This article explains how to determine whether a vendor actually requires a BAA, what contract terms HIPAA requires in a compliant BAA, why some “standard vendor BAAs” still fail the requirements, and how to respond when a vendor will not sign. The goal is to give clinics a repeatable decision process that produces defensible outcomes and a clean documentation trail.

This article breaks the topic into three practical systems: AI scribes, call recording, and voicemail transcription. The guiding question is consistent across all three: where does the PHI go, who touches it, how is it secured, and what contractual and policy controls prove that it is handled in a HIPAA-compliant way.

This article explains what HIPAA expects regarding termination procedures and access removal, what “addressable” means in practice for smaller clinics, and how to build an offboarding process that is both defensible and workable. It is informational, not legal advice.

This article explains, in operational terms, what OCR looks at during complaint intake, what typically happens after OCR accepts a complaint for investigation, what kinds of information OCR can request, and how a clinic should respond when the first letter arrives. It focuses on the actual rules and OCR’s published process descriptions, not folklore.

This article explains what the HIPAA attestation requirement for reproductive health care information was designed to do, how it would have worked in real-world request workflows, and what the landscape looks like today.

This report lays out the rule, when it applies, and a defensible implementation workflow for small clinics, including templates for reference.

This article gives a defensible playbook: the legal framework, response scripts that stay out of PHI territory, escalation rules for when to stop replying publicly, vendor and BAA considerations for reputation management, and an incident-response approach if PHI is posted.

If you run a small clinic, you will eventually receive a request for records that looks official and urgent: a subpoena, a court order, or some other legal demand. The two failure modes are predictable. One is handing over too much, too fast, because the document looks scary. The other is ignoring it, because no one knows what to do. HIPAA sits in the middle: it allows disclosures for judicial and administrative proceedings, but only under specific conditions and with tight limits on scope. 

Sending medical records to the wrong person by email, fax, or mail is usually an impermissible disclosure under the HIPAA Privacy Rule, and it is presumed to be a reportable HIPAA “breach” unless you can fit the event into a specific exclusion or you can document a four-factor risk assessment showing a low probability that the PHI was compromised.