HIPAA compliance resources covering vendor management, gap analysis, incident response planning, and documentation requirements under 45 CFR Part 164.
Articles on vendor management, gap analysis, incident response planning, and the documentation requirements under 45 CFR Part 164 that small practices often overlook. Understanding these requirements before an OCR audit or breach investigation can save your organization significant time and expense.
16 min read
Minnesota is the state where the HIPAA treatment exception mostly does not work: the Health Records Act wants a signed, dated consent before a chart leaves the building.
15 min read
Michigan's breach law gives HIPAA-compliant providers a pass, but its Public Health Code, Mental Health Code, and Medical Records Access Act do not. Here is the full state layer.
16 min read
Massachusetts has no single health privacy act, but Chapter 93H, 201 CMR 17.00, and a stack of record-specific statutes reach every practice in the state.
16 min read
Maryland has a medical records act with criminal penalties, a breach law that puts the Attorney General first in line, and a deemed-compliance clause for practices that actually follow HIPAA.
16 min read
Colorado counts medical information as personal information, sets a 30-day breach clock, and tells regulated entities the shortest deadline wins.
16 min read
Arizona wrote HIPAA covered entities out of its breach notification statute and into its medical records statute. Here is what that means for a practice in the state.
11 min read
Patients cannot make you erase a record. They can make you respond by a deadline. If you deny them, they can attach their side of the story to the chart.
10 min read
Ambient documentation is allowed under HIPAA. Turning it on without a BAA, a data-use clause, and a risk analysis entry is how a time-saver becomes a breach report.
11 min read
Federal rules make an ASC chart dense. Often three separate covered entities touch it on a single case. Here is how the Privacy and Security Rules fit a surgery center.
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Walk through your current program with an experienced compliance consultant. Get an honest assessment and a clearer path forward.