Posts tagged with ""
A medical assistant forwards chart screenshots to the state health department. Here is what 45 CFR 164.502(j) actually permits, what 160.316 forbids you from doing next, and the documentation that proves you handled it correctly.
Carl B. Johnson
Patients can complain to you and to the HHS Office for Civil Rights. Here's how the HIPAA complaint process actually unfolds, what OCR asks for, and the records your practice needs on file before the letter arrives.
Carl B. Johnson
OCR has settled multiple cases over practices responding to online reviews with patient details. Here's the social media policy, consent workflow, and vendor paperwork that keeps your practice out of that pile.
Carl B. Johnson
A working HIPAA mobile device policy names owners, sets encryption and enrollment rules, and tells your staff exactly what happens in the first hour after a phone goes missing. Here is how to build and document one.
Carl B. Johnson
The COVID-era enforcement discretion for telehealth ended in August 2023. Here is what actually makes a video platform defensible in 2026: the BAA, the configuration settings, and the documentation your privacy officer signs.
Carl B. Johnson
Cloud storage vendors don't make your practice compliant — contracts, configuration, and documentation do. Here's the split of responsibility, the evidence regulators ask for, and a 30-day cleanup plan.
Carl B. Johnson
Encryption alone doesn't make email HIPAA compliant. Here's the full stack — BAA, configuration, patient consent, audit logs — and the documentation your privacy officer needs to produce on demand.
Carl B. Johnson
A practical walkthrough of the HIPAA right of access for practice owners and privacy officers: the 30-day clock, what you may charge, the only lawful denial grounds, and the documentation OCR asks for when a patient complains.
Carl B. Johnson
A working breakdown of the five technical safeguard standards in 45 CFR 164.312 — who owns each one in your practice, what the documented evidence looks like, and how to close the common gaps in 90 days.
Carl B. Johnson
Two separate HIPAA rules require you to sanction workforce members who violate your policies — and to document it. Here is the tier structure, the role map, and the file OCR will ask to see.
Carl B. Johnson