Practical guidance on AI governance and HIPAA compliance, written for the people who run the program.
Subscribe by RSS to hear when a new post is published
May 28, 2026
45 CFR 164.414 covers burden of proof. This post walks through documenting why notification was not required, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 27, 2026
45 CFR 164.410 covers business associate breach notification. This post walks through what a business associate owes the covered entity, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 26, 2026
45 CFR 164.408 covers notification to the secretary. This post walks through the two HHS deadlines and which applies, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 22, 2026
45 CFR 164.406 covers media notification. This post walks through the more-than-500-residents threshold, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 21, 2026
45 CFR 164.404 covers individual breach notification. This post walks through the 60-day deadline and required content, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 20, 2026
45 CFR 164.402 covers breach definition and risk assessment. This post walks through the four-factor analysis and the presumption, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 19, 2026
45 CFR 164.530(j) covers privacy documentation retention. This post walks through the six-year retention rule for privacy records, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 18, 2026
45 CFR 164.530(g) covers refraining from retaliation. This post walks through the anti-retaliation and no-waiver rules, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 15, 2026
45 CFR 164.530(d) covers complaint process. This post walks through a complaint route patients can actually use, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 14, 2026
45 CFR 164.530(c) covers administrative safeguards for privacy. This post walks through safeguarding PHI in paper and conversation, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →