125 plain-English playbooks for the moments a medical practice actually deals with — audit letters, denied claims, HIPAA obligations, payer policy, specialty rules, state overlays. Every guide is source-grounded against HHS, OCR, CMS, eCFR, NIST, and the state regulators we cite. No marketing claims, no fabricated stats.
OCR audit, Medicare ADR, DEA on-site, CMS-855 revocation — the response window is already running. Start here.
60-day window, 4-factor risk assessment, OCR portal, ransomware playbook. The clock starts at discovery.
Modifier disputes, underpayment letters, E/M downcoding, payer policy lookup. The next move depends on the denial reason.
Specialty-specific risk profiles, cadence rules, vendor risk, the policies template, and what the MIPS attestation actually requires.
BAA template, privacy + security officer roles, encryption baseline, training curriculum.
E/M selection, modifier rules, split billing, add-on codes, first-year attending mechanics. The fundamentals, plain.
Medicare ADR response windows are contractor-specific (45 days for MAC/SMRC/RAC, 30 days for UPIC). Miss the window and the claim auto-denies. Here is the procedure that actually works.
7 min read42 CFR Part 416 Conditions for Coverage, CMS State Operations Manual Appendix L, the ASC Infection Control Surveyor Worksheet, and where state ASC licensure tightens the standard.
Compliance · Compliance FoundationsA 2026 annual HIPAA training curriculum for small healthcare practices — eight required modules under 45 CFR 164.530(b) and 45 CFR 164.308(a)(5), with documentation templates.
Compliance · Compliance FoundationsThe federal Anti-Kickback Statute is intent-based, criminal-grade, and the most common fraud-and-abuse theory in OIG enforcement. Here is what AKS actually prohibits, how the safe harbors function, and where practices get caught.
Plain-language playbooks for audit letters, breach windows, regulatory deadlines, specialty obligations, and state overlays. 80 guides covering Emergency Response, Compliance Foundations, Medicare & Payer, Specialty, and State.
Medicare ADR response windows are contractor-specific (45 days for MAC/SMRC/RAC, 30 days for UPIC). Miss the window and the claim auto-denies. Here is the procedure that actually works.
7 min readSpecialty Compliance42 CFR Part 416 Conditions for Coverage, CMS State Operations Manual Appendix L, the ASC Infection Control Surveyor Worksheet, and where state ASC licensure tightens the standard.
9 min readCompliance FoundationsA 2026 annual HIPAA training curriculum for small healthcare practices — eight required modules under 45 CFR 164.530(b) and 45 CFR 164.308(a)(5), with documentation templates.
10 min readCompliance FoundationsThe federal Anti-Kickback Statute is intent-based, criminal-grade, and the most common fraud-and-abuse theory in OIG enforcement. Here is what AKS actually prohibits, how the safe harbors function, and where practices get caught.
9 min readSpecialty ComplianceHow SAMHSA's 42 CFR Part 2 framework for substance use disorder records overlays HIPAA after the 2024 final rule alignment, and what behavioral health practices must document.
8 min readEmergency ResponseAfter a possible PHI incident, the four-factor breach risk assessment at 45 CFR 164.402 determines whether you notify. Do it in writing, do it on the record.
9 min readCompliance FoundationsA 2026 HIPAA Business Associate Agreement template with every 45 CFR 164.504(e) required clause, plus the vendor tracker auditors expect alongside it.
10 min readState ComplianceCalifornia's CMIA (Civ. Code §§ 56–56.37) vs HIPAA: stricter consent, 5-working-day inspection / 15-day copy access, private right of action, up to $25k per knowing-and-willful violation + misdemeanor exposure.
9 min readThe guides explain what the rules say. The SRA is where you actually assemble the documentation a practice needs when a reviewer asks — policies, workforce training logs, BAAs, sanction records, the lot — into one review-ready binder. Administrative documentation aid, not legal advice.
The HIPAA Security Risk Analysis is the most-cited deficiency in OCR enforcement actions. These 22 guides cover the rule itself, the audit process, vendor risk, training, breach response, and specialty-specific risk profiles.
A working list of the vendor categories a small practice typically needs a Business Associate Agreement with under 45 CFR 164.504(e), plus how to handle subcontractor chains.
5 min readAudits and EnforcementThe February 2024 Change Healthcare cyberattack, what HHS and UnitedHealth Group disclosed, and the small-practice lessons about clearinghouse concentration risk, contingency planning, and the Security Rule's information system activity review.
6 min readFoundationsHow the CMS Promoting Interoperability program (formerly Meaningful Use) requires a HIPAA Security Risk Analysis for each EHR reporting period, what the attestation actually claims, and how CMS audits it after the fact.
5 min readToolingWhat the free HHS/ONC Security Risk Assessment Tool actually does, where it stops, and how to evaluate paid alternatives without overpaying for what the free tool already covers.
5 min readAudits and EnforcementThe four-factor risk assessment at 45 CFR 164.402, the 60-day individual notice clock at 164.404, the HHS/media notice paths, and the small-practice annual report under 164.408(c).
6 min readAdministrative SafeguardsWhat the Security Rule contingency plan standard at 45 CFR 164.308(a)(7) actually requires, including data backup, disaster recovery, emergency mode operation, and testing — for a small practice.
5 min readTechnical SafeguardsWhat the Security Rule actually says about encryption at 45 CFR 164.312(a)(2)(iv) and 164.312(e)(2)(ii), the safe harbor under the Breach Notification Rule, and what 'addressable' means in practice.
5 min readAudits and EnforcementHow HHS Office for Civil Rights publishes its enforcement record, the tiered civil money penalty structure at 45 CFR 160.404, and what recent small-practice settlements actually say.
5 min readThe guides explain what an SRA requires. The Studio is the assisted workflow a practice uses to actually produce one — discovery, threat model, controls, gaps, and a source-cited binder for payer, BAA, or internal review. Try the free 5-question readiness check first.
Plain-English answers to the billing questions that come up in primary care every day — E/M selection, modifier rules, NCCI bundling, denial appeals, payer policy. 23 guides, written for the biller who needs the answer in under a minute.
A practical, action-oriented Security Risk Assessment checklist for 1-10 provider practices. Covers the nine OCR elements, asset inventory, addressable specs, and how to document evidence.
7 min readHIPAA ComplianceA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
6 min readHIPAA ComplianceWhat HIPAA actually requires for workforce training, what your training log should contain, and how long to keep it. Built for small practices and office managers.
6 min readHIPAA ComplianceA practical template for turning your Security Risk Assessment into a living risk register plus a 30/60/90 remediation plan, with the CFR anchors small practices need.
6 min readE/M CodingLearn the difference between 99214 and 99215: when each applies, what documentation you need, and the $40/visit revenue impact.
6 min readModifiersWhen to use modifier -25, when to skip it, and the common mistakes that trigger audits and denials.
5 min readDenialsCO-4, CO-97, CO-16, PR-96 and more. What each denial code means and exactly how to fix it.
8 min readDenialsClaim denied? Step-by-step appeal process with payer deadlines, denial code fixes, appeal letter template, and escalation options.
12 min readEvery guide in one flat index. Use your browser’s find (Ctrl/⌘F) to jump to a topic.
The Archive is free and stays free. The workspace — Ask D3 for billing research, the Denial Workbench, Revenue Audit, and the Templates engine — is where these guides become the daily workflow your billing team actually runs.