Posts tagged with ""
An operations guide to how behavioral health practices document code selection, route claims data, and control the vendors who see mental health CPT codes and the PHI attached to them.
Carl B. Johnson
Codes for CPT are protected health information the moment they attach to a patient. Here is how the annual changeover, your vendor list, and records requests intersect — written for administrators, not patients.
Carl B. Johnson
A marketing vendor asks for "de-identified" data and your billing team exports a CSV with dates of service and full ZIP codes. That file is still PHI. Here's exactly what safe harbor de-identification requires, where practices fail it, and what to document.
Carl B. Johnson
The minimum necessary standard is not a philosophy, it is an access-control obligation with documentable evidence. Here is how to build role classes, disclosure protocols, and the audit trail OCR expects.
Carl B. Johnson
A working breakdown of the HIPAA Privacy Rule for practice owners and privacy officers: the deadlines, the role assignments, and the documentation that survives an OCR inquiry.
Carl B. Johnson
A fax-to-email vendor says it won't sign a BAA because it's "just a conduit." Here's the transient-versus-persistent test HHS actually applies, which vendors qualify, and how to document the determination in your file.
Carl B. Johnson
The HHS sample provisions are a floor, not a finished contract. Here's what belongs in your business associate agreement template, who signs it, and what evidence proves you did it.
Carl B. Johnson