Expert guidance on HIPAA compliance, healthcare technology, and building a culture of compliance.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on risk assessments, business associate agreements, whether common software is HIPAA compliant, policies, and access controls.
HIPAA resources on data backup procedures, facility access controls, device and media controls, and staff security awareness training requirements. These articles help organizations build the operational policies and procedures that auditors and regulators expect to see documented.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
6 min read
HIPAA does not tell you how long to keep patient charts. State law does. The six-year rule everyone cites covers something else entirely.
HIPAA data retention is six years, but that clock covers compliance documents, not patient charts. Chart retention comes from state law, so verify yours.
11 min read
Yes, with a business or enterprise plan, the automatic BAA, and correct configuration. The BAA is the easy part. Setup is where practices slip.
Microsoft 365 HIPAA compliance: business and enterprise plans carry the BAA automatically. The setup, like turning on MFA, is where practices slip.
11 min read
The HIPAA onboarding sequence for a small practice: what to sign, train, assign, and document before a new hire ever touches a patient record.
HIPAA treats access as the trigger, so a HIPAA employee onboarding checklist starts before the first login: what to sign, train, assign, and document.
12 min read
Accountable HQ sells HIPAA software and training. This review checks its public HIPAA content against the regulation, finding by finding.
Short answer: Accountable markets a "HIPAA certification." HHS does not recognize private HIPAA certifications; confirm claims against 45 CFR Parts 160 and 164.
12 min read
Google now lets you sign in with a selfie video. Here is what healthcare organizations need to know about biometric authentication, HIPAA compliance, and the risks of cloud-stored facial data.
Google selfie sign-in swaps your password for a short face video on personal accounts. What cloud-stored facial data means for healthcare teams that handle PHI.
14 min read
HIPAA consulting is less rigid than compliance software alone. A consultant who also offers software wrote this comparison. This comparison explains common gaps when software is used without a consultant.
HIPAA compliance consulting or compliance software? What each gets right, where each falls short, and how a small practice picks the one that fits.
7 min read
HHS pushed the Security Rule overhaul to July 2027. But the 42 CFR Part 2 changes for substance use disorder records are already in force. Here is what your practice needs to do right now.
The HIPAA Security Rule 2027 date is a delay, not a reprieve. Final action moved to July 2027, and the substance use disorder privacy changes are already enforceable.
6 min read
A small clinic with no Security Risk Assessment and no written HIPAA policies is operating with zero defensible compliance. Here is what that actually means when OCR comes knocking.
Small clinic HIPAA compliance with no Security Risk Assessment and no written policies is zero defensible compliance. One patient complaint can open an investigation.
9 min read
Small clinic without a HIPAA risk assessment? Here is why you need one and exactly what happens after compliance gaps are found.
A small clinic HIPAA risk assessment is required whatever your headcount. Why OCR is targeting practices that skipped it, and what comes after gaps are found.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on risk assessments, business associate agreements, whether common software is HIPAA compliant, policies, and access controls. The articles: How Long to Keep Medical Records: HIPAA and State Rules; Is Microsoft 365 HIPAA Compliant? BAA & Setup Guide; HIPAA Employee Onboarding Checklist for Small Practices; Accountable HQ Review: A HIPAA Accuracy Check (2026); Google's Selfie Sign-In: What Healthcare Teams Need to Know About Biometric Authentication; HIPAA Consulting vs Compliance Software: Which Fits Your Practice?; HIPAA Security Rule Delayed to 2027: What Changed and What to Do Now; No Risk Assessment, No HIPAA Policies: What Small Clinics Risk; Does Your Small Clinic Need a HIPAA Risk Assessment? What Happens After the Gaps Are Found.
The articles on this page were published between July 18, 2026 and September 2, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 6 to 14 minutes.
No; state law sets retention periods; the six-year rule commonly cited covers a different requirement.
Microsoft 365 can be HIPAA-compliant with a business or enterprise plan, the automatic BAA, and correct configuration.
Yes; the Security Rule requires an accurate and thorough risk analysis and documentation to guide remediation.
HIPAA consulting is less rigid than compliance software alone. A consultant who also offers software wrote this comparison. This comparison explains common gaps when software is used without a consultant.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.