HIPAA compliance resources covering vendor management, gap analysis, incident response planning, and documentation requirements under 45 CFR Part 164.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on state privacy laws and specialty practices.
Articles on vendor management, gap analysis, incident response planning, and the documentation requirements under 45 CFR Part 164 that small practices often overlook. Understanding these requirements before an OCR audit or breach investigation can save your organization significant time and expense.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
16 min read
Washington's breach law runs a 30-day clock, its health records act gives patients 15 working days, and its My Health My Data Act sits just outside HIPAA. Here is the whole state layer.
Summarizes Washington's 30-day breach clock and the My Health My Data Act's relation to HIPAA.
17 min read
Virginia recognizes a right of privacy in the health record itself, caps breach penalties at $150,000 per breach, and leaves HIPAA entities out of its consumer privacy act.
Summarizes Virginia's recognition of a privacy right and the $150,000 per-breach cap.
15 min read
Tennessee wrote HIPAA-covered entities out of its 45-day breach statute and out of its new consumer privacy act, which makes the federal program the whole game for most practices.
Explains Tennessee's treatment of HIPAA-covered entities under state breach and privacy law.
19 min read
Older guides tell Ohio practices to plan around a 45-day state breach clock. The statute exempts HIPAA covered entities outright. What actually stacks on HIPAA in Ohio is the records access and fee law, the mental health and HIV confidentiality sections, and a litigation defense for practices with a real Security Rule program.
Explains Ohio's records access, mental health and HIV confidentiality layers that stack on HIPAA.
17 min read
North Carolina's breach law reaches paper records, requires an Attorney General report for every breach that triggers notice, and makes a violation an unfair trade practice. Here is how it fits with HIPAA.
Explains NC's AG report requirement for breaches and how state law treats paper records.
15 min read
A billing company never treats a patient, yet it often holds more complete patient records than its clients do. HIPAA calls that a business associate, and the Security Rule applies to it directly.
Explains when billing companies hold more complete patient records and how the Security Rule applies.
12 min read
A pediatric chart has two audiences from day one, and by the teenage years those audiences disagree. HIPAA decides who counts as the "individual," and it hands the hardest calls to state law.
Explains who counts as the 'individual' for minors and when state law controls.
12 min read
A partner in the exam room, a genetic screen in the portal, a subpoena for prenatal records, and a federal rule a court threw out. OB/GYN is where HIPAA gets tested weekly.
Summarizes frequent HIPAA issues in OB/GYN like genetic screens, subpoenas, and exam-room privacy.
12 min read
A dermatology chart is mostly pictures. Total body photography, dermoscopy images, and before-and-after shots are all P.H.I., and the phone that took them is a device the Security Rule has opinions about.
Explains why total body and dermoscopy images are PHI and why device security matters.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on state privacy laws and specialty practices. The articles: HIPAA Compliance for Medical Billing Companies: BA Rules; HIPAA Compliance for Pediatric Practices: Parents and Minors; HIPAA Compliance for OB/GYN Practices: What Applies Now; HIPAA Compliance for Dermatology Practices: A Field Guide; Washington State HIPAA Laws & Compliance Requirements; Virginia HIPAA Laws & Compliance Requirements; Tennessee HIPAA Laws & Compliance Requirements; Ohio HIPAA Laws & Compliance Requirements; North Carolina HIPAA Laws & Compliance Requirements.
The articles on this page were published between September 6, 2026 and September 7, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 12 to 19 minutes.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.