A patient calls asking for their spouse's test results
You generally cannot release this without written authorization from the patient — even to a spouse.
Get the answer →New to HIPAA? You're in the right place.
Plain English explanations — no legal jargon, no overwhelm. Pick your role below and we'll show you exactly what you need to know.
Start here
What's your role at your organization?
We'll show you exactly what HIPAA means for you and what you actually need to do.
Front desk staff
Front desk & admin staff
Receptionists, schedulers, billing staff, and anyone who handles patient information at the front
Your reading path →Practice managers
Practice manager
Office managers, practice administrators, and those responsible for running the practice
Your reading path →Healthcare providers
Healthcare provider
Doctors, nurses, therapists, pharmacists, and all clinical staff who treat patients
Your reading path →Software and IT vendors
Software or IT vendor
SaaS companies, IT providers, billing services, and anyone whose software touches patient data
Your reading path →What is HIPAA→What to protect→Your daily rules→If something goes wrong→Your checklist
Select your role above for a personalized path.
Plain English explainers
Short articles, big clarity
- What is HIPAA and why does it apply to my office?Start here
- Access controls — who can click what
- Do we need a Privacy Officer?
- Do we need to sign anything? Business Associate Agreements explained simply
- Does HIPAA apply to my software company or service?
- Encryption in plain English
- HIPAA and computers — passwords, locks, and shared desks
- HIPAA and mental health — extra sensitivity
- HIPAA and mobile devices — phones and tablets in patient care
- HIPAA and patient care — talking to other providers
- HIPAA and voicemail — keep messages short
- HIPAA for software companies (the short version)
- HIPAA in your daily work (without the stress)
- HIPAA policies without the three-ring binder fantasy
- Notice of Privacy Practices — what goes in it?
- Verbal privacy at the front desk
- What are we actually allowed to say about patients?
- What HIPAA training does our staff actually need?
- What patient information do we need to protect?
- What should I do if I think something went wrong?
- Your HIPAA basics checklist
Common misconceptions
HIPAA myths — quick reality checks
Myth
"We're too small to be fined for HIPAA violations"
Reality
OCR has fined solo practices and offices with fewer than 10 staff.
Myth
"Our software is HIPAA compliant so we're covered"
Reality
Your vendor's compliance does not cover your practice. You are still fully responsible.
Myth
"HIPAA means we can never talk about patients"
Reality
You can discuss treatment with other providers involved in a patient's care.
Real situations, clear answers
What do I do if…
I accidentally sent a fax to the wrong number
This may be a reportable breach. Take these steps in the next 24 hours.
Get the answer →I saw a coworker looking at patient records they shouldn't be
This is an internal HIPAA violation. You have an obligation to report it.
Get the answer →A patient wants a copy of their medical records
Patients have a legal right to their records. You have 30 days to provide them.
Get the answer →Compliance checklist
Is your practice covered?
Check off basics as you go — we save progress in your browser on this device.
0 of 16 items complete
- Notice of Privacy Practices posted in waiting area and given to new patients
- All staff completed HIPAA training within the last year
- A Privacy Officer has been designated at your practice
- Signed Business Associate Agreements with all software vendors handling patient data
- Computers are password protected and lock automatically after a few minutes
- Staff only access patient records they need for their specific job
HIPAA glossary
Every term you'll encounter — in plain English
PHIePHICovered entityBusiness associateBAAOCRBreachMinimum necessaryPrivacy officerNotice of Privacy Practices (NPP)AuthorizationDe-identificationEncryptionPatient rightsPolicies and proceduresAccess controlsBreach notificationCivil monetary penaltyWorkforce training
Browse full glossary →Ready to get compliant?
Start with our free risk assessment — about 10 minutes — or ask a question in plain English.
Not legal advice. medcomply.ai provides educational compliance basics; consult qualified counsel for legal decisions.