Posts tagged with ""
Findings without owners and dates stay open forever. Here is how to write, run, and close a HIPAA corrective action plan that survives an OCR document request — including a worked example and retention rules.
Carl B. Johnson
OCR's public breach portal — the so-called HIPAA wall of shame — lists every breach of 500 or more records, with your practice's name, state, and breach type. Here is what triggers a listing and what your documentation has to prove.
Carl B. Johnson
A practical walkthrough of the HIPAA breach reporting timeline: when the 60-day clock starts, who gets notified in what order, the March 1 annual filing, and the documentation OCR will ask for.
Carl B. Johnson
A letter from an OCR regional office typically gives you about 30 days to produce policies, your risk analysis, BAAs, and training records. Here's how to organize an OCR investigation response that holds up — owners, timelines, and the evidence you actually need to attach.
Carl B. Johnson
When a regulator, a health plan, or a hospital system asks you to prove HIPAA compliance, they want dated documents with names on them. Here is the file you should already have, who builds each piece, and how long you keep it.
Carl B. Johnson
Your risk analysis produced a list of gaps. A HIPAA remediation plan is what converts that list into dated, assigned, evidenced work — and it's the document investigators ask for second.
Carl B. Johnson
Your marketing agency wants your patient list, your website pixel, and your review responses. Here's exactly when a BAA is required, what clauses to insist on, and what your audit file needs to show.
Carl B. Johnson
Your practice runs on cloud services your compliance file has never seen. Here's how HIPAA applies to cloud vendors, what belongs in the BAA, and what evidence an OCR investigator will ask for.
Carl B. Johnson
Your managed service provider holds domain admin, touches every workstation, and can read any chart on the network. Here is what HIPAA requires of them, what belongs in the contract, and what evidence you need on file.
Carl B. Johnson
Medical billing companies are business associates with direct liability under HIPAA. Here is what your BAA, risk analysis, breach clock, and audit file need to contain — and who owns each piece.
Carl B. Johnson