“Every practice I worked in had a compliance binder on the shelf. Not one of them could have survived a real audit — and none of them knew it.”
Angie Perrin is the Chief Security Officer of Patient Protect, a Certified HIPAA Privacy Consultant (CHPC), a Registered Dental Hygienist, and an adjunct instructor in dental education. Her clinical work began inside independent dental practices in 2011; she has been licensed as an RDH since 2013 — the same practitioner-level experience she now draws on to build workforce training for the offices most exposed to HIPAA breach and least served by generic compliance content.
She teaches. That matters for training authority: the HIPAA Foundations curriculum is not written by a marketer working from a legal outline. It is written by someone who has stood in operatories, coached students through clinical judgment, and watched the specific ways an independent practice actually creates, moves, and stores ePHI during a normal patient visit. Every module in the 19-part Foundations series is drafted from that vantage.
She shaped the Patient Protect training program from the ground up: 19 focused video modules covering the Privacy Rule, Security Rule, Breach Notification Rule, the three safeguard categories, business associate agreements, incident response, auditing, and enforcement — plus an expanding Advanced Pro curriculum that will cover role-based training, specialty and practice-type content (dental, medical, optometry, behavioral health, chiropractic, physical therapy, primary care), threat awareness, vendor risk, patient rights, and technology systems. Each module is written to close a specific gap OCR investigators actually cite — not to satisfy a checkbox.
Her clinical background informs the parts of Patient Protect that most technology-first compliance platforms miss: the physical workflows in an operatory, the administrative rhythm of a front desk, and the acoustic realities of a small waiting room. The platform's risk methodology, role-based training assignments, and clinical workflow assessments are all shaped by direct experience of what breaks in real practices and what gets quietly ignored.
She works directly with independent practices during onboarding and is available for editorial commentary on clinical workforce training standards, compliance program design for small-practice environments, and the operational gap between documentation-first vendors and platforms built for how independent clinicians actually work.
Credentials last verified 2026-08-15
How training modules and articles by this contributor are kept accurate and current.
Selected publications
HIPAA Training Requirements: What Must Be Documented
HIPAA Foundations training curriculum — 19-module workforce program
HIPAA Training Evidence Checklist — audit-ready workforce documentation
HIPAA training certificate verification — how independent verification works
Authored guides
27 guides on Patient Protect.
A HIPAA compliance plan is the umbrella document that ties the risk assessment, policies, training, BAA inventory, incident response, audit log management, and remediation plan into a single operational program. This is the 7-element format that survives an OCR investigation.
Urgent care has a different HIPAA exposure profile — high patient volume, walk-in records, multi-clinician rotation, and OSHA + CLIA overlap. The 6 platform features that distinguish urgent-care-fit tools from generic compliance software.
The 14 policies every covered entity needs in writing, what each must contain to satisfy §164.316, where the free templates fall short, and how to adapt them to your actual practice.
Med spas have a HIPAA exposure profile most compliance vendors weren't built for — before/after photos, consent for injectables, Botox lot tracking, social-media patient stories. The 6 platform features that actually matter.
Twilio supports HIPAA workloads on specific eligible products with a signed BAA. Free trials and most consumer products are not covered. Here is what is eligible and how to configure it.
OneDrive for Business is HIPAA-compliant on Microsoft 365 commercial plans with a signed BAA. Personal accounts are not. Configuration traps + setup checklist (2026).
Stripe does not sign BAAs. Most patient payments aren't PHI under HIPAA, but invoice metadata and descriptors can be. Here's the line.
Adobe Sign (Acrobat Sign) is HIPAA compliant on Enterprise tiers with a signed BAA. Adobe Acrobat Pro, Adobe Document Cloud, and individual plans are not. Here is how the three differ — and how to set up the one that qualifies.
Most HIPAA violations start with a sticky note, a saved password, or an unlocked screen. 7 everyday security mistakes OCR targets — and how to fix each one before the 2026 Security Rule update.
There is no official HIPAA certification. The government does not certify compliance. Here is what vendor certifications actually mean and what your practice needs instead.
HIPAA requires a privacy and security officer. For small practices, one person can fill both roles. Here is what the position requires and how to manage it.
Leaving voicemails for patients is allowed under HIPAA — but what you say, how you say it, and where messages are stored all have compliance implications.
The ten warning signs auditors look for first when evaluating an independent practice. Each one is operational, observable, and fixable before the investigation begins.
Real HIPAA violation examples that resulted in OCR enforcement, fines, and practice closures. Learn the 6 most common violations and how to prevent each one.
The ten operational mistakes that turn an otherwise-compliant independent practice into an OCR enforcement statistic. Why each one happens, and the corrective baseline for each.
HIPAA training is required — and covered entities must document that applicable workforce training was provided. What the Privacy Rule and Security Rule actually require, what counts as proof of completion, and what most practices miss.
Complete BAA checklist for healthcare practices — what must be in a business associate agreement, when one is required, and how to track them.
iCloud is not HIPAA compliant. Apple doesn't sign BAAs for iCloud, iMessage, or Apple Health — and staff iPhones may already be backing up PHI.
DIY costs $0 + your nights and weekends. Software starts at $39/mo. Consultants charge $1,500+. The real numbers — and how independent practices choose.
The eleven HIPAA checklist items most independent practices either don't know they need or quietly skip. What each requires, and the OCR enforcement record for each.
Workforce training is the most-cited cause of HIPAA findings — and most independent practices make the same six mistakes. What the training program should look like to stand up to OCR scrutiny.
Healthcare ransomware headlines mask the real issue. Nearly every major HIPAA breach shares the same root cause: unencrypted patient data.
A foundational article for overwhelmed practices that need plain-English direction instead of another pile of legal abstraction.
A 17-step operational framework for HIPAA compliance built for independent healthcare practices. Not a checkbox list — a roadmap from gap identification to audit readiness.
The 18 HIPAA identifiers are just the start. AI transcripts, wearable data, and voice recordings are creating new PHI categories most practices miss.
HIPAA compliance explained without legal jargon. What the rules actually require, what small practices get wrong most often, and how to build a compliance foundation that works.
HIPAA compliance is not just a regulatory obligation — it is a competitive advantage. Practices that demonstrate active compliance build deeper patient trust, stronger retention, and better reputations.
