Expert guidance on HIPAA compliance, healthcare technology, and building a culture of compliance.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on risk assessments, telehealth, state privacy laws, specialty practices, and email and texting.
Articles on HIPAA compliance fundamentals including workforce training, organizational policies, and regulatory updates for healthcare organizations. These foundational resources are especially useful for organizations just beginning their compliance journey or revisiting their program after a change in leadership.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
8 min read
The COVID grace period is over. Telehealth now faces full HIPAA enforcement. Learn which platforms you can use, how to protect patient data, and what a proposed Security Rule change could mean.
HIPAA telehealth rules apply in full again. Enforcement discretion ended May 11, 2023, so platforms, BAAs, encryption, and consent count on every virtual visit.
14 min read
Your patients already email you. Which email services sign a BAA, what each costs on its own pricing page, and the settings to turn on.
HIPAA compliant email services start with a signed BAA: which providers offer one, what each lists on its own pricing page, and the settings to turn on.
20 min read
Yes, faxing is still HIPAA compliant in 2026. Traditional fax over phone lines is considered secure, but cloud fax requires a BAA. Learn the rules, common mistakes, and modern alternatives.
Under HIPAA fax regulations, traditional fax over phone lines is generally acceptable. Cloud fax needs a BAA, and the real risk is in how staff use it.
24 min read
Received a HIPAA complaint? Do not panic. Follow this step-by-step guide covering internal complaints, OCR investigations, documentation, and how to respond without making things worse.
Most HIPAA complaints end without a fine. OCR reports 152 settled or penalized cases since April 2003, but a prompt, documented response still shapes the outcome.
20 min read
Can you text patients under HIPAA? Standard SMS is not compliant for PHI. Learn what you can and cannot text, patient consent rules, and HIPAA-compliant alternatives.
HIPAA texting comes down to what you send, how you send it, and documented patient consent. Standard SMS is unencrypted and sits on carrier servers.
27 min read
If a laptop, phone, or USB drive with patient data just went missing, follow these HIPAA incident response steps. Covers remote wipe, breach assessment, notification rules, and how to prevent it.
Lost device HIPAA incident response covers remote wipe, the four-factor breach assessment, and notification. PHI encrypted to NIST standards counts as secured.
12 min read
The HIPAA Security Rule requires a risk assessment, and it is the best first step for compliance. Learn why to start here, what it covers, and what happens next.
The main purpose of a HIPAA risk assessment is to find threats and weak spots in your ePHI before they become breaches. Every other compliance decision builds on it.
12 min read
HIPAA does not exempt small practices. What the rules require of a 2 to 5 person office, what scales to your size, and what help costs.
HIPAA compliance for small business in health care: a 2 to 5 person practice owes the same duties as a large one, sized to how the office works.
13 min read
A gap analysis identifies HIPAA weaknesses. Learn what comes next: remediation planning, timelines, ownership, and how to close gaps before an audit.
A HIPAA gap analysis finds the problems; it fixes nothing. Remediation means ranking findings by risk, assigning owners and deadlines, and closing gaps before an audit.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on risk assessments, telehealth, state privacy laws, specialty practices, and email and texting. The articles: HIPAA and Telemedicine: Compliance Requirements for Telehealth; HIPAA Compliant Email Services for Small Practices (2026); HIPAA & Faxing in 2026: Is Fax Still Compliant? Rules, Risks & Alternatives; How to Respond to a HIPAA Complaint: Privacy Officer's Step-by-Step Guide; HIPAA & Texting: Can You Text Patients? Rules, Risks & Compliant Alternatives; Lost or Stolen Device? HIPAA Incident Response Steps for Healthcare Teams; What Is the Main Purpose of a HIPAA Risk Assessment?; HIPAA Compliance for Small Business: A Practice Guide; HIPAA Gap Analysis: Process, Findings & Remediation.
The articles on this page were published between June 13, 2026 and June 18, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 8 to 27 minutes.
Yes, faxing is still HIPAA compliant in 2026. Traditional fax over phone lines is considered secure, but cloud fax requires a BAA. Learn the rules, common mistakes, and modern alternatives.
Can you text patients under HIPAA? Standard SMS is not compliant for PHI. Learn what you can and cannot text, patient consent rules, and HIPAA-compliant alternatives.
If a laptop, phone, or USB drive with patient data just went missing, follow these HIPAA incident response steps. Covers remote wipe, breach assessment, notification rules, and how to prevent it.
The HIPAA Security Rule requires a risk assessment, and it is the best first step for compliance. Learn why to start here, what it covers, and what happens next.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.