Healthcare compliance insights on cybersecurity best practices, ePHI protection, access controls, and audit preparation for HIPAA-regulated organizations.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on state privacy laws and specialty practices.
Healthcare compliance insights covering cybersecurity best practices, ePHI protection strategies, access controls, and audit preparation for HIPAA-regulated organizations. These articles summarize OCR priorities and common gaps found in One Guy Consulting assessments.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
17 min read
Minnesota is the state where the HIPAA treatment exception mostly does not work: the Health Records Act wants a signed, dated consent before a chart leaves the building.
Signed, dated consent is generally required before a chart leaves the building.
16 min read
Michigan's breach law gives HIPAA-compliant providers a pass, but its Public Health Code, Mental Health Code, and Medical Records Access Act do not. Here is the full state layer.
Michigan HIPAA laws add 7-year record retention and a 30-day records response. The breach law gives HIPAA-compliant providers a pass; the Public Health Code does not.
17 min read
Massachusetts has no single health privacy act, but Chapter 93H, 201 CMR 17.00, and a stack of record-specific statutes reach every practice in the state.
Massachusetts HIPAA laws add Attorney General and OCABR breach notices on top of the federal rules, and Chapter 93H and 201 CMR 17.00 reach every practice.
16 min read
Maryland has a medical records act with criminal penalties, a breach law that puts the Attorney General first in line, and a deemed-compliance clause for practices that actually follow HIPAA.
Maryland HIPAA laws add a records act with criminal penalties, a breach law that puts the Attorney General first in line, and a deemed-compliance clause.
17 min read
Colorado counts medical information as personal information, sets a 30-day breach clock, and tells regulated entities the shortest deadline wins.
For HIPAA compliance Colorado sets a 30-day breach clock, half the federal window, and tells regulated entities that the shortest deadline wins.
17 min read
Arizona wrote HIPAA covered entities out of its breach notification statute and into its medical records statute. Here is what that means for a practice in the state.
Arizona HIPAA laws split in two: the breach statute exempts HIPAA covered entities and business associates, while the medical records statute still applies.
12 min read
Patients cannot make you erase a record. They can make you respond by a deadline. If you deny them, they can attach their side of the story to the chart.
A HIPAA amendment request gets a written answer within 60 days, plus one 30-day extension. Patients cannot force an erasure, and there are four grounds to deny.
11 min read
Ambient documentation is allowed under HIPAA. Turning it on without a BAA, a data-use clause, and a risk analysis entry is how a time-saver becomes a breach report.
HIPAA AI scribe rules treat the vendor as a business associate. Before it records a single visit: a BAA, a data-use clause, and a risk analysis entry.
12 min read
Federal rules make an ASC chart dense. Often three separate covered entities touch it on a single case. Here is how the Privacy and Security Rules fit a surgery center.
Surgery center compliance under HIPAA covers one shared chart touched by three covered entities, joint notices with surgeons, ransomware planning, and vendor BAAs.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on state privacy laws and specialty practices. The articles: Minnesota HIPAA Laws & Compliance Requirements; Michigan HIPAA Laws & Compliance Requirements; Massachusetts HIPAA Laws & Compliance Requirements; Maryland HIPAA Laws & Compliance Requirements; Colorado HIPAA Laws & Compliance Requirements; Arizona HIPAA Laws & Compliance Requirements; HIPAA Amendment Request: The 60-Day Rule and Denials; HIPAA AI Scribe Rules for Ambient Documentation; HIPAA Compliance for Ambulatory Surgery Centers.
The articles on this page were published between September 3, 2026 and September 6, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 11 to 17 minutes.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.