Self-Serve tier

Classify a healthcare communication as HIPAA marketing (requiring individual authorization) vs. treatment, payment, or healthcare operations (TPO) (permitted without authorization) under 45 CFR §164.501. Applies the definition of marketing, TPO carve-outs, and refill reminder / t

For Privacy Officers responding to a confirmed PHI breach affecting 500 or more individuals, this skill produces the 60-day OCR + media + individual notification workflow with templates anchored to 45 CFR 164.408.

For Privacy Officers and compliance counsel at covered entities or business associates drafting or reviewing a BAA, this skill produces a clause-by-clause checklist against the 45 CFR 164.504(e) required elements with redline language.

For Privacy Officers and procurement teams deciding whether a vendor needs a BAA, this skill applies the narrow HHS conduit-exception test against vendor function and persistent-storage facts to produce a defensible BAA-required vs not-required determination.

For legal counsel and privacy officers at organizations with mixed healthcare and non-healthcare functions, this skill produces a defensible hybrid-entity designation document under 45 CFR 164.105 with healthcare-component boundaries.

For Privacy Officers reviewing patient communications, this skill applies the 45 CFR 164.508 marketing definition against the proposed message to determine whether prior written authorization is required versus permissible TPO under 45 CFR 164.506.

For Privacy Officers operationalizing the minimum-necessary standard for internal workforce access to PHI, this skill produces role-based access criteria and routine-disclosure protocols anchored to 45 CFR 164.502(b) and 164.514(d).

For Privacy Officers and outside counsel responding to an HHS OCR investigation or data request, this skill produces a 30-day response packet, document-collection protocol, and privilege log structured against 45 CFR 160.310.

For HIM directors and Privacy Officers managing patient record requests, this skill produces a 30-day right-of-access workflow with fee-cap controls and form/format compliance under 45 CFR 164.524 and the OCR Right of Access Initiative.

For mental health providers and Privacy Officers handling psychotherapy notes, this skill produces a notes-segregation policy, separate-authorization form, and access-denial protocol anchored to 45 CFR 164.508(a)(2) and 164.524(a)(1)(i).

For research compliance officers and IRB administrators evaluating PHI use in research, this skill applies the 45 CFR 164.512(i) waiver criteria versus 164.508 authorization to produce the correct pathway with documentation.

For CISOs and Privacy Officers conducting the HIPAA Security Rule risk analysis, this skill produces an enterprise-wide assessment per 45 CFR 164.308(a)(1)(ii)(A) using NIST SP 800-30 Rev 1 methodology with risk register output.

For multi-state covered entities and Privacy Officers reconciling HIPAA with state medical privacy laws, this skill applies the 45 CFR 160.203 more-stringent test to produce a preemption matrix per topic and per state.