Posts tagged with ""
A practical walkthrough of the covered entity definition at 45 CFR 160.103 — the three-part test, the electronic transaction trigger, hybrid entity elections, and the documentation that proves your status when OCR asks.
Carl B. Johnson
A practical walkthrough of the HIPAA breach notification rule for practice owners and privacy officers: the 60-day clock, the four-factor assessment, the March 1 small-breach filing, and the documentation OCR asks for first.
Carl B. Johnson
A signed BAA is the first thing an investigator asks for after a vendor breach. Here are the required clauses, the timelines worth tightening, and the retention rules for every business associate agreement PDF in your files.
Carl B. Johnson
Your billing company's cloud host is a downstream business associate — and the chain of BAAs has to reach it. Here's who contracts with whom, what breach notice timelines apply, and what documentation holds up under an OCR investigation.
Carl B. Johnson
If your organization runs a clinic alongside programs that never touch PHI, hybrid entity designation can shrink your HIPAA footprint — but only if you document it correctly and maintain the firewalls.
Carl B. Johnson
A fax-to-email vendor says it won't sign a BAA because it's "just a conduit." Here's the transient-versus-persistent test HHS actually applies, which vendors qualify, and how to document the determination in your file.
Carl B. Johnson
Since 2013, HIPAA business associates answer to OCR directly — but that does not move risk off your practice. Here is exactly which obligations belong to your vendor, which stay with you, and what the paper trail looks like.
Carl B. Johnson
Email hosting providers, encryption gateways, e-fax services, and form tools all touch PHI. Here's which ones need a signed BAA, what clauses to check, and what your auditor expects to see in the file.
Carl B. Johnson
The 60-day federal floor for business associate reporting leaves your practice almost no time to notify patients. Here is the BAA breach notification clause language, timeline math, and documentation that actually protects you.
Carl B. Johnson
The nine clauses HIPAA requires in every BAA, the terms you should negotiate but aren't required to, and the signature and review workflow that produces defensible evidence.
Carl B. Johnson