HIPAA Compliance Insights

HIPAA Record Storage

HIPAA Record Storage Requirements: What You Must Keep

In 2023, OCR settled with a New England dermatology practice for $300,640 after an investigation revealed that records containing protected health information were stored

Carl B. Johnson · Jul 4, 2025

HIPAA Records Retention

HIPAA Records Retention Policy: What You Must Keep

In 2023, a mid-sized clinic in the Southeast received a records request from OCR during a compliance review — and couldn't produce its risk

Carl B. Johnson · Jul 4, 2025

HIPAA Patient Rights

HIPAA Regulations Establish a Floor of Patient Rights

When Maryland enacted its strict genetic information privacy law and California expanded patient access rights beyond what federal rules require, many healthcare organizations asked the

Carl B. Johnson · Jul 4, 2025

HIPAA Regulations

HIPAA Regulations for Medical Records Storage Explained

In 2023, OCR settled with a New England dermatology practice for $300,640 after an investigation revealed that protected health information stored on a network

Carl B. Johnson · Jul 4, 2025

HIPAA Authorization

HIPAA Release Authorization Form: What Your Organization Must Include

In 2023, OCR investigated a mid-sized specialty clinic that had been using the same patient authorization form since 2009. The form lacked three of the

Carl B. Johnson · Jul 4, 2025

HIPAA Release of Information

HIPAA Release of Information Requirements Explained

In 2023, OCR settled with a New England dermatology practice for $300,640 after an investigation revealed the organization had disclosed protected health information to

Carl B. Johnson · Jul 4, 2025

HIPAA Requirements

HIPAA Requirement Basics Every Covered Entity Must Know

In February 2024, OCR announced a $4.75 million settlement with Montefiore Medical Center after a former employee stole the protected health information of over

Carl B. Johnson · Jul 4, 2025

HIPAA Data Storage

HIPAA Requirements for Data Storage: A Practical Guide

In June 2023, OCR settled with a dental practice for $350,000 after an investigation revealed unencrypted patient records stored on a network server with

Carl B. Johnson · May 3, 2025

Accounting of Disclosures

HIPAA Requires an Accounting of Disclosures: Your Guide

In 2011, a small physician practice in the Midwest received a patient's written request for an accounting of disclosures. The office manager had

Carl B. Johnson · May 3, 2025

HIPAA Retention Policy

HIPAA Retention Policy: What You Must Keep and For How Long

In 2023, OCR settled with a dental practice for $350,000 after an investigation revealed the organization had no documentation of its risk analysis, policies,

Carl B. Johnson · May 3, 2025

HIPAA Rights

HIPAA Rights Violation: What OCR Enforces and How to Comply

In 2019, OCR launched its HIPAA Right of Access Initiative — and since then, it has settled more than 45 enforcement actions specifically targeting organizations that

Carl B. Johnson · May 3, 2025

HIPAA Risk Assessment

HIPAA Risk Assessment Requirement: What OCR Expects

In February 2023, OCR settled with a health system for $1.25 million after investigators found a fundamental gap: the organization had never conducted a

Carl B. Johnson · May 3, 2025