Healthcare Compliance Insights

Compliance Blog: Page 7

Expert guidance on HIPAA compliance, healthcare technology, and building a culture of compliance.

Archive

HIPAA Compliance Articles: Page 7

This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on business associate agreements, whether common software is HIPAA compliant, state privacy laws, and specialty practices.

Articles on breach notification timelines, minimum necessary standards, and Security Rule requirements that healthcare IT teams need to understand. From encryption decisions to access logging, these resources help organizations implement technical safeguards that satisfy both the letter and spirit of HIPAA.

Articles by , Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).

About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.

"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
HIPAA compliance Pennsylvania cover: state breach act, records retention 18 min read
Chuck Weiselberg, Founder at One Guy Consulting, CHP (not an attorney)

Pennsylvania HIPAA Laws & Compliance Requirements

Pennsylvania has no single health privacy code. It has a breach act with a HIPAA clause, a 2024 Attorney General notice rule, seven-year physician retention, and HIV and drug and alcohol consent rules that a federal authorization form does not satisfy.

Hospital compliance deadlines Pennsylvania adds to HIPAA: breach notice clocks, Attorney General notice above 500 residents, and seven-year physician record retention.

Read
HIPAA compliance Georgia cover: state record retention, breach law, and penalties 16 min read
Chuck Weiselberg, Founder at One Guy Consulting, CHP (not an attorney)

Georgia HIPAA Laws & Compliance Requirements

Georgia mostly follows the federal rules, so its few state additions are easy to miss. They include a 10-year physician record rule, a disposal law, and a breach law aimed at information brokers and data collectors.

Georgia HIPAA laws lean on the federal rules, so the state additions are easy to miss: a 10-year physician record rule, a disposal statute, and a breach law.

Read

Recent policy & AI analysis

Browse older posts

FAQ

Blog FAQ

What topics does this Compliance Blog cover?

HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.

Who authors these posts?

Chuck Weiselberg writes the articles listed on this page.

Who is the blog for?

Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.

What is the free 30-minute session?

A free 30-minute intro call with an experienced consultant to assess your current program.

Is the blog content legal advice?

Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.

How do I book the free 30-minute intro call?

Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.

What is PHI?

Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.

What is ePHI?

PHI that is created, received, maintained, or transmitted in electronic form.

What is a Business Associate?

A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.

What is a BAA?

The written contract HIPAA requires between a covered entity and a business associate.

Where are key terms defined?

See the Key HIPAA terms section on this page.

What topics are on this page?

Guides on business associate agreements, whether common software is HIPAA compliant, state privacy laws, and specialty practices. The articles: HIPAA Compliance for Imaging Centers: A Practical Guide; Pennsylvania HIPAA Laws & Compliance Requirements; Georgia HIPAA Laws & Compliance Requirements; Is Claude HIPAA Compliant? Enterprise BAA Guide; HIPAA Accounting of Disclosures: What Must Be Logged; HIPAA Tracking Pixels: What a Practice Website Can Run; HIPAA Compliance for Hospice Providers: A Practical Guide; HIPAA Compliance for Home Health Agencies: Field Rules; New Jersey HIPAA Laws & Compliance Requirements.

What date range do these posts cover?

The articles on this page were published on September 3, 2026. Each article shows its publication date.

What is this page?

An archive of HIPAA compliance articles for small practices.

Where are state HIPAA guides?

State HIPAA guides are listed in this archive and linked by state name.

How long are the articles on this page?

Read times for the articles on this page range from 11 to 18 minutes.

Quick answers

Quick answers from this page

Is Claude HIPAA Compliant?

Anthropic will sign a BAA for Claude, but only on Enterprise, only after a one-way switch is flipped, and only for the features on its covered list.

By state

State-specific HIPAA guides

State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.

Topics

Security Rule

BAAs

Breach Reporting

Resources

Resources & glossary (SRA, templates, external links)

"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."

HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)

Key terms

Key HIPAA terms on this page

Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.

Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.

"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."

(45 CFR 160.103)

Protected Health Information (PHI)
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium. 45 CFR 160.103Example: a patient's name and appointment date on a front-desk schedule.
Electronic PHI (ePHI)
PHI that is created, received, maintained, or transmitted in electronic form. 45 CFR 160.103Example: lab results stored in your EHR or attached to an email.
Covered Entity
A health plan, health care clearinghouse, or health care provider that transmits health information electronically. 45 CFR 160.103Example: a dental office that bills insurance electronically.
Business Associate
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors. 45 CFR 160.103Example: an IT company that manages the server where your patient records live.
Business Associate Agreement (BAA)
The written contract HIPAA requires between a covered entity and a business associate. 45 CFR 164.502(e), 164.504(e)Example: the agreement a billing company signs before it receives your claims data.
Security Rule
The standards for protecting ePHI through administrative, physical, and technical safeguards. 45 CFR Part 164, Subpart CExample: giving each staff member a unique login to the EHR.
Security Risk Assessment (SRA)
The accurate and thorough risk analysis the Security Rule requires you to conduct and document. 45 CFR 164.308(a)(1)(ii)(A)Example: listing every laptop, phone and server that holds ePHI and rating the risk to each.
Breach Notification Rule
After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified. 45 CFR 164.400 to 164.414Example: a stolen unencrypted laptop holding patient files can require notice to every affected patient.
Free 30-Minute Session

Free 30-Minute Intro Call: Book Now

Book a free 30-minute intro call with an experienced consultant to assess your current program.

See the Case Studies page for client remediation examples and lessons learned.

Book your free 30-minute intro callSee plans and pricing
OGC-BotHow can One Guy Consulting help today?