Posts tagged with ""
HIPAA names nine things every BAA must do. Here's what each provision has to say, the timelines worth writing in, and the documentation that proves you did it.
Carl B. Johnson
Cloud storage, transcription, scheduling, and backup vendors are business associates — even the ones that never look at your data. Here's how to get a defensible BAA for cloud providers on file, and what evidence to keep.
Carl B. Johnson
A two-question test for deciding whether a vendor needs a Business Associate Agreement, which common vendors fall outside the rule, and what your signed-agreement evidence should look like when OCR asks.
Carl B. Johnson
A clause-by-clause breakdown of what a compliant business associate agreement contains, which terms HIPAA mandates, which ones you should negotiate, and how to prove the signed file exists when OCR asks.
Carl B. Johnson
Your billing company's offshore coder is not your vendor — but the PHI is still yours. Here's who owes a subcontractor BAA, what it must contain, and what evidence survives an OCR request.
Carl B. Johnson
The mandatory clauses, subcontractor obligations, and breach-notification clocks that every BAA must contain — plus the documentation an OCR investigator will ask your practice to produce.
Carl B. Johnson
A practical, vendor-by-vendor method for deciding who needs a business associate agreement, which exceptions actually apply, and what documented proof looks like when OCR asks.
Carl B. Johnson
The HHS sample provisions are a floor, not a finished contract. Here's what belongs in your business associate agreement template, who signs it, and what evidence proves you did it.
Carl B. Johnson
A working explainer on business associate agreements: which vendors need one, the nine required terms, subcontractor obligations, retention rules, and the evidence an auditor actually asks to see.
Carl B. Johnson