9 min read
Is Adobe Acrobat Sign HIPAA Compliant?
Adobe names Acrobat Sign a HIPAA-Ready Service and will act as your business associate. The consumer Acrobat your staff already use is not on that list.
Archive
HIPAA Compliance Articles: Page 2
Continue exploring our HIPAA compliance library. These articles cover Security Rule implementation, risk assessment best practices, and breach notification requirements for healthcare organizations of all sizes. Whether you are a covered entity or business associate, these resources break down complex regulatory language into actionable steps your team can follow.
9 min read
9 min read
Is Jotform HIPAA Compliant? BAA and Plan Guide
Jotform will sign a BAA, but only on two plans and only after a setting is switched on. Most practices stop at the plan and never finish the setup.
12 min read
HIPAA vs OSHA for Medical and Dental Offices
The vendor sells "HIPAA and OSHA compliance" as one package. They are two laws from two agencies, and the only thing they share is your break room.
11 min read
HIPAA vs Information Blocking: What Each Rule Requires
The portal holds lab results for three days so the doctor can call first. Under HIPAA that is fine. Under 45 CFR Part 171 it may be information blocking.
11 min read
HIPAA vs FERPA: Which Law Covers Student Health Records
A public school nurse whose district bills Medicaid electronically is inside a HIPAA covered entity and still does not follow the HIPAA Privacy Rule. Here is why, and where the line moves.
11 min read
HIPAA Cyber Insurance: What It Covers and What It Does Not
The renewal application asks whether you enforce multifactor authentication on all remote access. The honest answer is the compliance program, not the checkbox.
11 min read
HIPAA Compliance for Medical Answering Services
Every message an answering service takes for a practice is PHI (protected health information). The service is a business associate, and the Security Rule applies to it directly. The practice needs a signed BAA (business associate agreement) with it. Both sides of that relationship, explained.
10 min read
Does HIPAA Apply to Therapists in Private Practice?
Whether a private-practice therapist is a HIPAA covered entity turns on one question about billing, not on license type or practice size. Here is the test, the cash-only answer, and the duties that apply either way.
10 min read
Does HIPAA Apply to Massage Therapists and Acupuncturists?
Massage therapists and acupuncturists are health care providers under HIPAA's definitions. Most are still not covered entities. The difference is one billing question, and state law fills the gap.
Key terms
Key HIPAA terms used in these articles
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
- Protected Health Information (PHI)
- Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium. 45 CFR 160.103
- Electronic PHI (ePHI)
- PHI that is created, received, maintained, or transmitted in electronic form. 45 CFR 160.103
- Covered Entity
- A health plan, health care clearinghouse, or health care provider that transmits health information electronically. 45 CFR 160.103
- Business Associate
- A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors. 45 CFR 160.103
- Business Associate Agreement (BAA)
- The written contract HIPAA requires between a covered entity and a business associate. 45 CFR 164.502(e), 164.504(e)
- Security Rule
- The standards for protecting ePHI through administrative, physical, and technical safeguards. 45 CFR Part 164, Subpart C
- Security Risk Assessment (SRA)
- The accurate and thorough risk analysis the Security Rule requires you to conduct and document. 45 CFR 164.308(a)(1)(ii)(A)
- Breach Notification Rule
- After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified. 45 CFR 164.400 to 164.414