Practical guidance on AI governance and HIPAA compliance, written for the people who run the program.
Subscribe by RSS to hear when a new post is published
April 29, 2026
45 CFR 164.514(a) covers de-identification. This post walks through the two lawful methods and their limits, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →April 28, 2026
45 CFR 164.512(j) covers serious threat to health or safety. This post walks through the narrow safety exception, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →April 27, 2026
45 CFR 164.512(f) covers law enforcement purposes. This post walks through what you may disclose, and what you must not, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →April 24, 2026
45 CFR 164.512(e) covers judicial and administrative proceedings. This post walks through responding to a subpoena or court order, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →April 23, 2026
45 CFR 164.512(b) covers public health activities. This post walks through reporting to public health authorities, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →April 22, 2026
45 CFR 164.512(a) covers disclosures required by law. This post walks through reading the required-by-law exception narrowly, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →April 21, 2026
45 CFR 164.510 covers uses and disclosures requiring an opportunity to object. This post walks through facility directories and family involvement, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →April 20, 2026
45 CFR 164.508(a)(2) covers psychotherapy notes. This post walks through the separate authorization standard, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →April 17, 2026
45 CFR 164.508 covers authorizations. This post walks through when an authorization is required and what it must contain, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →April 16, 2026
45 CFR 164.504(e) covers business associate contracts. This post walks through the privacy-side contract requirements, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →