Schema Care
BlogSign inStart free

HIPAA, BAAs and PHI

Before any vendor touches patient paperwork, compliance comes first. This category explains what HIPAA asks of software that reads medical documents: when a business associate agreement is required, how PHI de-identification and redaction work, what encryption, access controls, audit logs and retention policies should cover, and how to review a vendor's security. It is plain guidance, not legal advice. Read "What Is a Business Associate Agreement? A Plain Guide" first, then "Safe Harbor vs Expert Determination: Which to Use".

  1. Safe Harbor vs Expert Determination: Which to Use

    Safe Harbor vs Expert Determination: how each HIPAA de-identification method works, what it costs, what it keeps, and which fits your document data.

    September 18, 2026hipaade-identificationsafe harborphi

  2. The 18 HIPAA Identifiers, With Document Examples

    The 18 HIPAA identifiers listed with examples of where each one appears on EOBs, claims and lab reports, plus the exceptions for dates and ZIP codes.

    September 13, 2026hipaaphide-identificationsafe harbor

  3. Encryption at Rest and in Transit for PHI

    What HIPAA expects for encryption at rest and in transit for PHI: storage, backups, TLS, who holds the keys, and where email and fax break the chain.

    September 6, 2026hipaaencryptionsecurity

  4. HIPAA Compliant Data Extraction, Field by Field

    How to run HIPAA compliant data extraction: why extracted fields stay PHI, how to apply minimum necessary, and how to keep review queues and exports safe.

    July 17, 2026hipaaextractionminimum necessaryphi

  5. Audit Logs Under HIPAA: What to Record and Keep

    Audit logs under HIPAA: which events to record for PHI documents, sample log entries, how long to keep them, and how to review them without drowning.

    June 12, 2026hipaaaudit logsecurity

  6. Choosing a BAA OCR Vendor: Questions to Ask First

    How to choose a BAA OCR vendor: the questions to ask before signing, how subprocessors and offshore keying touch PHI, and red flags in a vendor's answers.

    May 14, 2026baavendor reviewocrphi

  7. Choosing HIPAA Compliant Document Management

    What HIPAA compliant document management needs: access, audit, encryption and deletion features, and whether plain cloud storage is enough for records.

    April 26, 2026hipaadocument managementcloud storagephi

  8. PHI De-Identification: A Step-by-Step Guide for Documents

    PHI de-identification for medical documents in five steps: pick a method, remove identifiers, check the result, and document the work for an audit.

    March 25, 2026hipaaphide-identificationdocuments

  9. What Is a Business Associate Agreement? A Plain Guide

    Learn what a business associate agreement is, which clauses HIPAA requires, and when a document vendor must sign one before it touches patient paperwork.

    March 20, 2026hipaabaavendorsphi

  10. Limited Data Set vs De-Identified Data Under HIPAA

    Limited data set vs de-identified data under HIPAA: what each keeps, when a data use agreement applies, and whether pseudonymized records count as either.

    January 17, 2026hipaalimited data setde-identificationphi

  11. The Healthcare Vendor Security Questionnaire, Annotated

    A healthcare vendor security questionnaire, section by section: what to ask, which evidence to request, and how to read pen test reports and risk reviews.

    December 16, 2025vendor reviewsecurityrisk assessmentbaa

  12. Access Controls for PHI in Document Workflows

    Access controls for PHI in document workflows: the Security Rule standards, role-based access for review queues, a sample role matrix, and offboarding.

    October 1, 2025hipaaaccess controlreview

  13. SOC 2 vs HIPAA: What Each One Proves About a Vendor

    SOC 2 vs HIPAA explained: why one is a law and one an audit report, why there is no HIPAA certification, and where HITRUST fits for healthcare vendors.

    September 1, 2025soc 2hipaahitrustvendor review

  14. HIPAA Compliant OCR: What Makes a Tool Safe for PHI

    What makes HIPAA compliant OCR: where scanned pages and text copies live, local versus cloud OCR, and the features a tool needs before it reads PHI.

    July 30, 2025hipaaocrphisecurity

  15. Breach Notification Rule Basics for Document Vendors

    Breach notification rule basics for PHI in documents: what counts as a breach, the four-factor risk assessment, deadlines, and what vendors must report.

    July 7, 2025hipaabreachvendors

  16. HIPAA Compliant AI: What It Takes to Use AI on PHI

    What HIPAA compliant AI really requires: a BAA, no training on your PHI and controlled logs, plus why general chatbots are off limits for patient data.

    May 23, 2025hipaaaiphibaa

  17. De-Identified Sample Documents for a Pilot

    How to build de-identified sample documents for a pilot of document AI: which layouts to include, how to strip identifiers, and what to test before a BAA.

    March 10, 2025de-identificationpilotsample documentsphi

  18. HIPAA Compliant Document Processing: A Checklist

    A checklist for HIPAA compliant document processing, from intake to export and deletion, showing who owns each control: your team or the vendor.

    December 11, 2024hipaachecklistphiautomation

  19. Redacting PHI From PDFs Without Leaving Traces

    Redacting PHI from PDFs so nobody can recover it: why black boxes fail, a step-by-step method, what redaction software should do, and how to verify it.

    November 13, 2024redactionphipdfde-identification

  20. Writing a Data Retention Policy for Medical Documents

    How to write a data retention policy for medical documents a vendor processes, including when to delete source files after extraction, with a template.

    November 7, 2024hipaaretentionvendors