— 2 Jun 2026

HIPAA Compliance

Treating Herniated Lumbar Disc: Front-Desk Privacy Gaps

Sign-in sheets, waiting-room callbacks, attorney faxes, and check-in tablets create the most common privacy exposures in a referral-heavy spine practice. Here is the administrative fix list, with role assignments and a 90-day plan.

Carl B. Johnson

— 1 Jun 2026

Business Associate Agreements

Stages of Change Vendors: Mapping Every BAA You Need

Behavioral readiness programs generate PHI across coaching platforms, SMS reminder tools, referral partners, and analytics vendors. Here is how to build the vendor map and close the BAA gaps before an auditor does it for you.

Carl B. Johnson

— 1 Jun 2026

Telehealth Compliance

PREVENT Calculator Visits: Telehealth Intake Privacy

A telehealth risk-assessment visit touches an intake form vendor, a video platform, a lab feed, and your chart. Here is how to map consent, BAAs, and records handling before the volume arrives.

Carl B. Johnson

— 30 May 2026

HIPAA

Bipolar Depression Treatment Data: Vendor BAA Exposure

A single behavioral health encounter can push protected health information through a dozen outside organizations in 72 hours. Here is how to map that path, reconcile your business associate list, and close the contract gaps before OCR or a breach finds them.

Carl B. Johnson

— 30 May 2026

HIPAA Compliance

Dermabond Records: What Your Practice Must Capture and Keep

A five-minute skin adhesive closure generates photos, a lot number, a consent, and a records trail that three different requesters will come looking for. Here is the capture, retention, and release workflow your staff should be running.

Carl B. Johnson

— 30 May 2026

HIPAA Privacy Rule

Nail Fungus Fingernails Treatment: Front-Desk Privacy

A practical look at the front-desk privacy exposure created by nail fungus fingernails treatment visits: sign-in sheets, waiting room acoustics, clinical photography, referral hand-offs, and the vendors that touch all of it.

Carl B. Johnson

— 29 May 2026

HIPAA Compliance

High Calcium in Blood: Mapping the Vendors Needing BAAs

A single elevated calcium result can move a patient's chart through six or more outside organizations in two weeks. Here's how to inventory that data flow and confirm every stop has a signed BAA behind it.

Carl B. Johnson

— 29 May 2026

HIPAA Compliance

Doxy Antibiotic for Lyme Disease: Portal Message Policy

A single portal thread about an antibiotic follow-up can pull in a lab, a specialist, a pharmacy, and two vendors you never signed a BAA with. Here is the administrative workflow that keeps it contained.

Carl B. Johnson

— 29 May 2026

HIPAA Compliance

NPI Number Lookup Records: Retention and Destruction

Every NPI verification your staff performs leaves an artifact somewhere — a screenshot, a credentialing file note, a clearinghouse log. Here is how long to keep those records, who owns the clock, and how to destroy them defensibly.

Carl B. Johnson

— 28 May 2026