HIPAA Compliance Insights

PHI Disclosure

PHI To Third Parties: What HIPAA Actually Allows

A hospital employee in Texas forwarded a patient's lab results to a family member who called and asked nicely. No written authorization. No

Carl B. Johnson · Jun 30, 2026

Business Associate HIPAA Compliance

Business Associate HIPAA Compliance: What 2026 Demands

In 2018, a medical billing company called Advanced Care Hospitalists paid $500,000 to settle with OCR after a business associate it hired gained access

Carl B. Johnson · Jun 30, 2026

HIPAA Fines

Fines for Violation of HIPAA: What They Cost in 2026

In February 2023, Banner Health agreed to pay $1.25 million to the Office for Civil Rights after a breach exposed the ePHI of nearly

Carl B. Johnson · Jun 30, 2026

American Health Training HIPAA

American Health Training HIPAA: What Actually Works

A 22-employee cardiology practice in Tennessee paid $2.3 million to settle HIPAA violations in 2020 — and the root cause wasn't a sophisticated

Carl B. Johnson · Jun 29, 2026

HIPAA Cloud Security

Security Measures for PHI in Cloud-Based Therapy Apps

A Therapist's Worst Nightmare Started With a Default Password In 2022, a mid-sized behavioral health practice in the Southeast discovered that session notes

Carl B. Johnson · Jun 29, 2026

Certification for HIPAA

Certification for HIPAA: What Actually Matters in 2026

Here's something that surprises most people in healthcare: HHS does not issue or endorse any official certification for HIPAA. There's no

Carl B. Johnson · Jun 28, 2026

Covered Entity

A Covered Entity Is: Who HIPAA Actually Applies To

Last year I got a call from the owner of a medical billing company in Ohio. She'd just received a letter from the

Carl B. Johnson · Jun 28, 2026

HIPAA Compliant Texting

Text Messaging HIPAA Compliant: What You Must Know

The Text That Cost a Practice Everything A physician texted a colleague a photo of a patient's wound for a quick consult. Standard

Carl B. Johnson · Jun 27, 2026

Administrative Simplification

Administrative Simplification: What HIPAA Really Demands

The Part of HIPAA Nobody Reads — Until It Costs Them In 1996, Congress passed HIPAA with a goal most people have forgotten. It wasn'

Carl B. Johnson · Jun 27, 2026

HIPAA Compliance Plans

HIPAA Compliance Plans: Build One That Actually Works

A pediatric clinic in Idaho had a binder on the shelf labeled "HIPAA Compliance Plan." It was printed in 2017, never updated, and

Carl B. Johnson · Jun 26, 2026

HIPAA Compliant Checklist

HIPAA Compliant Checklist: What You Actually Need in 2026

The Spreadsheet That Cost a Health System $5.1 Million In 2017, Memorial Healthcare System paid $5.1 million to HHS after employees accessed the

Carl B. Johnson · Jun 26, 2026

OCR HIPAA

OCR HIPAA Enforcement: What's Changed and What It Means

A single unencrypted laptop stolen from a parked car cost Concentra Health Services $1,725,220. The laptop contained patient names, dates of birth, Social

Carl B. Johnson · Jun 25, 2026