Posts tagged with ""
Section 164.308(a)(7) requires five contingency plan components, three of them non-negotiable. Here is what each one looks like in a real practice, who owns it, and what evidence survives an OCR request.
Carl B. Johnson
Encryption is "addressable" under the Security Rule, which trips up practices constantly. Here is what to encrypt, where the breach safe harbor applies, and what documentation OCR expects to see.
Carl B. Johnson
The 2013 HIPAA Omnibus Rule rewrote business associate liability, the breach standard, and your Notice of Privacy Practices. Here is what a privacy officer must have on file in 2025 — and how to close the gaps.
Carl B. Johnson
The HITECH Act is where your 60-day breach clock, your business associate liability, and your penalty exposure all come from. Here's the operator's version: deadlines, role assignments, and the documentation that survives an OCR request.
Carl B. Johnson
OCR HIPAA enforcement rarely starts with a raid. It starts with a data request letter and a 30-day deadline. Here is what investigators ask for, who at your practice has to answer, and what evidence has to already exist.
Carl B. Johnson
A practical HIPAA audit checklist built around the documents investigators actually request — risk analysis, BAAs, training rosters, access logs, breach records — with owners, deadlines, and evidence standards for each.
Carl B. Johnson
A practical breakdown of the HIPAA policy set every covered entity must maintain in writing, who owns each document, and the version history and attestation records that prove the policies were real.
Carl B. Johnson
The Part 2 alignment rule sets a February 16, 2026 compliance date for Notice of Privacy Practices changes. Here's what your notice must say, who has to hand it out, and what documentation survives an OCR request.
Carl B. Johnson
A working list of protected health information examples as they actually appear in a clinic — schedules, voicemails, IP addresses, fax cover sheets — plus the inventory and vendor evidence a surveyor will ask you to produce.
Carl B. Johnson
A working definition of PHI for the people who run the practice: the two-part test, the 18 safe harbor identifiers, six edge cases staff routinely misjudge, and the inventory documentation an investigator will ask to see.
Carl B. Johnson