How long do you have to respond to a HIPAA complaint?
HIPAA sets no deadline for answering a patient privacy complaint. What 45 CFR 164.530(d) requires, and how to set timeframes your practice can meet.
10-minute read
CoreFolio Learn
How-to
Practical walkthroughs for the work HIPAA actually requires — risk analysis, gap analysis, vendor reviews.
35 articles in this topic
ACA Section 1557: the nondiscrimination rules for practices that take federal funds
Section 1557 covers practices that receive federal funds, including Medicare Part B. What 45 CFR Part 92 requires, and what a court order removed.
23-minute read
HIPAA-compliant texting and encrypted messaging: what the rules actually require
Standard SMS is not encrypted and has no audit trail. What the HIPAA Security Rule, Privacy Rule, and proposed Security Rule NPRM require before you text patient information.
20-minute read
45 CFR 164.308(a)(1): the HIPAA Security Management Process
45 CFR 164.308(a)(1) is the standard behind many Office for Civil Rights (OCR) risk-analysis settlements. Its four required specifications and what a defensible record looks like.
8-minute read
HIPAA BAAs for technology vendors: the requirement, what it covers, and how to verify
Any tech vendor that handles ePHI is a business associate needing a BAA. Which tool categories always require one, and how to find and verify a vendor BAA.
7-minute read
Ransomware and HIPAA: how to recognize and respond to a suspected attack
How to spot a suspected ransomware attack on your practice, what to do in the first hour, and why HIPAA treats a ransomware event on ePHI as a presumed breach.
8-minute read
What is a fractional HIPAA compliance officer?
HIPAA requires every covered entity to name a Privacy and Security Official. Who typically fills the role in small practices, and when an outsider can serve.
10-minute read
HIPAA compliance responsibilities for office managers
In many small practices, the office manager is the de facto Privacy and Security Official. The specific CFR duties, the annual cycle, and what to document.
10-minute read
HIPAA compliance without a dedicated compliance officer: a small practice guide
HIPAA requires designated Privacy and Security Officials, not a full-time hire. What the role involves, who holds it, and a defensible documentation baseline.
9-minute read
HIPAA risk analysis vs. security evaluation: you need both
The HIPAA Security Rule has two separate risk requirements with different triggers. Many practices document only one; here is what each requires.
16-minute read
Does HIPAA apply to small practices?
Many small practices assume they are too small for HIPAA, but the law has no size exemption. The two-part test for whether you are a covered entity.
6-minute read
HIPAA administrative safeguards: the complete checklist for small practices
Administrative safeguards under 45 CFR 164.308 are a frequently cited standard in Office for Civil Rights (OCR) cases. Every requirement, what addressable means, and what to document.
8-minute read
What must a HIPAA business associate agreement include?
A HIPAA BAA is more than a signature: 45 CFR 164.504(e) sets the provisions it must contain. Every required element and the common drafting gaps Office for Civil Rights (OCR) finds.
7-minute read
HIPAA breach notification requirements: what your practice must do and when
The HIPAA Breach Notification Rule sets firm deadlines for notifying patients and regulators. Every obligation, deadline, and the four-factor analysis.
9-minute read
HIPAA compliance for home health agencies: mobile workforce, devices, and ePHI
Home health agencies carry HIPAA obligations across a mobile workforce. What the Privacy Rule, Security Rule, and device management mean for field staff.
7-minute read
HIPAA compliance for medical billing companies: obligations as a business associate
Medical billing companies are business associates liable under HIPAA since 2013. What that means for the Security Rule, BAAs, and breach notification.
6-minute read
HIPAA compliance for mental health counselors, therapists, and psychologists
Mental health providers face the same HIPAA duties as any covered entity, plus psychotherapy-note protections and, for SUD care, 42 CFR Part 2.
8-minute read
HIPAA compliance for physical therapy practices
Physical therapy practices are covered entities under HIPAA. What that means for PT: EHR choice, telehealth, and the 2026 privacy-notice deadline.
6-minute read
Am I a HIPAA covered entity or business associate? How to tell
Your HIPAA classification determines your direct liability, documentation requirements, and whether you need a BAA. Two questions reveal which one you are.
7-minute read
HIPAA physical safeguards for small practices: what the rule actually requires
HIPAA physical safeguards under 45 CFR 164.310 control physical access to ePHI. Every standard explained for a small practice, from workstations to disposal.
7-minute read
HIPAA policies and procedures for small practices: what you must have in writing
The HIPAA Security Rule requires written policies for every safeguard area. What 45 CFR 164.316 requires, what each policy must address, and 6-year retention.
7-minute read
HIPAA requirements for solo and small practices: what applies and what is scaled
HIPAA has no size exemption. A solo practitioner faces the same Privacy, Security, and Breach rules as a hospital. What is scaled to size, and what is not.
7-minute read
What to do after a HIPAA breach: a step-by-step response guide
After a HIPAA breach, the 60-day notification clock starts at once. Discovery, patient notice, U.S. Department of Health and Human Services (HHS) reporting, and what to document.
9-minute read
Who needs a HIPAA business associate agreement?
Not every vendor needs a BAA. Here is the legal test, the categories that consistently require one, the common exceptions, and what happens if you skip it.
6-minute read
ePHI inventory template: the foundation of every risk analysis
How to build an ePHI inventory for your HIPAA risk analysis: what to include, where ePHI hides, and why missing systems is a top Office for Civil Rights (OCR) finding.
10-minute read
HIPAA risk analysis for behavioral health practices
Behavioral health risk analysis considerations: therapy notes, telehealth, session recordings, 42 CFR Part 2, and the privacy threats these practices face.
9-minute read
HIPAA risk analysis checklist: 27-point review before an audit
A checklist of what Office for Civil Rights (OCR) investigators look for in a HIPAA risk analysis. Use it to review your documentation before an investigation.
8-minute read
HIPAA risk analysis for dental practices: a specialty guide
Dental-specific HIPAA risk analysis: imaging systems, practice software, patient communication tools, and the unique threats dental practices face.
8-minute read
HIPAA risk analysis template for small practices
What a defensible HIPAA risk analysis template must include, how to structure it for Office for Civil Rights (OCR) review, and why many free templates fail the accuracy requirement.
8-minute read
How often to update your HIPAA risk analysis (and why annual is the floor)
Office for Civil Rights (OCR) treats risk analyses older than 12 months as presumptively stale. When to update, what triggers an immediate review, and how to document the cycle.
8-minute read
Risk analysis vs gap analysis: which does your practice need?
The difference between a HIPAA risk analysis and a gap analysis, which the Security Rule requires, and when you need both.
7-minute read
How to do a HIPAA risk analysis yourself: a step-by-step guide for small practices
The Security Rule requires every covered entity to conduct an accurate, thorough risk analysis. What it must contain and how to do it yourself, step by step.
6-minute read
What goes in a HIPAA risk management plan
The risk analysis gets attention, but Office for Civil Rights (OCR) also requires a risk management plan. What it must contain, how it ties to the risk analysis, and what to include.
6-minute read
What is a business associate agreement, and who needs one?
A HIPAA business associate agreement (BAA) is required when a vendor handles patient data. Who qualifies, what it must contain, and the cost of skipping it.
6-minute read
HIPAA workforce training: what the rule requires and what actually works
HIPAA requires workforce training on security policies. What the rule says, what Office for Civil Rights (OCR) has cited in settlements, and what it looks like in a small practice.
7-minute read