Guidance on HIPAA administrative safeguards, technical controls, policy development, and compliance program management for covered entities and business associates.
Practical resources on HIPAA administrative safeguards, technical controls, and policy development to help your organization build and maintain a defensible compliance program. These articles address real-world implementation challenges that small and mid-sized healthcare practices face during audits and risk assessments.
12 min read
A billing company never treats a patient, yet it often holds more complete patient records than its clients do. HIPAA calls that a business associate, and the Security Rule applies to it directly.
12 min read
A pediatric chart has two audiences from day one, and by the teenage years those audiences disagree. HIPAA decides who counts as the "individual," and it hands the hardest calls to state law.
13 min read
A partner in the exam room, a genetic screen in the portal, a subpoena for prenatal records, and a federal rule a court threw out. OB/GYN is where HIPAA gets tested weekly.
10 min read
A dermatology chart is mostly pictures. Total body photography, dermoscopy images, and before-and-after shots are all P.H.I., and the phone that took them is a device the Security Rule has opinions about.
15 min read
Washington's breach law runs a 30-day clock, its health records act gives patients 15 working days, and its My Health My Data Act sits just outside HIPAA. Here is the whole state layer.
16 min read
Virginia recognizes a right of privacy in the health record itself, caps breach penalties at $150,000 per breach, and leaves HIPAA entities out of its consumer privacy act.
14 min read
Tennessee wrote HIPAA-covered entities out of its 45-day breach statute and out of its new consumer privacy act, which makes the federal program the whole game for most practices.
16 min read
Older guides tell Ohio practices to plan around a 45-day state breach clock. The statute exempts HIPAA covered entities outright. What actually stacks on HIPAA in Ohio is the records access and fee law, the mental health and HIV confidentiality sections, and a litigation defense for practices with a real Security Rule program.
16 min read
North Carolina's breach law reaches paper records, requires an Attorney General report for every breach that triggers notice, and makes a violation an unfair trade practice. Here is how it fits with HIPAA.
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Walk through your current program with an experienced compliance consultant. Get an honest assessment and a clearer path forward.