Posts tagged with ""
A HIPAA risk register turns your risk analysis into tracked, owned, date-stamped remediation. Here are the exact fields, scoring rules, review cadence, and evidence auditors expect to see.
Carl B. Johnson
Your practice runs on cloud services your compliance file has never seen. Here's how HIPAA applies to cloud vendors, what belongs in the BAA, and what evidence an OCR investigator will ask for.
Carl B. Johnson
Medical billing companies are business associates with direct liability under HIPAA. Here is what your BAA, risk analysis, breach clock, and audit file need to contain — and who owns each piece.
Carl B. Johnson
A practical, month-by-month approach to small practice HIPAA compliance for offices with no dedicated compliance staff — what to document, who owns it, and which deadlines actually bite.
Carl B. Johnson
Personal phones are already in your clinic. This is the operator's guide to writing, enforcing, and documenting a HIPAA BYOD policy that survives an OCR investigation.
Carl B. Johnson
A working HIPAA mobile device policy names owners, sets encryption and enrollment rules, and tells your staff exactly what happens in the first hour after a phone goes missing. Here is how to build and document one.
Carl B. Johnson
Fax is still the default channel for referrals, prior auth, and records requests. Here is what a HIPAA compliant fax setup actually requires — vendor BAA terms, workflow controls, and the documentation an OCR investigator will ask for.
Carl B. Johnson
A working breakdown of the five technical safeguard standards in 45 CFR 164.312 — who owns each one in your practice, what the documented evidence looks like, and how to close the common gaps in 90 days.
Carl B. Johnson
Facility access controls, workstation security, and device and media controls are the three standards behind §164.310 — here's who does what, on what schedule, and what the documentation has to show.
Carl B. Johnson
Your Security Rule obligation isn't to prevent every incident — it's to have a documented, tested response. Here are the roles, the clocks, and the evidence file that survives an OCR request.
Carl B. Johnson