Expert guidance on HIPAA compliance, healthcare technology, and building a culture of compliance.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on business associate agreements, whether common software is HIPAA compliant, and specialty practices.
Guidance on HIPAA authorization forms, minimum necessary rules, de-identification standards, and patient rights under the Privacy Rule. Knowing these Privacy Rule basics is key for any practice that collects, stores, or sends protected health information.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
10 min read
Google's BAA is accepted in the Admin console. What it covers, what it leaves to the practice, and the settings a small office turns on next.
Is Google Workspace HIPAA compliant? It can hold PHI once a super administrator accepts Google's BAA, and only inside the services on Google's list.
19 min read
Our process toward becoming HIPAA compliant at One Guy Consulting isn't rocket science but we're happy to explain how it works, step by step.
The HIPAA compliance process, step by step: it opens with a full platform tour and your hardest compliance questions, answered before you pay anything.
11 min read
A BAA is a corporate-level compliance contract. A confidentiality agreement is a personal promise. One question tells you which to use.
NDA vs BAA: a BAA is a corporate-level compliance contract, a confidentiality agreement is a personal promise, and one question tells you which a vendor signs.
7 min read
If OCR is investigating you, it already has a reason to think something went wrong. Here is how investigations start, how they get more serious, and what sets the penalty.
Most OCR investigations into HIPAA violations do not start with a surprise audit. How they begin, how they escalate to fines, and what keeps penalties low.
11 min read
If your agency handles patient data for a healthcare client (forms, testimonials, ad pixels, CRM records), you're a business associate under HIPAA. Here's what that means and what to do about it.
A HIPAA compliant marketing agency starts from one fact: touch patient forms, testimonials, ad pixels, or CRM records, and you are a business associate.
15 min read
HIPAA's Safe Harbor standard lists 18 identifiers that must be removed before health data counts as de-identified. Here is the complete list with real-world examples and steps to protect each one.
The 18 protected health information identifiers draw the line: health data carrying any one of them is PHI, and every HIPAA safeguard applies to it.
15 min read
Intuit says QuickBooks Online is not HIPAA compliant, so there is no Business Associate Agreement path for it. Learn when billing data becomes PHI and what healthcare practices should use instead.
Is QuickBooks Online HIPAA compliant? No. Intuit will not sign a BAA. When billing data becomes PHI, and the one narrow hosted Desktop workaround.
7 min read
Calendly does not sign Business Associate Agreements on any plan. Healthcare practices cannot use it for patient scheduling that involves protected health information.
Is Calendly HIPAA compliant for patient booking? No. It signs no BAA on any plan, so it can run internal staff scheduling but not appointments that involve PHI.
8 min read
Meta will not sign a Business Associate Agreement (BAA) for WhatsApp. The app also lacks the audit logs, admin controls, and message-keeping controls that HIPAA calls for.
Is WhatsApp HIPAA compliant for talking about patients? No. Meta signs no BAA, and the app lacks audit logs and access controls. One narrow exception exists.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on business associate agreements, whether common software is HIPAA compliant, and specialty practices. The articles: Is Google Workspace HIPAA Compliant? BAA and Setup; How One Guy Consulting Works; BAA vs. Confidentiality Agreement: Which One Gets Signed?; HIPAA Violations: What Triggers an Investigation; HIPAA Compliance for Healthcare Marketing Agencies; The 18 HIPAA Identifiers: Full List With Real-World Examples; Is QuickBooks HIPAA Compliant? No, Here Is Why; Is Calendly HIPAA Compliant? No, Here Is Why; Is WhatsApp HIPAA Compliant? No, and Here Is Why.
The articles on this page were published between July 11, 2026 and July 17, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 7 to 19 minutes.
Google's BAA is accepted in the Admin console. What it covers, what it leaves to the practice, and the settings a small office turns on next.
A BAA is a corporate-level compliance contract. A confidentiality agreement is a personal promise. One question tells you which to use.
Intuit says QuickBooks Online is not HIPAA compliant, so there is no Business Associate Agreement path for it. Learn when billing data becomes PHI and what healthcare practices should use instead.
Calendly does not sign Business Associate Agreements on any plan. Healthcare practices cannot use it for patient scheduling that involves protected health information.
Meta will not sign a Business Associate Agreement (BAA) for WhatsApp. The app also lacks the audit logs, admin controls, and message-keeping controls that HIPAA calls for.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.