HIPAA Compliance Insights

HIPAA Training

HIPAA Training for Healthcare Workers: What Works

Last year, a 14-person physical therapy clinic in the Midwest got hit with a corrective action plan after a random OCR audit. The finding? Their

Carl B. Johnson · Apr 6, 2026

Protected Health Information Disclosure

Protected Health Information Disclosure: Rules You Must Follow

A receptionist at a New York City dental clinic mentioned a patient's upcoming root canal to the patient's coworker — casually, in

Carl B. Johnson · Apr 6, 2026

PHI Examples

PHI Examples HIPAA: 18 Identifiers You Must Protect

A Faxed Lab Report Sent to the Wrong Number Started It All A nurse at a mid-size clinic in Minnesota faxed a patient's

Carl B. Johnson · Apr 6, 2026

HIPAA Compliance Testing Services

HIPAA Compliance Testing Services: What Actually Works

The Audit That Costs Less Than the Breach A hospital system in Oregon thought its annual checklist was enough. Internal IT signed off every year.

Carl B. Johnson · Apr 5, 2026

Healthcare Emergency Management

Healthcare Emergency Management: HIPAA Rules Still Apply

The Hurricane That Exposed More Than a Hospital's Roof In 2017, Hurricane Harvey flooded a major Texas hospital system. Staff scrambled to evacuate

Carl B. Johnson · Apr 5, 2026

Electronic Health Records

What Act Outlines the Use of Electronic Health Records

In 2011, a small cardiology practice in Phoenix switched from paper charts to an electronic health record system. Within six months, an unencrypted laptop containing

Carl B. Johnson · Apr 4, 2026

Covered Entity vs Business Associate

Covered Entity vs Business Associate: Key Differences

A few years ago, I got a call from the CEO of a mid-sized billing company. His team had been processing claims for a hospital

Carl B. Johnson · Apr 4, 2026

EHR and HIPAA

EHR and HIPAA: What Every Practice Gets Wrong

A $4.3 Million Wake-Up Call Buried in an EHR Audit Log In 2023, the University of Texas MD Anderson Cancer Center lost its years-long

Carl B. Johnson · Apr 4, 2026

Who Regulates HIPAA

Who Regulates HIPAA? The Agencies Behind Enforcement

A Single Complaint to the Wrong Agency Can Cost You Months I got a call last year from a clinic administrator who had filed a

Carl B. Johnson · Apr 3, 2026

Technical Safeguards HIPAA

Technical Safeguards HIPAA: What Most Orgs Get Wrong

In 2018, the University of Texas MD Anderson Cancer Center lost a $4.3 million appeal after OCR found that unencrypted laptops and thumb drives

Carl B. Johnson · Apr 3, 2026

OSHA HIPAA

OSHA HIPAA: Where Workplace Safety Meets Patient Privacy

The Phone Call That Exposed a $1.7 Million Blind Spot A hospital safety officer called me three years ago, panicking. OSHA had requested employee

Carl B. Johnson · Apr 3, 2026

HIPAA Eligibility

HIPAA Eligibility: Who Must Comply and Why It Matters

A $5.1 Million Penalty That Started with a Simple Question In 2017, Memorial Healthcare System in Florida agreed to pay $5.1 million to

Carl B. Johnson · Apr 2, 2026