Category: Healthcare & HIPAA

A 60-day notification deadline is an outer limit, not an investigation plan. The first day should preserve evidence, stop ongoing exposure, identify the legal decision-makers, and create a record for the breach-risk assessment and any required notices.

When the Office for Civil Rights investigates a healthcare organization, it asks for one document more reliably than any other: the security risk analysis. Most organizations produce something.

Telehealth turned every behavioral health practice into a technology operation almost overnight, and the compliance obligations did not pause for the transition.

A physician employment contract is a decade of your professional life compressed into fifteen pages, and the terms that will matter most are the ones you are least likely to read closely. The time to negotiate them is before you sign, because after that they are simply the rules.

The business associate agreement says the vendor will safeguard your data. The security exhibit says how. When those two documents disagree, or when the exhibit is missing, you have a contract that promises protection and specifies none.

A healthcare tenant signs a lease written for a generic retail store and later finds it cannot expand its X-ray room, cannot sell the practice without the landlord’s blessing, and is personally on the hook for the whole term. Here is what to look for before you sign.

Buyers fixate on the multiple and negotiate the price to the dollar, then inherit problems the price never accounted for. In a dental acquisition, the number on the term sheet is rarely where the real risk lives.