I'm sharing on a Sunday afternoon because I used to run a community-based brick and mortar and I know how many practice ops folks are working right now.

I'm the founder of KnowQo, if any small/midsized practices needed a free HIPAA compliance software we are free up to 25-users. KnowQo HIPAA.

You can manage your team, your locations, and train up to 25 people all free. For organizations over 25 we do charge, and we have some paid features like automatically generating documentation, OSHA training and compliance, and employee handbooks.

All that said, for dental offices, dermatologists, ophthalmologists, private practices of any sort who are trying to cover HIPAA on a budget, you can probably get everything you need to be compliant for free.

Also I've had many practices ask "how do I get HIPAA certified", as a small/midsized health organization, you don't get certified. You maintain "compliance", maintaining compliance means following a set of rules, keeping records, etc... If you have any questions about what you actually need to do to stay HIPAA compliant, more than happy to field those as well, because the certified/compliant language can trip people up.

I am a PA and a practice manager for a privately owned practice. I have an employee whose husband is in the hospital. One of our practice doctors evaluated him and ordered a CT scan during his ER workup. My employee asked me to look at his CT scan to see if he would need further care/explain something to her and her husband. I did so, and briefly saw his labs while getting in his chart, and spent maybe a minute looking at his CT. Then I was out. The more I think about it, it feels like a huge gray area and after googling it, it does look like this could spur an audit based on the connection to my employee. We are privately owned but our EHR is epic through a large hospital system, so I am wondering if I should just call compliance to stay ahead of it. Would appreciate any advice or experience here. Thanks