25 min read
What Is a HIPAA Officer? Role, Requirements & Duties
What a HIPAA compliance officer does day to day. Covers duties, skills, daily tasks, and tips for doing the job well.
HIPAA Compliance Articles: Page 21
Continue exploring our HIPAA compliance library with expert articles on Security Rule implementation, risk assessments, and healthcare cybersecurity. One Guy Consulting publishes in-depth guides, compliance checklists, and practical advice for covered entities and business associates navigating HIPAA requirements.
25 min read
13 min read
HIPAA Compliance Documentation Requirements: What to Keep
What HIPAA says you have to write down. Which records, how long to keep them, how to track versions, and where to store them.
10 min read
Employee HIPAA Training: Essential Topics to Cover
The HIPAA training topics every worker needs. Covers PHI handling, phishing awareness, and training by role.
13 min read
Patient Rights Under HIPAA: What Every Provider Must Know
'What rights do patients have under HIPAA?' Getting a copy of their records, asking for a fix, asking you to hold back, private messages, and what you owe them.
30 min read
HIPAA Assessment Guide: Security Risk Assessment Steps
How to run a HIPAA risk assessment, step by step. What you need, how to spot threats and weak points, how to score risk, and how to fix what you find.
13 min read
HIPAA Security Rule: A Step-by-Step Guide
A step-by-step guide to the HIPAA Security Rule. Covers the three safeguard groups, risk analysis, and how to plan the work.
14 min read
HIPAA Privacy Rule: What You Need to Know
What the HIPAA Privacy Rule asks of you: how PHI may be used and disclosed, what rights a patient has, the minimum necessary standard, and when you need consent.
13 min read
Understanding PHI: A Complete Guide
A full guide to protected health information. What PHI means, the 18 HIPAA identifiers, what counts as ePHI, how to strip identity out of data, and cases from real life.
14 min read
What Is HIPAA? A Guide for Healthcare Teams
HIPAA is a federal law that sets the bar for keeping health data safe. Who it covers, what PHI means, and what you really have to do.
Key HIPAA terms used in these articles
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
- Protected Health Information (PHI)
- Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium (45 CFR 160.103).
- Electronic PHI (ePHI)
- PHI that is created, received, maintained, or transmitted in electronic form (45 CFR 160.103).
- Covered Entity
- A health plan, health care clearinghouse, or health care provider that transmits health information electronically (45 CFR 160.103).
- Business Associate
- A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors (45 CFR 160.103).
- Business Associate Agreement (BAA)
- The written contract HIPAA requires between a covered entity and a business associate (45 CFR 164.502(e), 164.504(e)).
- Security Rule
- The standards for protecting ePHI through administrative, physical, and technical safeguards (45 CFR Part 164, Subpart C).
- Security Risk Assessment (SRA)
- The accurate and thorough risk analysis the Security Rule requires you to conduct and document (45 CFR 164.308(a)(1)(ii)(A)).
- Breach Notification Rule
- After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified (45 CFR 164.400 to 164.414).