Practical guidance on AI governance and HIPAA compliance, written for the people who run the program.
Subscribe by RSS to hear when a new post is published
May 13, 2026
45 CFR 164.530(b) covers privacy training. This post walks through the privacy half of workforce training, which security training misses, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 12, 2026
45 CFR 164.530(a) covers privacy official designation. This post walks through naming a privacy official and a contact person, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 11, 2026
45 CFR 164.528 covers accounting of disclosures. This post walks through the six-year accounting and its exclusions, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 8, 2026
45 CFR 164.526 covers right to amend. This post walks through handling an amendment request and a denial, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 7, 2026
45 CFR 164.524(c)(3)(ii) covers individual-directed transmission. This post walks through third-party directives after Ciox v. Azar, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 6, 2026
45 CFR 164.524 covers right of access. This post walks through the 30-day clock, the fee cap and the format rules, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 5, 2026
45 CFR 164.522 covers requests for restrictions. This post walks through the self-pay restriction you cannot refuse, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 4, 2026
45 CFR 164.520 covers notice of privacy practices. This post walks through what the notice must say and where it must appear, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →May 1, 2026
45 CFR 164.514(h) covers verification requirements. This post walks through verifying identity and authority before disclosing, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →April 30, 2026
45 CFR 164.514(e) covers limited data set. This post walks through when a limited data set is the right tool, with the language of the requirement itself and the evidence an assessor asks to see.
Read more →