Posts tagged with ""
A medical assistant who left 14 months ago still has an active EHR login. That single fact fails four separate Security Rule provisions. Here is what HIPAA access controls require, who owns each task, and what the documentation has to show.
Carl B. Johnson
Encryption is "addressable" under the Security Rule, which trips up practices constantly. Here is what to encrypt, where the breach safe harbor applies, and what documentation OCR expects to see.
Carl B. Johnson
OCR's first document request in almost every investigation is your risk analysis. Here is what the regulation actually requires, who in your practice owns each step, and what the finished evidence file looks like.
Carl B. Johnson
The HIPAA Security Rule is enforced through documents, not intentions. Here's what OCR asks for first, what "addressable" really means, and how to build the evidence file before you need it.
Carl B. Johnson
A working HIPAA compliance checklist organized the way investigators actually request evidence — risk analysis, BAAs, policies, training logs, access requests, and breach timelines, each with an owner and a date.
Carl B. Johnson
A signed BAA is the first thing an investigator asks for after a vendor breach. Here are the required clauses, the timelines worth tightening, and the retention rules for every business associate agreement PDF in your files.
Carl B. Johnson
Your billing company's cloud host is a downstream business associate — and the chain of BAAs has to reach it. Here's who contracts with whom, what breach notice timelines apply, and what documentation holds up under an OCR investigation.
Carl B. Johnson
Since 2013, HIPAA business associates answer to OCR directly — but that does not move risk off your practice. Here is exactly which obligations belong to your vendor, which stay with you, and what the paper trail looks like.
Carl B. Johnson
Your managed service provider can read every chart on every workstation. This is the concrete checklist for the BAA for an IT vendor — required clauses, breach clocks, subcontractor language, and the evidence OCR asks for.
Carl B. Johnson
Cloud storage, transcription, scheduling, and backup vendors are business associates — even the ones that never look at your data. Here's how to get a defensible BAA for cloud providers on file, and what evidence to keep.
Carl B. Johnson