HIPAA Compliance Case Studies from Real Practices

I was working with a large franchise health group of more than 100 offices. My job was to help each one set up the policies, procedures, training, and records HIPAA calls for. One office had gone quiet for about six months, no matter how often I reached out. Then came an urgent call. A state auditor was due in days, and the audit would decide whether that office kept its license.

The office had fallen far behind. Records had holes. The policies 45 CFR 164.316 calls for were never written. Staff training under 45 CFR 164.530(b) was half done. And they were asking for help days out, not months. No one knew where to start, and the pile of work looked too big to move.

• Ran a fast gap analysis to find the highest-risk holes
• Built a ranked plan around what the state auditor was most likely to ask for
• Gave the office manager and staff clear jobs and clear due dates
• Held a short check-in each day to track progress, answer questions, and clear roadblocks
• Stayed on what the audit would touch, rather than trying to close every gap at once
• Coached the staff so they felt less anxious and more sure of the work

Practices rarely fall behind because they want to ignore the rules. Far more often, other tasks, thin staffing, and the pull of the day push the work down the list. Give them a guide, a clear plan, and the highest-risk items first, and they can cover a lot of ground fast.

At One Guy Consulting, I help practices work through just this kind of thing. Getting set for an audit, dealing with a concern, running a risk assessment, or simply finding out where you stand today: the goal does not change. Build a path that is clear, doable, and made to last.

I worked with a solo eye doctor in a rural town who wore every hat: patient care, the books, the staff, the office itself. Tech was not his strong suit. Reading email, joining a video call, and clicking through online tasks were all real hurdles. And the work ahead called for records, training under 45 CFR 164.530(b), a policy review under 45 CFR 164.316, and steady effort the practice could not get going.

He wanted to get it right. The tech gap kept getting in the way. Meetings moved. Email went unread. Tasks that take another office ten minutes took him far longer. With no compliance team, no IT staff, and no one running the project, there was a real chance he would never finish, and would stay exposed.

• Bent the process to fit how much tech he was at ease with, instead of making him bend to a rigid system
• Found that the office manager was the key partner, and gave her extra training so she could carry it inside the office
• Kept in touch often, followed up, answered straight, and walked each step with him
• Built trust, so questions got asked instead of buried
• Cut the work into small, plain tasks he could finish one at a time

Every practice learns and runs its own way. Some want the fine detail. Others want the big picture, and time. The work goes best when it bends to fit.

At One Guy Consulting, I think the plan should fit the practice - not the other way around. A large group with staff to spare, or a small office juggling this with patient care: the goal does not change. Build a path you can actually walk.

I was working with a large health group with many sites. On paper it had it all: the money, the backing at the top, the systems. But take-up swung wildly from office to office. Some moved along steadily. Others had stalled, or barely touched the tools they had. The group had spent the money. Spending alone was not getting people to take part.

The job was to find out why. The activity data showed that most of these offices were not dodging the work on purpose. They just had no personal tie to it. To an office manager or a provider, it read as one more admin chore, not something the business needed. Auto-emails and stock reminders were not moving anyone.

• Read the activity trends, take-up numbers, and task data across every site to spot patterns
• Weighed a few plays (auto reminders, leaning on the offices already on board, direct outreach) and picked direct outreach to the ones falling behind
• Made personal introductions at the quiet offices, and framed each talk around help, not enforcement
• Ran video calls to answer questions, walk through the workflow, and tie each task back to what 45 CFR Part 164 asks of the group
• Gave every office my direct line and kept the door open

I worked with a small multi-specialty practice that wanted to do better on HIPAA but could not get moving. Nearly every admin job - the schedule, billing, new hires, vendor calls, payroll, patient messages, and compliance - had landed on one office manager. The doctors who owned the place thought the work was rolling along. The office manager was buried, with almost no time left for HIPAA.

She was all in. She just had no room. The urgent stuff each day kept pushing HIPAA down the list. Policies needed a review under 45 CFR 164.316. Training under 45 CFR 164.530(b) was not done. Records needed sorting - and each one landed on a pile that was already too high. The practice was not dodging the work. It had no system for fitting it around the day.

• Looked at what was already done, so no one redid work
• Ranked what was left by risk and weight, rather than dumping every gap at once
• Cut the work into small, plain goals she could finish beside her day job
• Stayed with her, and made questions and roadblocks a normal part of the routine
• Moved the practice from putting out fires to planning ahead

Most of these problems come from too little time, too many demands, and too few hands - not from not knowing. Most health care businesses have no compliance department. They have an office manager wearing six hats.

At One Guy Consulting, I build plans that fit the way a practice really runs. Instead of a long list and goals no one can hit, you get a short, clear plan that moves you ahead while you keep seeing patients.

I worked with a practice that had put real time into its program. The leaders were on board, the staff was trained, and the key tasks got done. Then, in a wider review, we took a hard look at the outside vendors that help run the place - and that is where we found a big hole.

The practice leaned on a long list of outside vendors for tech, billing, software, advice, and admin work. Over the years those ties had piled up, and no one had looked at them through a HIPAA lens. Several of them likely counted as business associates, which calls for a written Business Associate Agreement (per 45 CFR 164.502(e) and 164.504(e)). Some could not be found. Others were never signed. The issue was not neglect - the practice had simply grown faster than its own vendor process.

• Built a full vendor list by talking to the owners, the staff, and the people who run the systems
• Sorted each vendor by what they do and how much protected health information (PHI) they can reach
• Worked out which ones count as business associates and need a BAA under HIPAA (per 45 CFR 164.502(e))
• Chased down the missing Business Associate Agreements and read the ones on file
• Put every vendor record in one place that is easy to keep up
• Set up a check to run on any new vendor before they get near PHI

Gaps that open up as a vendor list grows are among the most common risks in health care, and the easiest to miss. BAAs slip because vendors get added one at a time, over years. A practice often has no idea its paperwork never caught up with choices made long ago.

At One Guy Consulting, I help practices catch this kind of hidden risk before it grows. With vendor reviews, risk assessments, and plain guidance, a program can reach past policies and training to cover the outside firms that keep the place running.

I worked with a practice that had just bought HIPAA compliance software and thought the tool would handle most of the job. The owners had spent real money and saw the rollout as a big step. But software on its own cannot run a Security Risk Assessment (required under 45 CFR 164.308(a)(1)), finish staff training, get Business Associate Agreements signed, or build a culture. They were asking the tool to do work only people can do.

The staff thought the tool would take care of it. The managers thought buying it was effort enough. So take-up lagged. Training (required under 45 CFR 164.530(b)) slipped. Tasks sat open. The policy reviews (per 45 CFR 164.316) were never done. Left alone, the owners would have believed they were finished while most of the work was still ahead.

• Reset the talk: away from the software, toward what it has to produce
• Built a road map with key staff that tied each task to a real job someone owns
• Named what was still open: risk assessments, training, policy reviews, record upkeep, and vendor evaluations
• Cast the platform as a tool that helps the work, not one that does it for you
• Helped each person see their own part in guarding patient information (PHI)

Tech helps you record, manage, track, and sort the work. It does not make you compliant. People do that. It takes input, ownership, and steady effort.

At One Guy Consulting, I help practices close the gap between the tool and the result. Setting up a new platform, running a risk assessment, or starting a program from nothing: the goal does not change. Build something that works in the real world and shows clear results.