HIPAA Compliance Insights

Safe Harbor Method

Safe Harbor Method HIPAA: De-Identification Guide

In 2023, OCR investigated a research institution that published a dataset it believed was fully de-identified — only to discover that zip codes and dates of

Carl B. Johnson · Dec 15, 2023

Cloud Security

Security Measures for PHI in Cloud-Based Therapy Apps

In early 2024, OCR settled with a telehealth provider for $950,000 after an investigation revealed the organization had deployed a cloud-based therapy platform without

Carl B. Johnson · Dec 15, 2023

HIPAA Compliance

Social Media Firms HIPAA Compliance Expertise Gap

In December 2022, OCR issued a bulletin explicitly warning healthcare organizations about the use of tracking technologies on websites and mobile apps — including pixels from

Carl B. Johnson · Dec 15, 2023

Business Associate Agreement

Subcontractor Business Associate Agreement Requirements

In 2016, OCR settled with North Memorial Health Care of Minnesota for $1.55 million after determining that a business associate had provided PHI access

Carl B. Johnson · Dec 15, 2023

Mental Health Records

Subpoena Mental Health Records: HIPAA Rules You Must Know

A mid-size behavioral health practice in the Southeast received a subpoena demanding the complete treatment records of a current patient involved in a custody dispute.

Carl B. Johnson · Dec 14, 2023

Technical Safeguards

Technical Safeguard Requirements Under HIPAA Security Rule

In 2023, OCR settled with a health system for $1.3 million after investigators found the organization had failed to implement even basic access controls

Carl B. Johnson · Dec 14, 2023

Telehealth Compliance

Telehealth Compliance: What HIPAA Requires in 2025

When HHS announced in late 2024 that the COVID-era telehealth enforcement discretion would not be extended indefinitely, many healthcare organizations realized they had been operating

Carl B. Johnson · Oct 11, 2023

Telehealth HIPAA

Telehealth HIPAA Rules Your Organization Must Follow

When OCR announced in May 2023 that the COVID-era telehealth HIPAA enforcement discretion was ending, thousands of healthcare organizations realized they had been operating on

Carl B. Johnson · Oct 11, 2023

Texas HB300

Texas HB300: What It Adds Beyond Federal HIPAA Rules

When a major Texas health system paid $1.6 million in state penalties for unauthorized disclosures of protected health information, it wasn't a

Carl B. Johnson · Oct 11, 2023

HIPAA Compliance

Text Messaging HIPAA Compliant: What Your Organization Must Know

In 2023, a dental practice in Texas agreed to a $50,000 settlement with OCR after an investigation revealed staff members were texting appointment reminders

Carl B. Johnson · Oct 11, 2023

Texting and HIPAA

Texting and HIPAA: What Your Organization Must Know

In 2023, a dental practice in Texas paid a $50,000 settlement to the HHS Office for Civil Rights after an employee texted patient appointment

Carl B. Johnson · Oct 11, 2023

HIPAA Texting

Texting Patient Information Is Allowed When These Rules Apply

In 2023, a small dental practice in Texas received a $50,000 settlement with OCR after a staff member routinely texted patient appointment details, diagnoses,

Carl B. Johnson · Sep 24, 2023