HIPAA Compliance Insights

PHI Release Form

PHI Release Form: What Your Practice Gets Wrong

A Missing Checkbox Cost This Hospital $387,000 In 2019, Bayfront Health St. Petersburg agreed to a $85,000 corrective action settlement with OCR after

Carl B. Johnson · Apr 24, 2026

HIPAA Compliance Program

An Effective Compliance Program Should Include These 7 Parts

In 2018, the University of Texas MD Anderson Cancer Center lost a $4.3 million appeal after OCR found that the organization had policies on

Carl B. Johnson · Apr 24, 2026

HIPAA Breach

Definition of HIPAA Breach: What Actually Triggers One

A Stolen Laptop, a Missing Exception, and a $3 Million Problem In 2018, the University of Texas MD Anderson Cancer Center lost an unencrypted laptop

Carl B. Johnson · Apr 23, 2026

Covered Entities

Covered Entities Include: Who HIPAA Actually Applies To

A few years ago, I got a call from the office manager of a chiropractic clinic in Texas. She was panicking. They'd just

Carl B. Johnson · Apr 23, 2026

PHI

What Does PHI Mean in Healthcare? A Real-World Guide

A Receptionist, a Fax Machine, and a $1.5 Million Fine A few years ago, I consulted with a specialty clinic where a front-desk employee

Carl B. Johnson · Apr 22, 2026

HIPAA Training

HIPPA Compliance Training for Employees: A Guide

A receptionist at a small orthopedic clinic in Arizona clicked "Reply All" to an email containing 836 patient records. The breach triggered an

Carl B. Johnson · Apr 22, 2026

HIPAA Compliance

HIPAA Compliance for Medical Billing in Telehealth

A Single Telehealth Claim Triggered a $1.5 Million Investigation A mid-size behavioral health practice in the Southeast thought they had telehealth billing figured out.

Carl B. Johnson · Apr 21, 2026

OSHA Compliance

What Is OSHA Compliant and How Does It Relate to HIPAA?

A home health agency in Texas got hit with two separate federal investigations in the same quarter — one from OSHA for failing to maintain a

Carl B. Johnson · Apr 21, 2026

HIPAA Privacy Risk Analysis

HIPAA Privacy Risk Analysis: What Most Orgs Get Wrong

A $4.75 Million Fine That Started With One Missing Document In 2023, OCR settled with Lafourche Medical Group for $480,000 after a phishing

Carl B. Johnson · Apr 20, 2026

Parts of HIPAA

Parts of HIPAA: A Practical Guide to Every Title

Most People Only Know Two of the Five Parts of HIPAA I was running a compliance workshop for a mid-size hospital system last year when

Carl B. Johnson · Apr 20, 2026

HIPAA Privacy Rule

The HIPAA Privacy Rule Provides Patients the Right to Request

A Mother Waited 18 Months for Her Son's Medical Records. Then OCR Got Involved. In 2019, Cignet Health of Prince George's

Carl B. Johnson · Apr 19, 2026

HIPAA Titles

5 Titles of HIPAA: What Each One Actually Covers

Here's something that surprises most people in healthcare: the law they cite every single day — HIPAA — has five distinct sections, and the vast

Carl B. Johnson · Apr 19, 2026