Guess What? Compliance Can Be Simple!

Not every mistake is a breach. But every potential incidentmust be assessed.

In this episode of Guess What? Compliance Can Be Simple!, Dr. Natasha Guess clears up one of the most misunderstood areas in healthcare compliance. What actually constitutes a breach under HIPAA, why HIPAA presumes a breach unless you can prove otherwise, and why the moment you suspect something happened is the moment the clock starts.

She uses a real scenari; a misdirected fax that wasretrieved quickly to show that even fast recoveries require documented assessment. Because silence increases exposure. Process reduces it.

Guess What? Compliance Can Be Simple! is hosted by

Dr. Natasha Guess, founder of Guess Compliance Consulting LLC.

Connect with Dr. Natasha Guess:

Website: guesscomplianceconsultingllc.com

Compliance Strategy Call:

https://calendly.com/guesscomplianceconsulting-proton/compliancestrategycall

In this episode Dr. Natasha Guess takes on a compliance problem that most small and mid-size practices are carrying right now without realizing it. Your policy is signed. Your team completed training. But the way work actually gets done has quietly moved in a different direction.

That gap is not visible until something goes wrong. And by then it is expensive.

This episode covers what creates the gap, why it grows without anyone noticing, and what it takes to close it before a regulator or an incident does it for you.

If your practice has policies on file, this episode is worth your time.

Key takeaway from this episode: The template reflects the workflow you had. Your compliance operation needs to reflect the workflow you have.

Connect with Dr. Natasha Guess:Website: guesscomplianceconsultingllc.com

Compliance Strategy Call:

https://calendly.com/guesscomplianceconsulting-proton/compliancestrategycall

In this episode Dr. Natasha Guess goes deep on informalcommunication, the second most common operational compliance pitfall in healthcare teams. Speed and helpfulness are not problems. The absence of secure channels to support them is.

What we cover in this episode:

Why speed creates compliance risk. Operational teams are built for responsiveness. That pressure for speed is valuable and it is also where safeguards quietly erode. The path of least resistance is almost always the unsecured one.

What makes a communication channel compliant. Approved secure messaging platforms, encrypted email, and systems with audit capability are the standard. Personal phones, personal email accounts, and consumer messaging appsare not.

The lost device scenario. A team member texts protected health information to clarify a billing issue. The message is sent from a personal phone. The phone is later lost or stolen. There is no encryption, no mobile device management, and no remote wipe capability. The organization must now initiate a breach risk assessment.

What a breach risk assessment actually requires. Organizations must evaluate the nature and extent of the information involved, identify the unauthorized recipient, assess whether the information was actually accessed orviewed, and determine whether mitigation steps reduced the risk. That process takes time, resources, and documentation regardless of how the assessment concludes.

Key takeaway from this episode:

Workflow convenience becomes regulatory exposure. Every single time. The goal is not to slow teams down. It is to build secure channels that are just as fast as the informal ones so that compliance is the path of least resistance.

Connect with Dr. Natasha Guess: Website:guesscomplianceconsultingllc.com Compliance Strategy call: https://calendly.com/guesscomplianceconsulting-proton/compliancestrategycall

 📋 https://delicate-paper-93475.myflodesk.com/cu9pb6q49z

It seemed harmless. They just wanted to check something.

In this episode of Guess What? Compliance Can Be Simple!, Dr. Natasha Guess breaks down one of the most common and least talked about compliance risks in healthcare operations: informal access. She walks through what minimum necessary actually means in practice, why small teams are especially vulnerable, and what happens when an employee opens a record they had no documented business reason to access.

The system logged it. And that log became evidence.

Guess What? Compliance Can Be Simple! is hosted by Dr. Natasha Guess, founder of Guess Compliance Consulting LLC.

Most compliance failures in healthcare do not start with badintentions. They start with bad systems.

In this episode of Guess What? Compliance Can Be Simple!, Dr. Natasha Guess walks through the five most common operational compliance pitfalls she sees in healthcare teams. Informal access, informal communication, outdated policies, business associate gaps, and weak incident escalation. Eachone is grounded in a real scenario so you can recognize the risk in your own workflow before it becomes a problem.

If you have ever thought your organization was mostlycompliant, this episode is for you.

Guess What? Compliance Can Be Simple! is hosted by Dr. Natasha Guess, founder of Guess Compliance Consulting LLC.

Take the next step in strengthening your compliance foundation by joining the Compliance Support Hub: https://guesscomplianceconsultingllc.com/compliance-support-hub

Connect with Dr. Natasha Guess:

Website: https://guesscomplianceconsultingllc.com/

Compliance Strategy call:https://calendly.com/guesscomplianceconsulting-proton/compliancestrategycall

Most healthcare teams think compliance lives in the legal department. It does not.

