When Does a Sponsored Appointment Reminder Become HIPAA Marketing?
A reminder can move from treatment communication into HIPAA marketing when a third party pays the practice to promote its product or…
Category
HIPAA
Does a Cloud Provider Need a HIPAA BAA If It Cannot Decrypt the ePHI?
Yes. A cloud provider can be a HIPAA business associate even when it stores only encrypted ePHI and never receives the decryption key. HHS…
How Should a HIPAA-Covered Dental Practice Reply to a Google Review?
A HIPAA-covered dental practice should answer a Google review without confirming that the reviewer is a patient or discussing care,…
How a HIPAA Business Associate Supports a Patient Access Request
A HIPAA business associate can help fulfill a patient access request, but the covered entity remains responsible for the individual’s right…
Healthcare Tracking Pixels After American Hospital Association v. Becerra
The court decision in American Hospital Association v. Becerra did not give healthcare organizations general permission to use tracking…
Outside HIPAA Does Not Make Health Conversion Tracking Low Risk
A finding that HIPAA does not apply to a particular actor or activity answers only the HIPAA question. It does not establish that health…
HIPAA Authorization, Privacy Consent, and Google Ads Permission Are Different Gates
HIPAA Authorization, Privacy Consent, and Google Ads Permission Are Different Gates. A clinic can satisfy one gate and still fail another.…
Does a BAA Let a SaaS Vendor Benchmark One Clinic Against Another?
No, not by itself. A business associate agreement can authorize a SaaS vendor to perform defined services with protected health…
A Google Cloud BAA Does Not Cover Google Ads
A Google Cloud Business Associate Agreement applies to the Google Cloud services and conditions identified in that agreement. It does not…
How to Run a Tabletop Exercise for Breach Notification
A breach-notification tabletop should test roles, facts, evidence, risk assessment, communications, recovery, and post-exercise actions…
Proposed HIPAA Security Rule Changes for Incident Plans
As of August 15, 2026, distinguish the HIPAA Security Rule currently in effect from proposed modifications. Prepare incident,…
HIPAA Contingency Plans: Backup, Restore, and Testing
A HIPAA contingency plan should cover backup, disaster recovery, emergency mode, restore testing, recovery objectives, and evidence. The…