Expert guidance on HIPAA compliance, healthcare technology, and building a culture of compliance.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on ransomware, telehealth, and state privacy laws.
One Guy Consulting's Compliance Blog provides in-depth guidance on HIPAA compliance and healthcare technology for practice managers and clinicians. It explains Security Rule implementation, risk assessments, and cybersecurity steps you can apply in small practices. Browse articles, checklists, and guides tailored to covered entities and business associates.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
16 min read
HIPAA compliance for Chicago and statewide Illinois practices: what BIPA, GIPA, and state privacy law add on top of HIPAA.
HIPAA compliance in Chicago and across Illinois has two layers: federal HIPAA, plus state laws like PIPA and BIPA that go further, including on breach notice timing.
14 min read
Florida HIPAA compliance guide with state-level details for healthcare teams.
Florida HIPAA laws mean two layers: federal HIPAA, plus FIPA's stricter breach notice rules, which reach organizations outside Florida that hold Florida residents' data.
17 min read
Texas HIPAA compliance guide: HB 300, SB 1188, and breach notice rules, with practical steps for Texas providers.
Texas HIPAA laws add to federal HIPAA: staff training every two years, fast patient record access, and larger breaches reported to the Attorney General within 30 days.
19 min read
California HIPAA compliance guide with CMIA, CCPA health data rules, patient access, breach notice, and a step-by-step checklist.
California HIPAA requirements stack on the federal floor: CMIA, CCPA/CPRA health data rules and state breach notice. Where the two differ, follow the stricter law.
18 min read
New York HIPAA compliance guide with state privacy and data security rules.
HIPAA compliance in New York has two layers: federal HIPAA as the floor, then the SHIELD Act, Public Health Law §18, the Mental Hygiene Law and SHIN-NY on top.
14 min read
Hour-by-hour ransomware response plan for healthcare. Covers containment, reporting, and recovery to protect your practice and patients.
Ransomware response, hour by hour, for a practice's first 72 hours: contain the damage, report it, notify patients, and recover without guesswork.
14 min read
Real-world HIPAA compliance timelines by team size, plus a step-by-step rollout plan.
How long does HIPAA compliance take for a small practice? A solo office can reach a defensible baseline in 4 to 8 weeks; 5 to 25 staff, 8 to 16 weeks.
21 min read
Master HIPAA in 2026 with this guide on the Privacy Rule, Security Rule, Breach Notification Rule, risk analysis, and enforcement trends.
A HIPAA compliance checklist for 2026: the Privacy Rule, Security Rule, breach notice, risk reviews and enforcement trends, for covered entities and business associates.
11 min read
HIPAA rules for telehealth: what your platform needs, BAA must-haves, patient consent, tech controls, and what changed after the COVID-19 emergency ended.
Telemedicine HIPAA compliance asks for the same protections as in-person care: encryption, a BAA with your video vendor, patient consent, and the right platform.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on ransomware, telehealth, and state privacy laws. The articles: Illinois HIPAA Compliance & Requirements Guide; Florida HIPAA Laws & Compliance Requirements; Texas HIPAA Laws & Compliance Requirements; California HIPAA & CMIA Compliance Guide; Ransomware Hit Your Practice: First 72 Hours; HIPAA Compliance Requirements in New York; How Long Does HIPAA Compliance Take?; Complete HIPAA Compliance Guide 2026; Telemedicine Compliance: HIPAA Considerations.
The articles on this page were published between January 23, 2026 and February 11, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 11 to 21 minutes.
Real-world HIPAA compliance timelines by team size, plus a step-by-step rollout plan.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.