USA HIPAA Blog
HIPAA compliance writing for modern healthcare teams.
Practical guidance, checklists, and training updates from the team behind USA HIPAA. Dated, specific, and written for people running real compliance programs.
Latest Articles
Recent HIPAA articles and guides
HIPAA-Compliant Records Retrieval: The Rules for Requesting, Releasing, and Handling Medical Records
Records retrieval sits at the intersection of the two most litigated corners of HIPAA: the patient's right of access and the authorization rules that govern everyone else. Whether you are a provider releasing charts, a law firm or insurer requesting them, or a retrieval company working in the middle, the pathway a request travels determines the deadline, the allowable fee, and the legal exposure when something goes wrong. This guide walks through both pathways, the Ciox v. Azar decision that reset the fee rules, verification and minimum necessary duties, business associate agreements for retrieval vendors, and the delivery and documentation controls that keep a release defensible.
July 26, 2026
Read articlehipaa network requirementsHIPAA Network Requirements: What the Security Rule Demands from Your Network, Wi-Fi, and Remote Access
HIPAA never names a firewall brand, a Wi-Fi standard, or a VPN product, but it absolutely regulates your network. The Security Rule requires you to protect electronic PHI as it moves across your systems, control who can reach it, watch what happens on the wire, and prove all of it in writing. This guide translates the legal text into concrete network requirements: transmission encryption and the breach safe harbor, segmentation and firewalls, wireless and remote access, cloud connections and exposed services, and the monitoring duties behind the $16 million Anthem settlement, plus the proposed Security Rule update that would make encryption, MFA, and network mapping mandatory.
July 25, 2026
Read articlehipaa policies and proceduresHIPAA Policies and Procedures: The Complete List of What You Are Legally Required to Write Down
The HIPAA Security Rule legally requires organizations to keep and maintain written policies and procedures, and the Privacy Rule imposes a parallel duty of its own. Yet most covered entities cannot produce a complete, current policy set when a regulator asks, and OCR asks for policies before it asks for anything else. This guide maps every policy HIPAA expects to its exact citation in 45 CFR 164.530, 164.316, 164.308, 164.310, and 164.312, walks through the privacy, security, and breach notification policy sets one by one, covers the retention and review rules that keep a manual defensible, and explains why a policy that sits in draft form counts for nothing in an investigation.
July 24, 2026
Read articlehipaa privileged accessHIPAA Privileged Access: How the Law Regulates Admin Accounts, Elevated Rights, and Who Can See PHI
HIPAA never uses the phrase privileged access, but it regulates elevated accounts more tightly than any other part of your systems. Admin credentials, EHR superuser rights, service accounts, and break-glass logins all sit under the minimum necessary standard, the workforce security safeguards, and the access control requirements for ePHI. This guide maps every HIPAA privileged access requirement to its regulation, walks the enforcement record including the $5.5 million settlement built on one unrevoked login, and lays out the privileged access management program that satisfies all of it.
July 23, 2026
Read articlehow does hipaa relate to copier securityHow Does HIPAA Relate to Copier Security? The PHI Hiding in Your Copier's Hard Drive
Digital copiers are computers, and most of them keep a hard drive that stores an image of every document they copy, scan, print, or fax. When those documents contain patient information, the drive holds electronic PHI, and HIPAA's Security Rule governs it. This guide explains exactly how HIPAA relates to copier security: the safeguards that apply, the $1.2 million settlement that proved the risk is real, and the controls that keep copiers, printers, and fax machines from becoming your next breach.
July 21, 2026
Read articlehipaa compliance requirementsHIPAA Compliance Requirements: The Complete List of What the Law Actually Requires
HIPAA never publishes its requirements as a single list, which is why most organizations discover them one audit finding at a time. This guide assembles the complete set in one place: who must comply, what the Privacy, Security, and Breach Notification Rules each demand, the business associate agreement and documentation duties that investigators check first, and the order in which to build a program that satisfies all of it.
