Posts tagged with ""
One postpartum recovery encounter can push PHI to six or more outside organizations. Here is how to inventory those vendors, decide who needs a BAA, and tighten the breach-notice clock in your contracts.
Carl B. Johnson
Your risk analysis is the first document OCR requests after a breach report. Here's who owns it, what the nine required elements look like on paper, and how to build a 12-month cycle your practice can actually sustain.
Carl B. Johnson
Herbal and supplement documentation lives in odd corners of the chart — intake forms, scanned outside labs, referral letters. Here is how to fulfill a records request that touches all of them without missing the 30-day deadline.
Carl B. Johnson
When OCR opens an investigation, the first document they request is your risk analysis. Here's how a small practice scopes, performs, and documents one that survives review.
Carl B. Johnson
A screening encounter generates more record artifacts than most practices realize. Here is the documentation, retention, and release workflow your staff needs before the first request arrives.
Carl B. Johnson
A practical front-desk privacy audit for practices that see pregnant patients for headache workups: sign-in sheets, waiting room scripts, check-in tablets, and the referral paper trail that leaves your building.
Carl B. Johnson
A practical policy guide for practice administrators: how to route, log, and safeguard patient portal and text messages generated by maintenance inhaler follow-up, without pushing front-desk staff into clinical territory.
Carl B. Johnson
High-cost oral antibiotics generate prior authorizations, pharmacy-benefit claims, and appeal packets that move chart data outside your walls. Here is who touches that PHI and which of them need a signed BAA.
Carl B. Johnson
A working guide to the HIPAA risk analysis requirement under 45 CFR 164.308(a)(1)(ii)(A) — the nine elements OCR looks for, who owns each step, and what defensible documentation actually contains.
Carl B. Johnson
One fluid-status workup can move protected health information through a dozen outside organizations. Here is how to inventory them, decide which require a Business Associate Agreement, and close the gaps before an auditor finds them.
Carl B. Johnson