Business Associate Agreements

Hypermobility Double Jointed Records: Vendor Exposure

One hypermobility workup can push chart data to nine outside organizations in six weeks. Here's how to map that fan-out, sort business associates from treatment partners, and close the BAA gaps before OCR or a vendor breach finds them first.

Carl B. Johnson

— 25 Jun 2026

HIPAA Privacy Rule

Biceps Muscle Tendonitis Intake: Front-Desk Privacy Risks

Shoulder and arm complaints generate referrals, imaging orders, and work-comp paperwork — all of which pass through your front desk. Here's how to close the incidental disclosure gaps in your waiting room without buying new software.

Carl B. Johnson

— 25 Jun 2026

HIPAA Privacy Rule

End Stage Renal Disease Clinics: Front-Desk Privacy Risk

Recurring in-center visits mean the same patients pass your front desk 150 times a year. Here is how to audit sign-in sheets, waiting room layout, transport vendors, and check-in scripts before OCR asks you to.

Carl B. Johnson

— 22 Jun 2026

HIPAA Privacy Rule

Zoledronic Acid Referrals: Records Sharing Done Right

One zoledronic acid infusion order can pull records across four organizations in a week. Here is which disclosures HIPAA permits without authorization, which vendors need a BAA, and how to document the whole chain.

Carl B. Johnson

— 21 Jun 2026

Business Associate Agreements

Pain Exterior Knee Data: Who Touches It Outside Your Walls

One lateral knee complaint can push chart data to nine outside organizations in a week. Here's how to inventory those disclosures, fix the BAA gaps, and handle a vendor breach notice without blowing your deadlines.

Carl B. Johnson

— 21 Jun 2026

HIPAA Privacy Rule

Hyperbilirubinemia Clinics: Front-Desk Privacy Risks

Newborn bilirubin recheck visits stack up in the lobby, move records between three organizations, and put your front desk under pressure. Here is how to keep sign-in sheets, name calls, and lab handoffs inside the incidental disclosure rule.

Carl B. Johnson

— 20 Jun 2026

Chart Retention

Costochondritis Treatment Records: Retention & Disposal

Three separate clocks run on a chest-wall-pain chart: the HIPAA six-year documentation rule, your state's medical record law, and payer contract terms. Here's how to build a retention and destruction schedule that holds up.

Carl B. Johnson

— 16 Jun 2026

Business Associate Agreements

Stress Fracture in Foot: Vendor Risk When Data Leaves

One foot injury encounter can move protected health information through six or seven outside organizations in ten days. Here is how to tell which of them are business associates, and what your agreements need to say before the data moves.

Carl B. Johnson

— 15 Jun 2026

HIPAA Privacy Rule

Family Doctor Referrals: Records Sharing Without Delay

Provider-to-provider treatment disclosures don't require patient authorization, yet most primary care offices still delay referrals waiting for a signature. Here's the records-sharing workflow that keeps referrals moving and your disclosure log defensible.

Carl B. Johnson

— 9 Jun 2026

Business Associate Agreements

Swelling and Pitting Edema: Mapping Your Vendor BAAs

One bilateral leg-swelling encounter can push PHI through a dozen third parties in five days. Here's how to build a vendor map for that pathway and close the BAA gaps it exposes.

Carl B. Johnson

— 7 Jun 2026