Expert guidance on HIPAA compliance, healthcare technology, and building a culture of compliance.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on business associate agreements, whether common software is HIPAA compliant, specialty practices, and policies.
Expert guidance on HIPAA physical safeguards, workforce sanctions, contingency planning, and compliance documentation for small healthcare practices. These articles address the operational side of compliance that many organizations struggle with after completing their initial risk assessment.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
10 min read
Signal has strong end-to-end encryption. It still offers no BAA, no access logs for a practice, and no records to hand over. Encryption was never the whole question.
Is Signal HIPAA compliant? No. The encryption is strong, but Signal offers no BAA, no admin console, and no way to log access or hand you a record.
10 min read
Square has a real BAA, folded into its terms. It also has a list of things the BAA does not touch, and most practices have never read either one.
Is Square HIPAA compliant? Partly. Its BAA covers Appointments, Invoices, and features marked HIPAA-enabled, and it lists exclusions most practices never read.
9 min read
A patient list is PHI before you type a single word of the newsletter. Mailchimp has no BAA and tells you, in its own contract, not to send that list.
Is Mailchimp HIPAA compliant? No. It offers no BAA, and its own data terms prohibit health information. A patient list is PHI before the newsletter is written.
12 min read
DocuSign will sign a BAA, but only on the right plan. You also have to set up the account so signed patient data does not leak through email, retention settings, or a shared login. Here is which plans qualify and what to set.
Is DocuSign HIPAA compliant? It can be: a signed BAA, an eligible plan, and settings that keep signed PHI from leaking through email, retention, or guest access.
10 min read
Yes, HIPAA requires a sanction policy. You must apply appropriate discipline to workforce members who violate your rules, document what you did, and keep the record for six years. Here is what a real one looks like and the mistakes that get practices cited.
What is a sanction policy? Your written rule for disciplining staff who break HIPAA rules. HIPAA requires having one, using it, and keeping the record six years.
8 min read
Urgent care runs at a pace HIPAA never slows down for. The four pressure points: the walk-in desk, the shared workstation, the rotating roster, and the employer on line two.
HIPAA compliance for urgent care has no speed exception. Four pressure points do the damage: the walk-in desk, shared workstations, rotating staff, and employer calls.
8 min read
An optometry practice is a clinic and a retail store sharing one computer system. That split is exactly where its HIPAA problems live, and where the fixes are.
The weak spot in HIPAA security eye care practices share is where the exam lane ends and the optical shop begins. The lab BAA gap is the other.
7 min read
Does a cash chiropractic practice need HIPAA? The answer comes down to one test. If you send even one electronic claim or eligibility check, HIPAA applies to you. Here is how to run the test, plus the rules for testimonials, attorney faxes, and X-rays.
Chiropractors have to follow HIPAA if they bill insurance electronically even once, even through a billing service. Cash practices get a test, not a slogan.
7 min read
PT clinics treat six patients in one room and call it a gym. HIPAA allows that if you have reasonable safeguards in place. Here are four simple ones to put in writing.
HIPAA compliance for physical therapy permits the open gym, if four specific safeguards exist. Most PT clinics have none of them in writing.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on business associate agreements, whether common software is HIPAA compliant, specialty practices, and policies. The articles: Is Signal HIPAA Compliant? No BAA, Here Is Why; Is Square HIPAA Compliant? BAA Scope and Setup; Is Mailchimp HIPAA Compliant? No, Here Is Why; Is DocuSign HIPAA Compliant? BAA & Setup Guide; HIPAA Sanction Policy: Requirements, Examples, Records; HIPAA Compliance for Urgent Care Centers; HIPAA Compliance for Optometry Practices; HIPAA Compliance for Chiropractors and Cash Practices; HIPAA Compliance for Physical Therapy Clinics.
The articles on this page were published on September 3, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 7 to 12 minutes.
Signal has strong end-to-end encryption. It still offers no BAA, no access logs for a practice, and no records to hand over. Encryption was never the whole question.
Square has a real BAA, folded into its terms. It also has a list of things the BAA does not touch, and most practices have never read either one.
A patient list is PHI before you type a single word of the newsletter. Mailchimp has no BAA and tells you, in its own contract, not to send that list.
DocuSign will sign a BAA, but only on the right plan. You also have to set up the account so signed patient data does not leak through email, retention settings, or a shared login. Here is which plans qualify and what to set.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.