Practical guidance on AI governance and HIPAA compliance, written for the people who run the program.
Subscribe by RSS to hear when a new post is published
April 15, 2026
45 CFR 164.502(g) covers personal representatives. This post walks through who may act for a patient, and when, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →April 14, 2026
45 CFR 164.502(b) covers minimum necessary. This post walks through applying minimum necessary to real workflows, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →April 13, 2026
45 CFR 164.502(a) covers permitted and required uses and disclosures. This post walks through the default rule and its exceptions, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →April 10, 2026
45 CFR 164.316(b)(2)(iii) covers updates. This post walks through reviewing and updating documentation on a cadence, with the language of the requirement itself and the evidence an assessor asks to see. It is a required implementation specification, so there is no documented-alternative route.
Read more →April 9, 2026
45 CFR 164.316(b)(2)(ii) covers availability. This post walks through making documentation available to the workforce, with the language of the requirement itself and the evidence an assessor asks to see. It is a required implementation specification, so there is no documented-alternative route.
Read more →April 8, 2026
45 CFR 164.316(b)(2)(i) covers time limit. This post walks through the six-year clock and when it starts, with the language of the requirement itself and the evidence an assessor asks to see. It is a required implementation specification, so there is no documented-alternative route.
Read more →April 7, 2026
45 CFR 164.316(b)(1) covers documentation. This post walks through documentation and the six-year retention rule, with the language of the requirement itself and the evidence an assessor asks to see. It is a standard, so it must be met in full and there is no documented-alternative route.
Read more →April 6, 2026
45 CFR 164.316(a) covers policies and procedures. This post walks through policies and procedures that reflect what you do, with the language of the requirement itself and the evidence an assessor asks to see. It is a standard, so it must be met in full and there is no documented-alternative route.
Read more →April 3, 2026
45 CFR 164.314(a)(2)(iii) covers subcontractor obligations in business associate contracts. This post walks through how obligations flow down the chain, with the language of the requirement itself and the evidence an assessor asks to see. It is a required implementation specification, so there is no documented-alternative route.
Read more →April 2, 2026
45 CFR 164.314(a)(2)(i)(C) covers security incident reporting in business associate contracts. This post walks through who tells whom, and how fast, with the language of the requirement itself and the evidence an assessor asks to see. It is a required implementation specification, so there is no documented-alternative route.
Read more →