July 19, 2026
Read articlehipaa data securityHIPAA Data Security: The IT Security Requirements Your Systems Must Meet
HIPAA never uses the phrase data security, but it absolutely regulates it. This guide translates the Security Rule into the concrete IT security requirements behind the legal language: access controls, audit logging, authentication, encryption, network protections, storage and disposal, and backups, plus the proposed Security Rule update that would make encryption and multi-factor authentication mandatory. Written for the IT lead, security officer, or practice manager who has to build the actual system.
July 17, 2026
Read articlethree rules of hipaaThe Three Rules of HIPAA: Privacy, Security, and Breach Notification Explained
Ask what HIPAA actually requires and the honest answer comes down to three regulations: the Privacy Rule, the Security Rule, and the Breach Notification Rule. This guide explains what each rule covers, who must follow them, how they fit together, and what they mean for your training and certification.
July 16, 2026
Read articlehipaa remediation planHIPAA Remediation Plan: How to Fix Compliance Gaps and Prove You Fixed Them
A risk assessment that ends with a list of findings and no follow-through is worse than no assessment at all, because now the gaps are documented and unaddressed. This guide explains what a HIPAA remediation plan is, where the requirement actually lives in the regulation, why the 30-day correction window can change your penalty tier, what a defensible plan contains, how to prioritize fixes by risk instead of convenience, the interim controls that protect you while long projects run, and the documentation that turns finished work into evidence.
July 15, 2026
Read articlehow to become a hipaa compliance auditorHow to Become a HIPAA Compliance Auditor: The Realistic Career Path
There is no government license called HIPAA auditor, yet hospitals, insurers, consulting firms, and health tech vendors keep hiring people to do exactly that job. This guide lays out the realistic path: what a HIPAA compliance auditor actually does all day, the regulatory foundation you have to build first, the degrees and backgrounds that feed into the role, the professional certifications employers recognize, how to get audit experience before anyone hands you the title, the toolkit working auditors rely on, and the mistakes that stall people who try to shortcut the process.
July 14, 2026
Read articlehipaa minimum necessaryThe HIPAA Minimum Necessary Standard Explained: The Rule Your Whole Team Lives Under
Most workforce members have never heard the phrase minimum necessary, yet it is the HIPAA rule they live under every shift. Here is a plain-language walk through what the minimum necessary standard actually requires: where it lives in the regulation, what it means to limit protected health information to the minimum, the six situations it does not apply to including treatment, how role-based access and routine-disclosure policies put it into practice, the reasonable-reliance shortcut, the violations that draw enforcement, and why every person who touches PHI has to be trained on it.
July 8, 2026
Read articlehipaa right of accessThe HIPAA Right of Access: How to Handle Patient Records Requests (2026)
The right of access is the single most enforced part of HIPAA, and most access failures come from staff who did not know the rules. Here is a plain-language walk through what the HIPAA right of access requires: what records patients can get, the thirty-day deadline, what you are and are not allowed to charge, when you may deny a request, who can ask on a patient's behalf, and why every front-desk, records, and patient-access worker has to be trained on it.
July 7, 2026
Read articlehipaa for leaders trainingHIPAA Training for Leaders and Managers: Duties, Accountability, and Proof (2026)
HIPAA training for leaders and managers, explained: the duties HIPAA assigns to management, who is accountable when something goes wrong, how to set the tone that prevents willful neglect, and how to train your team and prove it.
July 6, 2026
Read articlehipaa security ruleThe HIPAA Security Rule Explained: Safeguards, Requirements, and Who Must Comply
The Security Rule is the part of HIPAA that protects electronic health information, and it is the one most teams get wrong because it never hands you a checklist. Here is a plain-language walk through what the Security Rule actually requires, the three kinds of safeguards it demands, why required and addressable do not mean mandatory and optional, how it differs from the Privacy Rule, who has to comply, and why every workforce member who touches ePHI has to be trained on it.
July 5, 2026
Read articlehipaa privacy ruleThe HIPAA Privacy Rule Explained: What It Requires and Who Must Comply
People treat HIPAA and the Privacy Rule as the same thing, but the Privacy Rule is one specific part of the law with its own rules about who can use protected health information, when they need permission, and what rights patients hold. Here is a plain-language walk through what the Privacy Rule requires, how it differs from the Security Rule, who has to follow it, and why every workforce member who touches patient data has to be trained on it.
July 4, 2026
Read articleprotected health informationWhat Is PHI? The 18 HIPAA Identifiers and What Counts as Protected Health Information
Most people think protected health information is just a list of eighteen data points. It is not. Here is the real definition of PHI under the Privacy Rule, where the eighteen HIPAA identifiers actually come from, how ePHI, de-identified data, and a limited data set differ, and why recognizing PHI is the first skill every HIPAA course teaches.
July 3, 2026
Read articlehipaa audit log retentionHIPAA Audit Log Retention Requirements: How Long to Keep Audit Trails
HIPAA does not print a retention number inside its audit-controls rule, so teams guess, and most guess too short. Here is where the six-year figure actually comes from, why state and Medicare rules can push it longer, what events you have to log, how to review and protect the trail, and how to write a retention policy that survives an audit or a breach investigation.
July 2, 2026
Read articlehipaa for employersDoes HIPAA Apply to Employers? What the Law Actually Covers at Work
Most people assume HIPAA stops an employer from asking about their health or sharing it. Usually it does not. Here is who HIPAA actually regulates, why employment records are not protected health information, which laws really protect medical information at work, and the specific situations where an employer does carry HIPAA duties and training obligations.
July 1, 2026
Read articlehipaa cookie consentHIPAA Cookie Consent for Healthcare Websites (2026 Guide)
Cookies, tracking pixels, and analytics tags can turn a patient's website visit into a disclosure of protected health information. Here is what HIPAA actually requires, what the OCR tracking bulletin and the 2024 court ruling changed, and how to keep your site, your vendors, and your staff on the right side of the line.
June 30, 2026
Read articlehipaa recertificationHow long does HIPAA certification last?
HIPAA certification has no federal expiration date. Learn when annual renewal makes sense, what triggers retraining, and which training records to keep.
June 28, 2026
Read articlehipaa training for small businessesHIPAA Training for Small Businesses: A Practical Owner's Guide
What HIPAA training actually requires of a small business, who it applies to, and how a small clinic, billing shop, SaaS startup, or IT vendor trains its whole team without building a compliance department.
June 25, 2026
Read articlehipaa certification for it professionalsHIPAA Certification for IT Professionals: What It Proves and How to Get It
A practical guide to HIPAA certification for IT professionals: who needs it, how it differs from SOC 2 and HITRUST, the technical safeguards IT actually owns, and how sysadmins, security engineers, MSP staff, and healthcare IT teams get certified.
June 24, 2026
Read articlehipaa certification for healthcare workersHIPAA Certification for Healthcare Workers: What You Actually Need
A practical guide to HIPAA certification for healthcare workers: who needs it, what the certificate proves, how employers review it, and how nurses, front-desk staff, medical assistants, billers, and aides get certified online.
June 21, 2026
Read articlehipaa compliance officerWhat Is a HIPAA Compliance Officer? Role, Requirements, and How to Become One
What a HIPAA compliance officer does, the privacy and security official roles HIPAA actually requires, the qualifications and pay, and how to step into the job.
June 15, 2026
Read articlehipaa certification on resumeHIPAA Certification on a Resume: How to List It
A practical guide for job seekers, students, contractors, and healthcare workers who want to list HIPAA training or certification on a resume accurately.
May 28, 2026
Read articlehipaa it certificationHIPAA IT Certification for Support Teams
HIPAA training guidance for IT support teams, MSPs, administrators, and vendors handling ePHI access and security duties.
May 28, 2026
Read articlebulk hipaa trainingBulk HIPAA Training Rollout Guide
How healthcare managers can plan bulk HIPAA training, seat assignment, completion tracking, renewals, and certificate proof.
May 28, 2026
Read articleamerican health training hipaa certificationAmerican Health Training HIPAA Certification Review
How to evaluate American Health Training HIPAA certification, including certificate proof, verification, renewals, and team-training fit.
May 27, 2026
Read articleaccredited hipaa certificationAccredited HIPAA Certification: What to Verify
What accredited HIPAA certification can mean, what it does not prove, and how buyers should verify training proof.
May 8, 2026
Read articleamerican health training hipaa certification costAmerican Health Training HIPAA Cost Comparison
Compare American Health Training HIPAA certification cost, certificate proof, renewals, and team admin before choosing a provider.
April 22, 2026
Read articlecertified hipaa trainingCertified HIPAA Training: Buyer Checklist
A buyer's guide to certified HIPAA training, certificate proof, employer review, team records, and fake government-certification claims.
April 16, 2026
Read articlecertified hipaa professionalCertified HIPAA Professional: What It Means
What employers usually mean by a certified HIPAA professional, what proof they review, and where certificate proof stops short of compliance.
April 15, 2026
Read articlehipaa certification costHIPAA Certification Cost: How to Compare Options
A practical guide to comparing HIPAA certification cost for individuals and teams without confusing a training certificate with full HIPAA compliance.
April 14, 2026
Read articlebecome hipaa certifiedHow to Become HIPAA Certified Online
How to become HIPAA certified, how employers review certificates, and why training is not the same as full HIPAA compliance.
April 13, 2026
Read articlehipaa and hitech actHIPAA and HITECH Act: What Changed
What HITECH changed inside HIPAA, including breach notification, business associate liability, audits, enforcement, and documentation.
April 12, 2026
Read articlehipaa training urology clinicsHIPAA Training for Urology Clinics
A practical HIPAA training plan for urology clinics handling sensitive visits, lab results, procedures, and patient messaging.
March 17, 2026
Read articlehipaa training neurology clinicsHIPAA Training for Neurology Clinics
How neurology clinics can train teams on long-horizon patient records, diagnostics, caregiver communication, and recurring follow-up workflows.
March 17, 2026
Read articlehipaa training rheumatology clinicsHIPAA Training for Rheumatology Clinics
A focused HIPAA training framework for rheumatology clinics managing chronic-care records, infusion workflows, labs, and payer coordination.
March 17, 2026
Read articlehipaa training home health agenciesHIPAA Training for Home Health Agencies
A practical HIPAA training plan for home health agencies handling in-home visits, mobile documentation, and caregiver communication.
March 17, 2026
Read articlehipaa training medical office managersHIPAA Training for Medical Office Managers
A practical HIPAA training roadmap for medical office managers overseeing staff access, vendor workflows, front-desk operations, and audit readiness.
March 11, 2026
Read articlehipaa training for practice ownersHIPAA Training for Practice Owners
How practice owners can use HIPAA training to tighten workforce accountability, vendor oversight, policy reviews, and compliance documentation.
March 11, 2026
Read articlehipaa training dental office managersHIPAA Training for Dental Office Managers
A role-specific HIPAA training guide for dental office managers coordinating imaging access, patient communication, scheduling teams, and third-party vendors.
March 11, 2026
Read articlehipaa training revenue cycle managersHIPAA Training for Revenue Cycle Managers
How revenue cycle leaders can apply HIPAA training across billing access, payer communication, vendor controls, and denial-management workflows.
March 11, 2026
Read articlehipaa training privacy officersHIPAA Training for Privacy Officers
A practical HIPAA training guide for privacy officers responsible for complaints, disclosures, policy enforcement, and breach-response coordination.
March 11, 2026
Read articlehipaa training prior authorization specialistsHIPAA Training for Prior Authorization Specialists
How prior authorization teams can apply HIPAA during payer submissions, records exchange, utilization review, and status follow-up.
March 11, 2026
Read articlehipaa training credentialing specialistsHIPAA Training for Credentialing Specialists
A role-specific HIPAA training framework for credentialing teams managing provider onboarding, document exchange, and payer enrollment workflows.
March 11, 2026
Read articlehipaa training telehealth coordinatorsHIPAA Training for Telehealth Coordinators
What telehealth coordinators should cover in HIPAA training across patient setup, platform access, scheduling support, and virtual-visit communication.
March 11, 2026
Read articlehipaa training billing managersHIPAA Training for Billing Managers
A practical HIPAA training roadmap for billing managers overseeing claims teams, vendor access, denial workflows, and payment-related PHI.
March 11, 2026
Read articlehipaa training log templateHIPAA Training Log Template for Audit Readiness
A practical guide to building a HIPAA training log template that captures completions, renewals, role assignments, and proof for audits.
March 10, 2026
Read articlehipaa self audit checklistHIPAA Self-Audit Checklist for Small Practices
How small healthcare practices can run a practical HIPAA self-audit covering training, policies, risk analysis, BAAs, and technical safeguards.
March 10, 2026
Read articlehipaa vendor risk assessmentHIPAA Vendor Risk Assessment Checklist
A practical HIPAA vendor risk assessment checklist for reviewing BAAs, subcontractors, security controls, and incident response expectations.
March 10, 2026
Read articlehipaa training emts paramedicsHIPAA Training for EMTs and Paramedics
A field-ready HIPAA training framework for EMS teams managing dispatch data, transport handoffs, and mobile documentation.
March 8, 2026
Read articlehipaa training radiology techniciansHIPAA Training for Radiology Technicians
How radiology teams can apply HIPAA during imaging intake, result workflows, and cross-department handoffs.
March 8, 2026
Read articlehipaa training speech therapistsHIPAA Training for Speech Therapists
A practical HIPAA training guide for speech-language pathology teams documenting assessments, caregiver communication, and care coordination.
March 8, 2026
Read articlehipaa authorization formsHIPAA Authorization Forms: What to Include
A practical HIPAA authorization form guide for clinics, billing teams, and front-desk staff handling release requests.
March 7, 2026
Read articlehipaa training dental hygienistsHIPAA Training for Dental Hygienists
A role-specific HIPAA training framework for dental hygienists handling imaging, perio charting, treatment discussions, and patient follow-up.
March 6, 2026
Read articlehipaa training patient access specialistsHIPAA Training for Patient Access Specialists
How patient access teams can apply HIPAA during registration, eligibility verification, intake calls, and records collection.
March 6, 2026
Read articlehipaa training medical records clerksHIPAA Training for Medical Records Clerks
A practical HIPAA training guide for records teams managing release requests, chart corrections, retention, and secure disclosures.
March 6, 2026
Read articlehipaa training physical therapyHIPAA Training for Physical Therapy Clinics
A practical HIPAA training roadmap for PT clinics managing treatment plans, referral handoffs, and therapist documentation.
March 6, 2026
Read articlehipaa training chiropracticHIPAA Training for Chiropractic Clinics
How chiropractic clinics can apply HIPAA during intake, imaging workflows, treatment discussions, and billing communication.
March 6, 2026
Read articlehipaa training occupational therapistsHIPAA Training for Occupational Therapists
Role-specific HIPAA training for occupational therapists handling pediatric documentation, caregiver communication, and care planning.
March 6, 2026
Read articlehipaa compliance for software developmentHIPAA Compliance for Software Development Teams
A practical HIPAA compliant software development guide for engineering, product, DevOps, and support teams that build or operate systems touching PHI.
March 5, 2026
Read articlehipaa training for medical couriersHIPAA Training for Medical Couriers
A practical HIPAA training framework for medical courier teams handling specimens, delivery logs, and chain-of-custody handoffs.
March 5, 2026
Read articlehipaa training medical receptionistsHIPAA Training for Medical Receptionists
A practical HIPAA training playbook for medical receptionists handling check-in, phone calls, records requests, and patient messaging.
March 5, 2026
Read articlehipaa training for dentistsHIPAA Training for Dentists
A practical HIPAA training guide for dentists covering treatment discussions, imaging workflows, records requests, and front-office coordination.
March 5, 2026
Read articlehipaa training for physician assistantsHIPAA Training for Physician Assistants
How physician assistants can apply HIPAA rules during exams, care coordination, e-prescribing, and cross-team communication.
