Blog / HIPAA

HIPAA Administrative Safeguards: A 45 CFR 164.308 Checklist and Operating Plan

A HIPAA administrative safeguards checklist for 45 CFR 164.308, with owners, cadences, evidence and a 90-day rollout plan small HealthTech teams can run.

HIPAA Right of Access: How to Handle Patient Requests Under 45 CFR 164.524

Handle every HIPAA right of access request on time: designated record set, 30-day deadline, fees, denial grounds and business associate duties for HealthTech.

HIPAA Technical Safeguards: An Engineering Guide to 45 CFR 164.312

HIPAA technical safeguards explained for engineers: each 45 CFR 164.312 standard, required vs addressable specs, SaaS implementation and the evidence to keep.

HIPAA Tracking Technologies: Pixels, Analytics and the OCR Bulletin After AHA v. Becerra

HIPAA tracking technologies explained: what the OCR bulletin still requires after AHA v. Becerra, plus a tag audit checklist and BAA table for HealthTech teams.

42 CFR Part 2: A Compliance Guide for HealthTech Vendors Handling SUD Records

42 CFR Part 2 explained for HealthTech vendors: covered SUD records, the 2024 final rule, how it differs from HIPAA, and the steps to reach Part 2 compliance.

FTC Health Breach Notification Rule: A Guide for Health Apps Outside HIPAA

FTC Health Breach Notification Rule guide for health apps outside HIPAA: who is covered, what counts as a breach, deadlines, penalties and HIPAA vs FTC.

HIPAA Incident Response Plan: Security Incident Procedures for HealthTech Teams

Build a HIPAA incident response plan that meets 164.308(a)(6), separates security incidents from breaches and gives HealthTech teams a clear, repeatable process

CCPA HIPAA Exemption: What Is Exempt and What Still Falls Under the CCPA

The CCPA HIPAA exemption covers PHI and medical information, not your whole company. Learn what HealthTech teams must still handle under the CCPA and how.

HIPAA Data Retention Requirements: What to Keep, How Long, and How to Dispose of It

HIPAA data retention requirements explained: which documents the six-year rule covers, why medical records follow state law, and how to dispose of PHI safely.

HIPAA Compliant File Sharing: A Checklist for Sharing PHI Securely

HIPAA compliant file sharing checklist: when a service needs a BAA, which technical safeguards apply, and how to configure links, access and logs for PHI.