Expert guidance on HIPAA compliance, healthcare technology, and building a culture of compliance.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on OCR audits, business associate agreements, breach prevention, whether common software is HIPAA compliant, and vendor management.
One Guy Consulting publishes in-depth guides and compliance checklists on Security Rule implementation, risk assessments, and healthcare cybersecurity. Its posts explain policy, technical controls, and audit evidence in practical terms.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
17 min read
HIPAA consulting costs for small healthcare offices range from one-time projects to ongoing support. See what drives pricing and what you get for it.
HIPAA compliance cost for small business owners depends on the work already done, what your practice needs, and how fast. What drives it, and consulting vs software.
12 min read
Not every vendor needs a BAA, but every PHI-touching one does. Learn when BAAs are required, how to manage them, and what proof to keep for audits.
The vendor BAA rule is one line: any vendor that creates, receives, maintains, or transmits PHI for you needs one. For MSPs, that line reaches subcontractors too.
10 min read
Auditors want documented proof of HIPAA compliance, not verbal assurances. See the documents, logs, and records to have ready for an audit.
A HIPAA audit checklist built on proof, not promises: dated documents, signed records, system logs, and vendor BAA files, organized so you can show them.
6 min read
Hacking and IT incidents now cause most reported healthcare data breaches. Here is who gets hurt, which HIPAA rules come up most often, and steps a small practice can take right now.
Healthcare breach trends show incidents accelerating across hospitals, clinics, insurers, and business associates. Which attacks dominate and what cuts exposure.
6 min read
Acadia Healthcare's 2026 breach began when an attacker tricked their way into one employee's email and SharePoint account. It exposed data on 1,807 people. Here is what went wrong and what practices can learn.
The Acadia Healthcare data breach exposed patient Social Security numbers, which cannot be changed like a password. What was exposed and who is affected.
9 min read
Former employees who keep their system access are a common HIPAA gap. Learn how to build a termination checklist that protects your practice.
Employee termination access revocation should happen the same day: logins, devices, keys, and records. Ex-employees with active logins are a top HIPAA audit finding.
23 min read
On March 27, 2026, threat group TeamPCP compromised the Telnyx Python SDK on PyPI in a three-stage supply chain attack. This article examines the HIPAA compliance gaps the attack exposed and what healthcare organizations must do to assess risk, manage vendor relationships, and meet breach notification obligations.
The Telnyx supply chain attack hid malware in Python SDK versions 4.87.1 and 4.87.2 on PyPI. If your voice, SMS, or fax APIs touch ePHI, it is a HIPAA problem.
13 min read
"HIPAA lists 18 identifiers that link health information to a person." (see 45 CFR 164.514(b)(2))
Most healthcare staff do not know what they are. Here is why that matters when your team uses AI tools.
The 18 HIPAA identifiers decide what counts as PHI. Strip every one before anything goes into an AI prompt, a code snippet, a training dataset, or a debug log.
17 min read
ChatGPT is not HIPAA compliant by default. What healthcare teams need to know about BAAs, PHI in prompts, and building an AI acceptable use policy.
Is there a HIPAA compliant ChatGPT? Not Free or Plus: OpenAI offers no BAA for them. Enterprise and the API are BAA-eligible, and a BAA alone is still not enough.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice Managers, Office Managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on OCR audits, business associate agreements, breach prevention, whether common software is HIPAA compliant, and vendor management. The articles: HIPAA Compliance Cost for Small Practices (2026 Pricing); Do Vendors and MSPs Need a BAA for Every PHI-Touching Vendor?; What Proof Do Auditors Expect for HIPAA Compliance?; Healthcare Data Breach Trends: What the Numbers Tell Us; Acadia Healthcare Breach Exposes Data; HIPAA Termination Procedures; How the Telnyx Supply Chain Attack Exposes HIPAA Compliance Gaps; PHI 18 Identifiers: What Counts as Protected Health Information; Is ChatGPT HIPAA Compliant? What Teams Must Know.
The articles on this page were published between May 19, 2026 and June 13, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 6 to 23 minutes.
Not every vendor needs a BAA, but every PHI-touching one does. Learn when BAAs are required, how to manage them, and what proof to keep for audits.
Auditors want documented proof of HIPAA compliance, not verbal assurances. See the documents, logs, and records to have ready for an audit.
ChatGPT is not HIPAA compliant by default. What healthcare teams need to know about BAAs, PHI in prompts, and building an AI acceptable use policy.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.