It lives in the moment a record is opened. The email that goes to the wrong recipient. The vendor added to a system without a signed agreement. The access that never got removed.

In this opening episode of the Compliance in the Workflow series, Dr. Natasha Guess lays the foundation that everything else in this series builds on. Before you can fix what is broken, you need to understand where compliance actually shows up in your daily work and what regulators are really looking for when something goes wrong.

The answer may surprise you.

Connect with Dr. Natasha Guess:Website: guesscomplianceconsultingllc.com

Schedule a compliance strategy call: https://calendly.com/guesscomplianceconsulting-proton/compliancestrategycall

Join the Compliance Support Hub: guesscomplianceconsultingllc.com/compliance-support-hub

Resources:HIPAA Privacy Rule — hhs.govHIPAA Security Rule — hhs.govHIPAA Breach Notification Rule — hhs.gov

This episode is different.

No audit breakdown. No compliance framework. No checklist. Today Dr. Natasha Guess sets down the usual work to speak as a human first.

This episode is part of Podcasthon, the first global charity event uniting podcasters worldwide. Thousands of microphones pause their regular programming to turn toward organizations doing work that truly changes lives. Visit podcasthon.org to learn more.

The organization Dr. Guess has chosen to support is St. Jude Children's Research Hospital.

Behind every diagnosis is a family whose life has just been split into before and after. What St. Jude does for those families is something every person deserves to hear about. Not read about. Hear about.

This episode is about why systems matter. Why dignity matters. And why a compliance podcast has everything to do with one of the most important children's hospitals in the world.

Press play. This one will stay with you.

Guess What? Compliance Can Be Simple! is proud to participate in Podcasthon 2026. Visit podcasthon.org to explore inspiring episodes from podcasters around the world who are using their platforms for good.

In this episode of Guess What? Compliance Can Be Simple, Dr. Natasha Guess is joined by Harrison Graham of Generational Builders and Jon Lee of FluId Financial for a conversation about Executive Order 14117 and the growing connection between data privacy and national security.

Executive Order 14117 focuses on preventing large volumes of Americans’ sensitive data from being accessed by foreign adversaries. The order highlights categories of data that regulators increasingly view as highly sensitive, including health information, biometric identifiers, genomic data, financial information, and precise geolocation data.

While the order primarily targets large-scale data transfers and data brokers, the broader implications extend across industries that collect and manage sensitive data.

In this conversation, we explore:

• why Executive Order 14117 was issued• how regulators are thinking about sensitive data governance• why leadership oversight is becoming increasingly important• what organizations should be considering about data access, vendor relationships, and data flows

This episode offers a broader perspective on how data privacy, governance, and leadership accountability are evolving in regulated industries.

Payer audits often feel disruptive, urgent, and financially threatening. But what if the difference between recoupment and resolution isn’t perfection, it’s preparation?

In this episode of Guess What? Compliance Can Be Simple!, Dr. Natasha Guess breaks down how payer audits are triggered, what payers are actually reviewing, and why panic responses often create more risk than the audit itself.

You’ll learn:

• Why payer audits feel more stressful than CMS audits• How data-driven triggers flag practices for review• What payers are truly comparing during an audit• Why oversharing documentation can backfire• The difference between reactive submissions and contract-aligned responses• What real audit preparedness looks like in day-to-day operations

Dr. Guess also shares real-world examples showing how defined audit response workflows protect revenue, reduce staff stress, and prevent unnecessary recoupment.

If your practice would struggle to justify a billed service using only contract language, this episode will help you reframe your approach before the next audit letter arrives.

Preparation, not panic—changes outcomes.

Learn more about building structured payer audit readiness inside the Compliance Support Hub:
https://guesscomplianceconsultingllc.com/compliance-support-hub

CMS audits feel intimidating for many healthcare practices. But what if the fear surrounding them is based on misunderstanding?

In this episode of Guess What? Compliance Can Be Simple!, Dr. Natasha Guess breaks down what CMS is actually looking for during reviews and audits — and why over-documenting, overreacting, and operating from fear can sometimes create more risk than protection.

You’ll learn:

• Why CMS is focused on oversight, not perfection• The difference between documentation detail and documentation consistency• What “activity without awareness” looks like from a regulator’s perspective• A real-world example of documentation that looked compliant but lacked monitoring• How to build simple, defensible oversight processes that increase confidence

If your practice feels anxious about CMS audits, this episode will help reframe the conversation. CMS expects imperfection. What they expect more is awareness.

Mid-episode, Dr. Guess also shares how her Compliance Support Hub helps small and mid-sized healthcare teams build realistic, day-to-day oversight processes that actually work.

Compliance is not about avoiding scrutiny. It is about being able to explain what you do, why you do it, and how you know it’s working.