Version forms when policy changes; old PDFs floating on tablets confuse staff and patients alike.
Capture signatures with integrity controls appropriate to your state and specialty.
Work with counsel on mixed federal/state requirements—HIPAA sets a floor, not the entire story.
Inspectors and partners ask for evidence, not intentions.
Most PHI incidents are human error, not Hollywood hackers.
Retention schedules should tie to legal, payer, and specialty norms—not infinite hoarding.
Every field you collect is another place PHI can leak—collect what you need, when you need it.