Compliance
The rulebook, and the proof you followed it.
Policies say what the clinic does. Procedures say how. Safety checks are the record that somebody actually did it, on the day they said they would.
- Three sides, one place. Policies, procedures and safety checks, rather than a binder and a spreadsheet.
- Servicing that chases you. An autoclave or AED due for service becomes a task, not a thing somebody remembers.
- Exportable. The written security policy comes out as a document you can hand to an auditor or an insurer.
HIPAA, in one sentence
LogBlues is built to HIPAA’s requirements from day one, with encryption on your computer and in the cloud backup, access controls, audit logs and a signed Business Associate Agreement that covers that backup, and it keeps working through the failures other systems do not: the app runs without internet, every change is saved as you go, the backup restores with one button, and we say plainly that the software supports your compliance rather than claiming it does it for you.
What lives in the Compliance area
Three lists, side by side.
The Compliance area has three entries on its left rail: Policies, Procedures and Safety checks. Any of them can be hidden with Customize. HIPAA, the Health Insurance Portability and Accountability Act, asks a practice to have written policies and to keep proof that it follows them. Both live here.
Policies.
A policy is an article: a title, a category, a one-line summary, the full text, and a review note such as “Reviewed quarterly and whenever consent guidance changes.” The eight categories are Patient Care, Patient Safety, Infection Prevention, Documentation, Results, Medication, Privacy and Scheduling. Owners and administrators add a policy by pasting its text or uploading a Word document, and can change the title, category, text and review note later. Everyone on the team can search the library and filter it by category.
Built in
Nine policies come with every workspace.
Every clinic starts with the same nine, whatever its specialty, each with its review schedule already written: respectful patient contact and examination; patient identification before care; hand hygiene and standard precautions; clinical documentation and late entries; abnormal results and closed-loop follow-up; medication reconciliation and refill safety; privacy during communication and release of information; missed appointments and continuity of care; emergency recognition and escalation. Keep them, rewrite them to match how your clinic works, or replace them.
Procedures, by contrast, come by specialty: more than three hundred across more than thirty specialties, plus a short shared list every clinic gets. A dental workspace does not start with a vein clinic’s procedures.
Procedures.
A procedure is one thing the clinic does for a patient, with what it needs before and after: the name, an internal code, a category (consultation, diagnostic, treatment, surgical, therapy or follow-up), the typical minutes, and the preparation, clinical steps and follow-up notes.
From a date to a task
How a service date becomes a task.
Equipment lives in Inventory with a location, a status, a serial number, a next service date and a next calibration date. The Inventory screen flags anything due within thirty days under Service due.
A built-in rule called Equipment maintenance turns those dates into work. It is on from the first day, runs when LogBlues opens and every hour after, and looks thirty days ahead (set it anywhere from one to ninety). For each service or calibration date inside that window it creates one task, “Service” or “Calibrate” plus the equipment’s name, with the location and due date in the details, assigned to the rule’s owner (Office manager to start) and due the next day. A date already passed makes the task Critical; otherwise it is Routine. One date makes one task, never a duplicate, and the task says LogBlues created it. It shows on Tasks and the dashboard like any other, and you close it the same way.
Safety checks chase you differently: they are ticked on their own screen, and the Check soon warning and the count of checks due are how they get your attention.
Safety checks.
A safety check is equipment that must work on the day it is needed: an AED (automated external defibrillator), emergency oxygen, and anything else you add. Each has a name, a location, a status (Ready, Check due or Needs attention), the days between checks, notes, the date last checked and the date next due. One click on Mark checked today records today and sets the next date from the interval. Fourteen days before a check falls due it turns to Check soon, and the screen counts how many are due. Only staff with inventory management access can add or tick a check; everyone else sees the list read-only.
The cart
The emergency cart, inspected and signed.
An emergency cart is a safety check with contents. It lives in Inventory with a name, a location and a seal number, and each supply on it is linked to a stock item with a target quantity, so the cart knows when it is short. Inspecting it is a short checklist: the seal number, seal intact and matching the record, contents at target, medication and supply dates reviewed, emergency equipment ready, and notes. Saving writes a dated record with the name of the person signed in and a status of Ready or Needs attention, and the cart keeps its inspection history. If it is not ready, LogBlues creates a restock task on the spot, due the next day.
