Healthcare Compliance Insights

Compliance Blog: Page 13

Expert guidance on HIPAA compliance, healthcare technology, and building a culture of compliance.

Archive

HIPAA Compliance Articles: Page 13

This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on business associate agreements, breach prevention, and specialty practices.

Articles covering state privacy law interactions, enforcement case studies, corrective action plans, and the foundational elements of a HIPAA compliance program. These resources help organizations understand how federal HIPAA requirements intersect with state-level privacy and security regulations.

Articles by , Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).

About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.

"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
"OBHC mailed breach letters to 15,774 Washington residents." From Okanogan Behavioral HealthCare Data Breach Settlement
Cover image for HIPAA Gap Analysis: Compliancy Group vs One Guy Consulting 12 min read
Chuck Weiselberg, Founder at One Guy Consulting, CHP (not an attorney)

HIPAA Gap Analysis: Compliancy Group vs One Guy Consulting

Compliancy Group and One Guy Consulting both offer HIPAA gap analysis. Compliancy Group pairs self-audits with a coach who creates your remediation plans. One Guy Consulting builds the gap analysis and plan from your SRA automatically. Here is how they compare.

Compliancy Group gap analysis runs through The Guard: your staff answers the questions, spots the gaps, and assembles the remediation plan over weeks to months.

Read
How to Automate HIPAA Compliance for Your Healthcare Organization: One Guy Consulting article cover 15 min read
Chuck Weiselberg, Founder at One Guy Consulting, CHP (not an attorney)

How to Automate HIPAA Compliance for Your Healthcare Organization

Most recurring HIPAA tasks can be automated, like training reminders, policy review scheduling, BAA tracking, and incident logs. Risk analysis, breach decisions, and policy tailoring still need a person. Here is what to automate, what not to, and how to roll it out in phases.

HIPAA compliance automation handles training reminders, BAA expiration alerts, and audit log collection. Risk analysis and breach determination still need a human.

Read
Okanogan Behavioral Healthcare Data Breach Settlement: One Guy Consulting article cover 11 min read
Chuck Weiselberg, Founder at One Guy Consulting, CHP (not an attorney)

Okanogan Behavioral Healthcare Data Breach Settlement

In May 2024, a cyberattack on Okanogan Behavioral HealthCare exposed files with patient names, Social Security numbers, medical information, and diagnoses. OBHC mailed breach letters to 15,774 Washington residents. A class action settlement is open for claims until December 1, 2026. Here is what is known.

The Okanogan Behavioral HealthCare settlement follows a May 2024 attack that exposed names, SSNs, and diagnoses. Breach letters went to 15,774 Washington residents.

Read the full Okanogan article for settlement details, remediation steps, and next-step guidance.

Read
The 3 HIPAA Safeguards Explained Simply: One Guy Consulting article cover, Security category 22 min read
Chuck Weiselberg, Founder at One Guy Consulting, CHP (not an attorney)

The 3 HIPAA Safeguards Explained Simply

A plain-English guide to all three HIPAA safeguard categories, administrative, physical, and technical, with CFR citations, real-world examples, and practical implementation steps for covered entities and business associates.

HIPAA Security Rule safeguards come in three types: administrative, physical, and technical. Some specs are required, some addressable; skip one type and you have a gap.

Read
PHI vs PII vs ePHI: Key Differences: One Guy Consulting article cover, HIPAA Basics category 18 min read
Chuck Weiselberg, Founder at One Guy Consulting, CHP (not an attorney)

PHI vs PII vs ePHI: Key Differences

PHI, PII, and ePHI are not interchangeable terms. Each has a different legal definition, different regulatory scope, and different compliance obligations. This guide breaks down exactly what each term means, where they overlap, and what your organization needs to do about each one.

PHI vs PII is not a naming quibble. Each has its own legal definition and rules, and mixing them up puts the wrong safeguards on the wrong data.

Read
What Is ePHI? Definition & Compliance: One Guy Consulting article cover, HIPAA Basics category 18 min read
Chuck Weiselberg, Founder at One Guy Consulting, CHP (not an attorney)

What Is ePHI? Definition & Compliance

Learn what electronic Protected Health Information (ePHI) is, see real-world examples, and understand the HIPAA Security Rule requirements that govern how covered entities and business associates must protect it.

What is ePHI in plain terms? PHI created, received, stored, or sent in electronic form. That electronic form is what brings in the HIPAA Security Rule.

