Omnibus Rule
The Primary Purpose of the Omnibus Rule Is To
In January 2013, HHS dropped a 563-page regulatory hammer that reshaped every corner of HIPAA compliance. The Omnibus Rule wasn't a minor tweak.
Carl B. Johnson
Healthcare Chief Information Security Officer (CISO), Virtual Privacy Officer and HIPAA Compliance Educator and National Speaker on Healthcare Privacy & Security
Protected Health Information
Which of the Following Is Protected Health Information?
A nurse texts a patient's lab results to a colleague using a personal phone. A receptionist confirms an appointment over the phone to
HIPAA Covered Entity
Under HIPAA a Covered Entity Is Defined As: Guide
A home health aide I worked with once told me, "We're too small to be a covered entity." Her agency had
HIPAA Patient Identifiers
HIPAA Patient Identifiers: The 18 Data Points That Trigger Compliance
A hospital employee in Texas once looked up her ex-husband's medical records out of curiosity. She didn't change anything. She didn&
HIPAA Compliance Forms
HIPAA Compliance Forms for Employers: What You Actually Need
A hospital system in New York handed HHS investigators a three-ring binder full of policies during an audit. The binder looked impressive — hundreds of pages,
HIPAA Violations
What Violates HIPAA? Real Cases and Real Fines
A Single Stolen Laptop Cost This Health System $3.9 Million In 2018, the University of Rochester Medical Center (URMC) settled with the Office for
PHI Meaning
PHI Meaning: What Counts as Protected Health Info
A Receptionist, a Sticky Note, and a $1.5 Million Fine A front-desk employee at a specialty clinic jotted down a patient's name,
HIPAA Penalties
Punishment for Violating HIPAA: Real Penalties Explained
In 2018, a small dermatology practice in Massachusetts agreed to pay $150,000 to the Office for Civil Rights after a physician threw patient records
HIPAA Breach Notification Rule
What Is the Purpose of the HIPAA Breach Notification Rule?
In 2017, Presence Health paid $475,000 to the Office for Civil Rights after a single mistake: they waited too long to notify patients about
HIPAA Transactional Print
HIPAA Transactional Print: Protect PHI on Paper
The Envelope That Ended Up at the Wrong Address A few years ago, a large health plan outsourced its Explanation of Benefits mailings to a
HIPAA Privacy Form
HIPAA Privacy Form: What Most Practices Get Wrong
That Stack of Forms Your Front Desk Hands Out? It Might Be Wrong. I once walked into a three-provider medical practice in Georgia and asked
HIPAA Training Requirements
HIPAA Training Requirements: What the Law Actually Says
A small pediatric clinic in Colorado thought they had HIPAA handled. They'd trained their staff once — back in 2014. When OCR came knocking