Posts tagged with ""
The 500 record breach threshold determines whether your practice files with HHS within 60 days or on the annual log. Here is how to count, who does what, and what documentation survives an OCR review.
Carl B. Johnson
When a regulator, a health plan, or a hospital system asks you to prove HIPAA compliance, they want dated documents with names on them. Here is the file you should already have, who builds each piece, and how long you keep it.
Carl B. Johnson
A practical walkthrough of how to run a HIPAA gap analysis inside a working practice — the inventory, the standard-by-standard review, the remediation plan, and the documentation that survives an OCR request.
Carl B. Johnson
A HIPAA risk register turns your risk analysis into tracked, owned, date-stamped remediation. Here are the exact fields, scoring rules, review cadence, and evidence auditors expect to see.
Carl B. Johnson
Your marketing agency wants your patient list, your website pixel, and your review responses. Here's exactly when a BAA is required, what clauses to insist on, and what your audit file needs to show.
Carl B. Johnson
Your practice runs on cloud services your compliance file has never seen. Here's how HIPAA applies to cloud vendors, what belongs in the BAA, and what evidence an OCR investigator will ask for.
Carl B. Johnson
Your managed service provider holds domain admin, touches every workstation, and can read any chart on the network. Here is what HIPAA requires of them, what belongs in the contract, and what evidence you need on file.
Carl B. Johnson
Pharmacies lose HIPAA cases at the counter, the courier handoff, and the unsigned vendor contract. A practical checklist for pharmacy owners, PICs, and privacy officers heading into 2026.
Carl B. Johnson
Home health agencies carry PHI into driveways, kitchens, and personal phones. Here is what your agency must document, who owns each task, and what the evidence looks like when OCR asks.
Carl B. Johnson
Chiropractic clinics get investigated over records requests, missing BAAs, and open adjusting bays. Here's who does what, by when, and what documentation actually satisfies an OCR investigator.
Carl B. Johnson