In-depth HIPAA compliance articles covering Business Associate Agreements, security risk assessments, workforce training requirements, and enforcement trends from the HHS Office for Civil Rights.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on business associate agreements, whether common software is HIPAA compliant, specialty practices, and healthcare cybersecurity.
More expert guidance on Business Associate Agreements, workforce training documentation, and enforcement trends from the HHS Office for Civil Rights that affect covered entities and business associates. Each article is written for compliance officers, practice managers, and IT administrators who need clear answers without legal jargon.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
9 min read
Adobe names Acrobat Sign a HIPAA-Ready Service and will act as your business associate. The consumer Acrobat your staff already use is not on that list.
Is Adobe HIPAA compliant? Acrobat Sign is a HIPAA-Ready Service with a BAA through Adobe sales. The consumer Acrobat your staff already use is not on that list.
12 min read
Jotform will sign a BAA, but only on two plans and only after a setting is switched on. Most practices stop at the plan and never finish the setup.
Is Jotform HIPAA compliant? The plan alone does nothing: on Gold or Enterprise, the HIPAA setting has to be on and the BAA signed before PHI goes in.
13 min read
The vendor sells "HIPAA and OSHA compliance" as one package. They are two laws from two agencies, and the only thing they share is your break room.
HIPAA vs OSHA: one protects patient information, the other protects workers. Vendors sell them as one package; they are two laws from two federal agencies.
12 min read
The portal holds lab results for three days so the doctor can call first. Under HIPAA that is fine. Under 45 CFR Part 171 it may be information blocking.
HIPAA permits sharing. The information blocking rule at 45 CFR Part 171 targets interfering with access, and a three-day hold on lab results may cross that line.
11 min read
A public school nurse whose district bills Medicaid electronically is inside a HIPAA covered entity and still does not follow the HIPAA Privacy Rule. Here is why, and where the line moves.
HIPAA vs FERPA comes down to two definitions: student health records a school holds are education records, not PHI, even when the district bills Medicaid.
12 min read
The renewal application asks whether you enforce multifactor authentication on all remote access. The honest answer is the compliance program, not the checkbox.
HIPAA cyber insurance is not required by the rule, and a policy is not a safeguard: it moves money after an event and does nothing to reduce the risk to ePHI.
12 min read
Every message an answering service takes for a practice is PHI (protected health information). The service is a business associate, and the Security Rule applies to it directly. The practice needs a signed BAA (business associate agreement) with it. Both sides of that relationship, explained.
A HIPAA compliant answering service is a business associate by definition. The Security Rule applies to it directly, and the practice owes it a BAA.
11 min read
Whether a private-practice therapist is a HIPAA covered entity turns on one question about billing, not on license type or practice size. Here is the test, the cash-only answer, and the duties that apply either way.
Does HIPAA apply to therapists in private practice? It turns on one billing question, not license type or practice size, and state duties apply either way.
11 min read
Massage therapists and acupuncturists are health care providers under HIPAA's definitions. Most are still not covered entities. The difference is one billing question, and state law fills the gap.
Does HIPAA apply to massage therapists and acupuncturists? Only if the practice bills a health plan electronically. State confidentiality duties apply either way.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on business associate agreements, whether common software is HIPAA compliant, specialty practices, and healthcare cybersecurity. The articles: Is Adobe Acrobat Sign HIPAA Compliant?; Is Jotform HIPAA Compliant? BAA and Plan Guide; HIPAA vs OSHA for Medical and Dental Offices; HIPAA vs Information Blocking: What Each Rule Requires; HIPAA vs FERPA: Which Law Covers Student Health Records; HIPAA Cyber Insurance: What It Covers and What It Does Not; HIPAA Compliance for Medical Answering Services; Does HIPAA Apply to Therapists in Private Practice?; Does HIPAA Apply to Massage Therapists and Acupuncturists?.
The articles on this page were published between September 9, 2026 and September 11, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 9 to 13 minutes.
Adobe names Acrobat Sign a HIPAA-Ready Service and will act as your business associate. The consumer Acrobat your staff already use is not on that list.
Jotform will sign a BAA, but only on two plans and only after a setting is switched on. Most practices stop at the plan and never finish the setup.
Whether a private-practice therapist is a HIPAA covered entity turns on one question about billing, not on license type or practice size. Here is the test, the cash-only answer, and the duties that apply either way.
Massage therapists and acupuncturists are health care providers under HIPAA's definitions. Most are still not covered entities. The difference is one billing question, and state law fills the gap.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.