HIPAA Compliance Insights

PHI Data

PHI Data: What Counts, What Doesn't, and What to Protect

In 2023, OCR settled with a dental practice for $350,000 after an investigation revealed the organization had been disclosing patient records to a marketing

Carl B. Johnson · Jan 15, 2024

Privacy Rule

Privacy Rule Definition: What It Actually Requires

In February 2023, OCR settled with a dental practice for $195,000 after investigators found the organization had no written policies implementing the HIPAA Privacy

Carl B. Johnson · Jan 8, 2024

Privacy Rule

Privacy Rule Grant to Patients: Rights You Must Honor

In 2023, OCR settled with a health system for $40,000 after it failed to provide a patient timely access to her own medical records

Carl B. Johnson · Jan 8, 2024

HIPAA Privacy Rule

Privacy vs Security Rule HIPAA: Key Differences Explained

In 2023, OCR settled with a dental practice for $350,000 after investigators found the organization had addressed its Privacy Rule obligations but had done

Carl B. Johnson · Jan 8, 2024

HITECH Act

Purpose of the HITECH Act: What It Means for HIPAA

In February 2011, Cignet Health of Prince George's County, Maryland, received a $4.3 million civil money penalty from the Office for Civil

Carl B. Johnson · Jan 8, 2024

Release of Information

Release of Information Form HIPAA: What You Must Include

In 2023, a mid-sized hospital system in the Midwest paid $125,000 to settle an OCR investigation after it disclosed patient records based on an

Carl B. Johnson · Dec 15, 2023

Release of Information

Release of Information HIPAA Rules You Must Follow

In 2023, OCR settled with a New England dermatology practice for $300,640 after the organization failed to provide a patient timely access to their

Carl B. Johnson · Dec 15, 2023

HIPAA Violation

How to Report a HIPAA Violation: A Step-by-Step Guide

In January 2024, a medical receptionist in Texas discovered her supervisor was accessing patient records for personal reasons — looking up neighbors, family members, even local

Carl B. Johnson · Dec 15, 2023

Safe Harbor Method

Safe Harbor Method HIPAA: De-Identification Guide

In 2023, OCR investigated a research institution that published a dataset it believed was fully de-identified — only to discover that zip codes and dates of

Carl B. Johnson · Dec 15, 2023

Cloud Security

Security Measures for PHI in Cloud-Based Therapy Apps

In early 2024, OCR settled with a telehealth provider for $950,000 after an investigation revealed the organization had deployed a cloud-based therapy platform without

Carl B. Johnson · Dec 15, 2023

HIPAA Compliance

Social Media Firms HIPAA Compliance Expertise Gap

In December 2022, OCR issued a bulletin explicitly warning healthcare organizations about the use of tracking technologies on websites and mobile apps — including pixels from

Carl B. Johnson · Dec 15, 2023

Business Associate Agreement

Subcontractor Business Associate Agreement Requirements

In 2016, OCR settled with North Memorial Health Care of Minnesota for $1.55 million after determining that a business associate had provided PHI access

Carl B. Johnson · Dec 15, 2023