Expert guidance on HIPAA compliance, healthcare technology, and building a culture of compliance.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on whether common software is HIPAA compliant and specialty practices.
Expert articles on HIPAA compliance for telehealth, cloud computing, mobile devices, and remote workforce security in healthcare settings. As healthcare delivery models evolve, these articles address the compliance implications of new technologies and workflows.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
7 min read
Apple does not sign Business Associate Agreements for iCloud, making it non-compliant for PHI. This covers iCloud Drive, Mail, iMessage, FaceTime, and backups.
Is iCloud HIPAA compliant for any PHI? No. Apple signs no BAA for iCloud, so Drive, Mail, iMessage, FaceTime, and iCloud backups are all off limits.
9 min read
Free Gmail has no path to Google's BAA. What Google itself says, what HHS says when patients already email a free inbox, and how Workspace Gmail gets set up.
HIPAA compliant email Gmail can offer comes only through paid Google Workspace with a signed BAA. Free @gmail.com accounts never qualify, whatever the settings.
8 min read
Is Dropbox HIPAA compliant? Only on paid team plans with a signed BAA. Learn which plans qualify, required settings, common mistakes, and how Dropbox compares to Google Drive.
Is Dropbox for Business HIPAA compliant? It can be, on paid team plans with a signed BAA and the right settings. Free and personal accounts never qualify.
7 min read
Is Slack HIPAA compliant? Only on a Slack Enterprise plan. Slack Pro and Business+ do not qualify. Learn the restrictions, costs, and better alternatives for healthcare practices.
A Slack BAA exists only on Enterprise Grid. Free, Pro, and Business+ get none, and even on Grid, Slack cannot be used for patient-facing messages.
7 min read
Is Microsoft Teams HIPAA compliant? Yes, on eligible Microsoft 365 plans with automatic BAA coverage. Learn which plans qualify, required settings, and common mistakes.
Microsoft Teams HIPAA compliance comes with eligible paid Microsoft 365 plans, never the free version. The BAA is automatic; the configuration is still on you.
9 min read
Is Google Drive HIPAA compliant? Only with a Google Workspace account and a signed BAA. Learn key settings, common mistakes, and how to set up Drive for healthcare.
Is Google Drive HIPAA compliant for patient files? Only in a Google Workspace account with a signed BAA and the right settings. Personal Gmail accounts do not qualify.
8 min read
Is Zoom HIPAA compliant? Only on paid plans with a signed BAA. Learn which plans qualify, how to request the BAA, required settings, and the mistakes that put practices at risk.
Is Zoom HIPAA compliant for telehealth? Only on a paid plan with a signed BAA. The free tier has no BAA option, and settings and staff habits still matter.
14 min read
Does your practice website need to be HIPAA compliant? Learn which features trigger HIPAA requirements and what to fix right now.
How to make a website HIPAA compliant: find where it touches PHI, like symptom forms, scheduling, portals, and chat. Encrypt that traffic and get a BAA from each vendor.
12 min read
A HIPAA gap analysis compares your current compliance posture against Privacy Rule, Security Rule, and Breach Notification Rule requirements. For small practices, it is where compliance stops being abstract and starts getting specific.
A HIPAA gap analysis shows where your practice meets the Privacy Rule, Security Rule, and Breach Notification Rule, and where it falls short. It is not an SRA.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on whether common software is HIPAA compliant and specialty practices. The articles: Is iCloud HIPAA Compliant? No, and Here Is Why; Is Gmail HIPAA Compliant? Free Gmail vs Google Workspace; Is Dropbox HIPAA Compliant? What Healthcare Practices Need to Know; Is Slack HIPAA Compliant? Enterprise Plan Requirements Explained; Is Microsoft Teams HIPAA Compliant? What Healthcare Practices Need to Know; Is Google Drive HIPAA compliant? What practice managers need to know; Is Zoom HIPAA Compliant? What Healthcare Practices Need to Know; HIPAA Compliance for Websites: Does Your Practice Website Need to Be Compliant?; How to Conduct a HIPAA Gap Analysis for Small Practices.
The articles on this page were published between June 29, 2026 and July 11, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 7 to 14 minutes.
Apple does not sign Business Associate Agreements for iCloud, making it non-compliant for PHI. This covers iCloud Drive, Mail, iMessage, FaceTime, and backups.
Free Gmail has no path to Google's BAA. What Google itself says, what HHS says when patients already email a free inbox, and how Workspace Gmail gets set up.
Is Dropbox HIPAA compliant? Only on paid team plans with a signed BAA. Learn which plans qualify, required settings, common mistakes, and how Dropbox compares to Google Drive.
Is Slack HIPAA compliant? Only on a Slack Enterprise plan. Slack Pro and Business+ do not qualify. Learn the restrictions, costs, and better alternatives for healthcare practices.
Is Microsoft Teams HIPAA compliant? Yes, on eligible Microsoft 365 plans with automatic BAA coverage. Learn which plans qualify, required settings, and common mistakes.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.