Guidance on HIPAA administrative safeguards, technical controls, policy development, and compliance program management for covered entities and business associates.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on OCR audits, specialty practices, and access controls.
Practical resources on HIPAA administrative safeguards, technical controls, and policy development to help your organization build and maintain a defensible compliance program. These articles address real-world implementation challenges that small and mid-sized healthcare practices face during audits and risk assessments.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
11 min read
The adjuster wants the whole chart. The employer wants to know why the employee is out. 164.512(l) says what you may release, and minimum necessary says how much.
HIPAA workers compensation disclosures need no authorization under 164.512(l). The adjuster who wants the whole chart still gets only the minimum necessary.
12 min read
The lab result is positive for a reportable disease. The new medical assistant asks if the patient must sign first. The front desk says HIPAA allows the report. The physician says the state requires it. Each has part of the answer.
HIPAA public health disclosures need no signed release under 45 CFR 164.512(b). The standard is a permission, not a mandate, and it names six kinds of recipients.
12 min read
A signed release for the "complete record" arrives. Whether the therapist's session notes go with it depends on one question: where were they filed?
HIPAA psychotherapy notes get extra protection only when kept apart from the chart. Kept that way, they need their own authorization and sit outside the right of access.
10 min read
The before-and-after went up the same afternoon. The patient texted "sure." In 2019, a dental practice paid $10,000 after sharing patient information on social media. Here is the form that makes a post legal.
HIPAA patient photos and testimonials used in marketing need a signed 164.508 authorization. A full-face photo is an identifier, and a texted "sure" is not a form.
11 min read
No, HIPAA does not say eight characters and change it every 90 days. It says something harder: write procedures for creating, changing, and safeguarding passwords, and be able to defend them.
HIPAA password requirements set no length and no rotation schedule. The rule asks for written procedures to create, change, and safeguard passwords you can defend.
11 min read
A mother at the front desk wants her 16-year-old's visit notes. HIPAA has an answer, and the answer points at your state.
HIPAA laws for minors start at 164.502(g): a parent is usually the minor's personal representative, with exceptions that point back to state law.
10 min read
The machine by the front desk has a hard drive full of scanned charts, referrals, and insurance cards. The lease ends next month. Here is what has to happen before it rolls out the door.
HIPAA copier hard drive rules sit in 164.310(d). A leased copier keeps an image of every chart, referral, and insurance card it scanned, and the drive leaves with it.
11 min read
A patient asks who looked at her chart. Either the answer is in a log someone actually reviews, or the practice is about to learn what OCR means by audit controls.
HIPAA audit logs exist to answer one question: who opened this chart, and when? Audit controls are Required, and so is regular review of what they record.
11 min read
HIPAA has no small-practice exemption. It has a flexibility clause, and it has a list of jobs that all land on the same desk. Here is the whole assignment for a one-clinician practice.
HIPAA compliance for solo practitioners has no size exemption. Privacy official, security official, workforce training: every assigned role lands on one desk.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on OCR audits, specialty practices, and access controls. The articles: HIPAA Workers Compensation Disclosures Explained; HIPAA Public Health Disclosures: When Reporting Is Allowed; HIPAA Psychotherapy Notes: The Separate-File Rule; HIPAA Patient Photos and Testimonials: Authorization Rules; HIPAA Password Requirements: What the Rule Says; HIPAA Minors Parents Access: Who Sees the Chart; HIPAA Copier Hard Drive Rules: Returns and Disposal; HIPAA Audit Logs: What to Record, Review, and Keep; HIPAA Compliance for Solo Practitioners: What Applies.
The articles on this page were published between September 7, 2026 and September 8, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 10 to 12 minutes.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.