March 5, 2026
Read articlehipaa training home health aidesHIPAA Training for Home Health Aides
A practical HIPAA training plan for home health aides documenting in-home visits, caregiver notes, and mobile-device communication.
March 4, 2026
Read articlehipaa training claims specialistsHIPAA Training for Claims Specialists
How claims teams can apply HIPAA minimum-necessary rules during eligibility checks, adjudication, appeals, and payer communication.
March 4, 2026
Read articlehipaa training medical codersHIPAA Training for Medical Coders
A focused HIPAA framework for medical coders handling diagnosis codes, chart abstraction, and secure claim documentation.
March 4, 2026
Read articlehipaa training medical billingHIPAA Training for Medical Billing Specialists
A role-specific HIPAA training plan for medical billing teams handling claims intake, denials, payment posting, and payer follow-up.
March 4, 2026
Read articlehipaa training dental assistantsHIPAA Training for Dental Assistants
What dental assistants need to know about HIPAA in imaging, treatment planning, and front-office patient communication.
March 3, 2026
Read articlehipaa training case managersHIPAA Training for Case Managers
A practical HIPAA training framework for case managers coordinating referrals, care plans, and cross-provider communication.
March 3, 2026
Read articlehipaa training pharmacistsHIPAA Training for Pharmacists
How pharmacy teams can apply HIPAA rules during prescription intake, counseling, refill requests, and payer coordination.
March 3, 2026
Read articlehipaa training medical assistantsHIPAA Training for Medical Assistants: What to Cover in 2026
A practical HIPAA training guide for medical assistants handling intake, chart prep, patient communication, and referrals.
March 1, 2026
Read articlehipaa training front deskHIPAA Training for Front Desk Staff
How reception and patient access teams can protect PHI during scheduling, check-in, calls, and records requests.
March 1, 2026
Read articlehipaa training urgent careHIPAA Training for Urgent Care Centers
A focused HIPAA approach for high-volume urgent care teams balancing speed, walk-in workflows, and after-hours operations.
March 1, 2026
Read articlehipaa complianceComplete Guide to HIPAA Compliance (2026)
A plain-English overview of HIPAA privacy, security, and breach notification requirements for modern healthcare teams.
January 31, 2026
Read articlehipaa training for nursesHIPAA Training Requirements for Nurses
Role-specific HIPAA training for nurses covering bedside privacy, handoffs, family questions, devices, incident reporting, and completion proof.
January 31, 2026
Read articlehipaa remote workRemote Work HIPAA Compliance Checklist
A practical HIPAA remote work checklist for home offices, approved tools, VPN access, mobile devices, telehealth support, and retrievable compliance evidence.
January 31, 2026
Read articlehipaa mental healthHIPAA for Mental Health Professionals
A practical guide to HIPAA for therapists, counselors, and behavioral health teams handling therapy notes, telehealth, releases, caregivers, and crisis calls.
January 31, 2026
Read articlebusiness associate hipaaBusiness Associate Agreements: What You Need to Know
A practical guide to HIPAA business associate agreements, when a BAA is required, what contract terms matter, and how to track vendor PHI access.
January 31, 2026
Read articlehipaa violationsHIPAA Violations: Real Cases and Lessons Learned
Common HIPAA violation examples, enforcement patterns, incident-response evidence, staff training, and process fixes that reduce repeat risk.
January 31, 2026
Read articlehipaa telehealthTelehealth HIPAA Rules Explained
A practical guide to HIPAA telehealth rules for video visits, audio-only care, platform approvals, BAAs, patient setup, and virtual-care incident response.
January 31, 2026
Read articlehipaa small practiceHIPAA Training for Small Clinics
Right-sized HIPAA training for small practices, dental clinics, and specialty teams.
January 31, 2026
Read articlehipaa insuranceHIPAA Training for Insurance Professionals
HIPAA guidance for brokers, benefits teams, TPAs, and claims staff handling enrollment data, eligibility files, and plan communication.
January 31, 2026
Read article