The log
The security log, and what an auditor sees.
The Security screen keeps a log called Security activity: everything security-related that has happened on this computer, newest first, each line with a type, a title, the details and the time. It records every export (a backup file, a result saved as PDF, printed or emailed, a letter printed, a claim file generated), a workspace restored from backup, a protected result opened or verified, every change to a security setting including choosing never to lock the screen, claim sending turned on or off, patients imported or an import undone, a visit recording started, recovery codes generated, and a sign-in or an account deleted.
The log holds the latest five hundred events and travels with the encrypted workspace, so it survives a restart. Next to it, Sessions & devices lists everywhere LogBlues is open, and owners and administrators can end any session. Owners and administrators are the people who read the log.
On paper
Export for an auditor or an insurer.
The security log.
Export audit CSV saves the whole log as a spreadsheet file with four columns: timestamp, type, title, detail. The export is itself written to the log.
The written security policy.
Export security policy saves a Word document describing the security controls LogBlues uses. Hand it to whoever asks how the software protects records.
Policies as documents.
A policy uploaded as a Word document stays attached by name, so the approved text is the file you already have.
Reports.
Everything in Reports exports to Excel or CSV.
The Business Associate Agreement itself is on the HIPAA page; we sign it with any clinic that asks, free.
Show me
Inspections and accreditation days.
A visit from an inspector, an insurer or an accrediting body is a series of “show me” questions. Show me your infection prevention policy: open Policies and filter by category. Show me the AED was checked: the card says where it is, when it was last checked and when it is next due. Show me the emergency cart log: the inspection history, dated, with a name and seal number on every line. Show me who exported patient data this year: the security log as a spreadsheet, sorted by type. None of this is a claim of accreditation. It is the dated evidence a reviewer asks for, ready without a search through a filing cabinet or an inbox.
Still yours
What compliance work LogBlues does not do for you.
HIPAA puts its duties on the practice, not on its software. LogBlues helps with each of these and cannot do them for you.
Training.
Staff must be trained on the policies, and the training recorded. The library gives them the current text; the training is yours to run.
The written risk analysis.
The Security Rule asks every practice for its own. We publish how the software protects records; your practice’s analysis is yours to write.
Physical safeguards.
Disk encryption on, screens locked when walking away, machines that stay in the building.
Agreements with every vendor
that touches patient information, not only us: a billing service, a clearinghouse, an email provider.
Naming an officer, and reading the log.
Someone is named privacy and security officer, and someone reads the security log on a schedule.
Breach notification.
If unsecured patient information gets out, the practice tells the affected patients and the Department of Health and Human Services within the rule’s deadlines. The log gives you the who and when to start from.
The full split is on How LogBlues complies with HIPAA, and the HIPAA checklist is the short version to work through.
An example
A month in the Compliance area.
An example, not a client: a two-provider clinic with one office manager.
-
1
Week one
The office manager reads the nine built-in policies with the providers, rewrites the missed-appointment policy to match how the front desk actually calls, and uploads the clinic’s privacy notice as a Word document. She adds two safety checks, the AED every thirty days and the oxygen every fourteen, and gives the autoclave in Inventory its next service date.
-
2
Week two
The Equipment maintenance rule sees the autoclave’s date thirty days out and puts “Service autoclave” on her task list, marked Routine. She books the technician and closes the task once he has been.
-
3
Week three
The oxygen check turns to Check soon; the nurse presses Mark checked today and the next date moves out fourteen days. The emergency cart is inspected: seal intact, two items below target, so it is marked Needs attention and a restock task appears, due tomorrow.
-
4
Week four
A provider prints a referral letter and saves a result as PDF for a specialist; both go to the security log. The owner reads the month’s activity in five minutes and exports the log for the file. Nothing was remembered. Everything was written down on the day.
What this is not.
It is not a certification, and it does not make a practice compliant on its own. It is the place the evidence lives so that when somebody asks, the answer is a record rather than a search through email.