Posts tagged with ""
A vendor sends 30 days' notice and your PHI is still sitting in their cloud storage. Here is what a BAA termination clause has to cover, who does what, and what the documentation file looks like afterward.
Carl B. Johnson
Your billing company's cloud host is a downstream business associate — and the chain of BAAs has to reach it. Here's who contracts with whom, what breach notice timelines apply, and what documentation holds up under an OCR investigation.
Carl B. Johnson
If your organization runs a clinic alongside programs that never touch PHI, hybrid entity designation can shrink your HIPAA footprint — but only if you document it correctly and maintain the firewalls.
Carl B. Johnson
A fax-to-email vendor says it won't sign a BAA because it's "just a conduit." Here's the transient-versus-persistent test HHS actually applies, which vendors qualify, and how to document the determination in your file.
Carl B. Johnson
Since 2013, HIPAA business associates answer to OCR directly — but that does not move risk off your practice. Here is exactly which obligations belong to your vendor, which stay with you, and what the paper trail looks like.
Carl B. Johnson
Your managed service provider can read every chart on every workstation. This is the concrete checklist for the BAA for an IT vendor — required clauses, breach clocks, subcontractor language, and the evidence OCR asks for.
Carl B. Johnson
Your billing vendor touches every chart that generates a claim. Here is exactly what the business associate agreement must contain, which terms to negotiate, and what evidence to keep on file.
Carl B. Johnson
The 60-day federal floor for business associate reporting leaves your practice almost no time to notify patients. Here is the BAA breach notification clause language, timeline math, and documentation that actually protects you.
Carl B. Johnson
The nine clauses HIPAA requires in every BAA, the terms you should negotiate but aren't required to, and the signature and review workflow that produces defensible evidence.
Carl B. Johnson
HIPAA never says "wet ink." It says the assurances must be documented in writing. Here's who can sign a business associate agreement, what makes it enforceable evidence, and how to fix an unsigned vendor file before someone asks.
Carl B. Johnson