Practical articles on HIPAA Security Rule implementation, Privacy Rule requirements, risk assessment best practices, and breach notification compliance for healthcare organizations.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on business associate agreements, breach prevention, and whether common software is HIPAA compliant.
Continue exploring the One Guy Consulting HIPAA compliance library. These articles cover Security Rule implementation, risk assessment best practices, and breach notification requirements for healthcare organizations of all sizes. Whether you are a covered entity or business associate, these resources break down complex regulatory language into actionable steps your team can follow.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
10 min read
Abyde prices by product, employee count and location. What its own calculator shows, and what the alternatives publish.
Abyde alternatives with published prices: what Abyde's own calculator shows per product, next to Accountable HQ, Live Compliance, Medcurity and TotalHIPAA.
8 min read
Compliancy Group took its prices off its website in September 2026. Here is the last public list, dated, and the math for a 5 and a 10 person practice.
Compliancy Group pricing is now quote-only. The last public list, dated July 2026, and what a 5 or 10 person practice would pay for it.
13 min read
The misdirected fax was handled in April. The statement mailed to an old address was handled in August. Nobody has told HHS about either one, and the filing is due 60 days after the year ends.
HIPAA small breach reporting runs on its own calendar: log every breach under 500 people, then file them with HHS within 60 days after the year ends.
10 min read
Stripe is a superb card processor and a terrible place for a diagnosis. Its own agreement defines PHI, then tells you not to send it as third-party data.
There is no Stripe BAA, and Stripe's Services Agreement bars PHI in third-party data. Take payments, but keep diagnoses out of descriptions and receipts.
10 min read
Salesforce will sign a BAA through your account rep. Then its restrictions page puts encryption on you. You must encrypt all PHI you send, and the PHI you store where you control it.
Is Salesforce HIPAA compliant? Only with a signed Business Associate Addendum for its HIPAA Covered Services, and the restrictions page puts encrypting PHI on you.
9 min read
A cloud phone system turns every voicemail, fax, and text into a stored file. RingCentral can be covered under HIPAA. Old forwarding rules can be the problem.
Is RingCentral HIPAA compliant? It can be covered, with a BAA through sales. The exposure is every voicemail, fax, and text that old forwarding rules send elsewhere.
10 min read
HubSpot signs a BAA inside its Sensitive Data terms. PHI is then allowed in exactly the places HubSpot lists, and nowhere else, including your marketing emails.
Is HubSpot HIPAA compliant? On Enterprise, with Sensitive Data on and the BAA accepted. Even then, PHI may live only where HubSpot lists, and not in marketing emails.
9 min read
There are at least four things called Gemini. One is on Google's HIPAA list, and one is explicitly excluded. With one, human reviewers may read some of your chats.
HIPAA compliant Gemini exists only inside Google Workspace with the BAA accepted. The consumer app on a personal account, and Gemini in Chrome, are not covered.
9 min read
Google Forms is on Google's HIPAA list, as part of Drive. The form your receptionist built on her own Gmail account last spring is not.
Is Google Forms HIPAA compliant? Only on Workspace with the BAA accepted, riding on Drive's coverage. A form on a staff member's personal Gmail is not covered.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on business associate agreements, breach prevention, and whether common software is HIPAA compliant. The articles: Abyde Alternatives for Small Practices (2026 Comparison); Compliancy Group Pricing (2026): What It Costs a Small Practice; HIPAA Small Breach Reporting: The Log and March 1; Is Stripe HIPAA Compliant? No BAA, Here Is What Works; Is Salesforce HIPAA Compliant? BAA and Restrictions; Is RingCentral HIPAA Compliant? BAA and Setup Guide; Is HubSpot HIPAA Compliant? Enterprise BAA Guide; Is Google Gemini HIPAA Compliant? Workspace BAA Guide; Is Google Forms HIPAA Compliant? Workspace BAA Guide.
The articles on this page were published between September 11, 2026 and September 29, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 8 to 13 minutes.
Stripe is a superb card processor and a terrible place for a diagnosis. Its own agreement defines PHI, then tells you not to send it as third-party data.
Salesforce will sign a BAA through your account rep. Then its restrictions page puts encryption on you. You must encrypt all PHI you send, and the PHI you store where you control it.
A cloud phone system turns every voicemail, fax, and text into a stored file. RingCentral can be covered under HIPAA. Old forwarding rules can be the problem.
HubSpot signs a BAA inside its Sensitive Data terms. PHI is then allowed in exactly the places HubSpot lists, and nowhere else, including your marketing emails.
There are at least four things called Gemini. One is on Google's HIPAA list, and one is explicitly excluded. With one, human reviewers may read some of your chats.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.