Compliance is not a document. It is a set of habits with a document attached.
Most practices have a HIPAA binder. Rather fewer have current policies, a written disaster recovery plan, an employee computer policy anyone has read, and training records from this year. The binder is the part that gets done because the binder is the part that feels finished.
What patients are entitled to be told
It is advisable to give patients written information about how their medical information is handled. Practically, those forms should cover:
- Where their files are stored
- Who has access to their files
- The name, address and contact details of your billing service
- The name of the healthcare clearinghouse your claims are processed through
- The method by which claims are transmitted
That last group is worth noticing: three of the five require you to know exactly who touches your claims. If you cannot answer them about your current biller, that is itself the finding.
Where we help
- Employee and patient forms drafted and kept current
- Employee computer policy — written, distributed, and actually enforceable
- Disaster recovery plan
- Off-site data backup
- Contingency operations plan
- Annual HIPAA training for staff, with records that survive an inspection
- Employee computer monitoring software where appropriate
Our own position
We will sign a BAA before any PHI moves, not after onboarding starts. All work is performed in the United States — there is no offshore subcontractor with access to your patients’ data, because there is no subcontractor. Access is role-based, data is encrypted in transit and at rest, and backups are redundant and off-site.
And this website collects no PHI at all: no patient details, no uploads, no free-text message boxes anywhere, including on the contact form. The calculators run entirely in your browser and store nothing.
| Patient identifiers | None |
| Free-text message fields | None |
| File uploads | None |
| Calculator inputs stored | None |
| Callback form fields | Name, contact, practice |
The absence of a message box is deliberate. It is the single most common way PHI ends up somewhere it should not be.
Related
Off-site backup and disaster recovery are compliance obligations as much as operational ones, and audit protection tests the documentation side of the same problem.