Posts tagged with ""
Your risk analysis is the first document OCR requests after a breach report. Here's who owns it, what the nine required elements look like on paper, and how to build a 12-month cycle your practice can actually sustain.
Carl B. Johnson
When OCR opens an investigation, the first document they request is your risk analysis. Here's how a small practice scopes, performs, and documents one that survives review.
Carl B. Johnson
OCR's first document request after a breach is almost always your risk analysis. Here's what a defensible HIPAA risk assessment template contains, who fills out each section, and how long you keep it.
Carl B. Johnson
A practical, step-by-step walkthrough of the Security Rule risk analysis requirement — scoping, asset inventory, scoring, remediation, and the documentation OCR actually asks to see.
Carl B. Johnson
A working guide to the HIPAA risk analysis requirement under 45 CFR 164.308(a)(1)(ii)(A) — the nine elements OCR looks for, who owns each step, and what defensible documentation actually contains.
Carl B. Johnson
Item 3 on almost every OCR data request asks for your most recent risk analysis. Here's what a compliant security risk analysis under HIPAA contains, who performs it, how often it repeats, and what the documented evidence actually looks like.
Carl B. Johnson
OCR's first document request after a breach is almost always your risk analysis. Here's what a defensible HIPAA security risk assessment contains, who owns each step, and what the paper trail looks like six years later.
Carl B. Johnson
A same-day telehealth visit for ear pain touches your scheduling widget, your video vendor, your image storage, and an ENT referral. Here is the intake, consent, and vendor workflow that keeps those handoffs defensible.
Carl B. Johnson
Remote monitoring management time still shows up in comp true-ups and payer audits three years later. Here's how to verify the 99457 work RVU, assign credit correctly, and control the vendor-held time logs behind the claim.
Carl B. Johnson
Release notes, subprocessor changes, breach disclosures, and rule updates all land in the same inbox and none of them come with instructions. Here is how to triage EHR news into assignable compliance tasks with owners and deadlines.
Carl B. Johnson