Expert guidance on HIPAA compliance, healthcare technology, and building a culture of compliance.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on risk assessments, staff training, and healthcare cybersecurity.
One Guy Consulting's Compliance Blog provides in-depth guidance on HIPAA compliance and healthcare technology for practice managers and clinicians. It explains Security Rule implementation, risk assessments, and cybersecurity steps you can apply in small practices. Browse articles, checklists, and guides tailored to covered entities and business associates.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
Official sources on this page: the HHS Security Risk Assessment Tool (HealthIT.gov) for the risk assessment template article; the OSHA Bloodborne Pathogens standard (29 CFR 1910.1030) for the bloodborne pathogen training article.
13 min read
HIPAA names no form for the risk analysis. What a usable template captures, where the free HHS tool fits, and when a template stops being enough.
No HIPAA risk assessment template is required: the Security Rule names no form. What a usable one captures, and how the free HHS SRA Tool compares.
11 min read
HIPAA compliance guide for dental offices. Covers dental-specific PHI, common violations, imaging security, and practical steps.
HIPAA compliance dentists can manage: X-rays, health history forms, and claims are all PHI, and the same Privacy Rule and Security Rule apply as for hospitals.
17 min read
Third-party HIPAA compliance badges may expose your organization to tracking violations. Learn how redirect chains and ad pixels create hidden risks.
A third-party HIPAA compliance badge can load tracking scripts and send referrer data to outside domains. Without a BAA, that can be an impermissible disclosure.
11 min read
Vercel disclosed a security incident on April 19, 2026 tied to a compromised OAuth chain. What is confirmed and what businesses should do.
The Vercel breach started at Context.ai, a third-party tool linked by OAuth. On Vercel? Check your credentials, configuration data, and deployment workflows.
11 min read
Bloodborne pathogen training for healthcare organizations. What OSHA training covers, why it matters, and how One Guy Consulting training maps to OSHA requirements.
Bloodborne pathogen training is an annual OSHA requirement for healthcare staff with exposure risk. The eight core topics to cover and how to document them.
14 min read
Fraud, waste and abuse training for healthcare organizations. What FWA training covers, who must complete it, and what makes it work.
FWA training teaches the key split: fraud requires intent, waste does not. Upcoding, unbundling, duplicate tests, and how fraud, waste and abuse ties to HIPAA.
24 min read
HIPAA de-identification methods explained: Safe Harbor vs Expert Determination, the 18 identifiers to remove, and common mistakes that leave data identifiable.
De-identified health records need more than a deleted name or record number. HIPAA gives two paths, Safe Harbor and Expert Determination, and both take care.
11 min read
HIPAA social media violations come from ordinary posting habits. What healthcare orgs must control and how to build a workable policy.
HIPAA social media violations rarely start with reckless staff. A selfie, a funny patient story, or a detailed review reply can make a patient identifiable.
11 min read
The HIPAA minimum necessary rule says to use, share, or request only the least PHI needed for the job. Learn how it works, where it does not apply, and common mistakes.
The HIPAA minimum necessary rule limits PHI to what the task needs. How it sets front desk, billing, and clinical access, where it does not apply, and common mistakes.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Articles on this page are authored by Chuck Weiselberg.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Book your free 30-minute intro call using the 'Book a Review' link in the header.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on risk assessments, staff training, and healthcare cybersecurity. The articles: HIPAA Risk Assessment Template and the Free HHS SRA Tool; HIPAA Dental Compliance for Offices & Practices; Is Your HIPAA Compliance Badge a Risk?; Vercel Security Incident: What to Do Now; Bloodborne Pathogen Training for Healthcare; Fraud, Waste and Abuse Training for Healthcare Organizations; HIPAA De-Identification Requirements: Safe Harbor & Expert Methods; HIPAA and Social Media: Staff Mistakes to Avoid; HIPAA Minimum Necessary Rule in Daily Operations.
The articles on this page were published between April 16, 2026 and May 18, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 11 to 24 minutes.
Third-party HIPAA compliance badges may expose your organization to tracking violations. Learn how redirect chains and ad pixels create hidden risks.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.