Read
Business Associate Agreement (BAA): HIPAA Requirements & Guide: One Guy Consulting article cover 14 min read
Chuck Weiselberg, Founder at One Guy Consulting, CHP (not an attorney)

Business Associate Agreement (BAA): HIPAA Requirements & Guide

A HIPAA business associate agreement is a legally required contract before any vendor touches PHI. Here is what it must contain, who needs one, and what happens without one.

A business associate contract must specify the following under 45 CFR 164.504(e)(2), starting with permitted uses of PHI. The rule word for word, and who needs a BAA.

Read

Browse older posts

FAQ

Blog FAQ

What topics does this Compliance Blog cover?

HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.

Who authors these posts?

Chuck Weiselberg writes the articles listed on this page.

Who is the blog for?

Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.

What is the free 30-minute session?

A free 30-minute intro call with an experienced consultant to assess your current program.

Is the blog content legal advice?

Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.

How do I book the free 30-minute intro call?

Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.

What is PHI?

Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.

What is ePHI?

PHI that is created, received, maintained, or transmitted in electronic form.

What is a Business Associate?

A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.

What is a BAA?

The written contract HIPAA requires between a covered entity and a business associate.

Where are key terms defined?

See the Key HIPAA terms section on this page.

What topics are on this page?

Guides on business associate agreements, breach prevention, and specialty practices. The articles: HIPAA Gap Analysis: Compliancy Group vs One Guy Consulting; How to Automate HIPAA Compliance for Your Healthcare Organization; What Is a Covered Entity Under HIPAA?; Notice of Privacy Practices: HIPAA NPP Requirements; Okanogan Behavioral Healthcare Data Breach Settlement; The 3 HIPAA Safeguards Explained Simply; PHI vs PII vs ePHI: Key Differences; What Is ePHI? Definition & Compliance; Business Associate Agreement (BAA): HIPAA Requirements & Guide.

What date range do these posts cover?

The articles on this page were published between June 18, 2026 and June 29, 2026. Each article shows its publication date.

What is this page?

An archive of HIPAA compliance articles for small practices.

Where are state HIPAA guides?

State HIPAA guides are listed in this archive and linked by state name.

How long are the articles on this page?

Read times for the articles on this page range from 11 to 22 minutes.

Quick answers

Quick answers from this page

What Is a Covered Entity Under HIPAA?

HIPAA only applies if you are a covered entity. Here's how 45 CFR 160.103 defines one, who qualifies, and what OCR does when organizations get it wrong.

What Is ePHI?

Learn what electronic Protected Health Information (ePHI) is, see real-world examples, and understand the HIPAA Security Rule requirements that govern how covered entities and business associates must protect it.

By state

State-specific HIPAA guides

State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.

Topics

Security Rule

BAAs

Breach Reporting

Resources

Resources & glossary (SRA, templates, external links)

"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."

HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)

Key terms

Key HIPAA terms on this page

Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.

Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.

"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."

(45 CFR 160.103)

Protected Health Information (PHI)
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium. 45 CFR 160.103Example: a patient's name and appointment date on a front-desk schedule.
Electronic PHI (ePHI)
PHI that is created, received, maintained, or transmitted in electronic form. 45 CFR 160.103Example: lab results stored in your EHR or attached to an email.
Covered Entity
A health plan, health care clearinghouse, or health care provider that transmits health information electronically. 45 CFR 160.103Example: a dental office that bills insurance electronically.
Business Associate
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors. 45 CFR 160.103Example: an IT company that manages the server where your patient records live.
Business Associate Agreement (BAA)
The written contract HIPAA requires between a covered entity and a business associate. 45 CFR 164.502(e), 164.504(e)Example: the agreement a billing company signs before it receives your claims data.
Security Rule
The standards for protecting ePHI through administrative, physical, and technical safeguards. 45 CFR Part 164, Subpart CExample: giving each staff member a unique login to the EHR.
Security Risk Assessment (SRA)
The accurate and thorough risk analysis the Security Rule requires you to conduct and document. 45 CFR 164.308(a)(1)(ii)(A)Example: listing every laptop, phone and server that holds ePHI and rating the risk to each.
Breach Notification Rule
After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified. 45 CFR 164.400 to 164.414Example: a stolen unencrypted laptop holding patient files can require notice to every affected patient.
Free 30-Minute Session

Free 30-Minute Intro Call: Book Now

Book a free 30-minute intro call with an experienced consultant to assess your current program.

See the Case Studies page for client remediation examples and lessons learned.

Book your free 30-minute intro callSee plans and pricing
OGC-BotHow can One Guy Consulting help today?