A HIPAA Compliance Guide for Doula Collective Practices

When does HIPAA apply to a doula collective?

HIPAA does not automatically apply to every doula, collective, or client record. It applies to covered entities—health plans, health care clearinghouses, and health care providers that conduct certain standard electronic transactions—and to business associates that handle protected health information (PHI) on a covered entity’s behalf. A collective’s name, nonprofit status, or use of health-related information does not, by itself, determine its HIPAA status. See HHS guidance on covered entities and business associates.

For a doula practice, a key question is whether the provider or organization electronically conducts a HIPAA-standard transaction, such as submitting health care claims. If your practice submits claims electronically, assess whether the legal entity or provider doing so is a covered entity; don’t assume that using a billing service settles the question. Medi-Cal enrollment and HIPAA status are separate questions: DHCS requires basic HIPAA training for Medi-Cal doulas, but that training requirement alone does not establish that every collective is a covered entity.

If a collective is neither a covered entity nor a business associate, the HIPAA Rules may not apply to it. Other privacy laws, contracts with health plans or care organizations, and professional commitments may still govern how you handle client information.

How to determine whether collective members are workforce members or business associates

Start by identifying who controls each member’s work and whose purpose the member serves when handling PHI. HIPAA workforce members include employees, volunteers, trainees, and certain other people whose conduct is under a covered entity’s direct control. A workforce member is not a business associate of that same entity. Review the actual working relationship, not just a job title or contract label. See HHS’s HIPAA Privacy Rule summary.

A person or organization may be a business associate when it performs a service or function on behalf of a covered entity that involves PHI—for example, billing, practice management, or certain administrative work. A doula collective engaged to perform services for a covered entity may need a business associate agreement (BAA), depending on what it does and how the relationship is structured.

By contrast, a provider who submits a claim to a health plan generally acts on their own behalf, rather than as the plan’s business associate. HIPAA also provides an exception to the BAA requirement for certain disclosures from a covered entity to a health care provider for treatment. Neither a referral nor a payer relationship automatically makes a doula a business associate; assess the parties’ roles and the purpose of the information exchange. See HHS guidance on providers and health plans and treatment disclosures between providers.

Make a simple role-and-data map for the collective: list each organization and member, who directs their work, what PHI they access, why they access it, and whether they act for themselves or on behalf of another covered entity. Revisit the map when contracts, staffing, billing, or services change.

What must a business associate agreement include?

A BAA is a written contract or other written arrangement that sets the permitted and required uses of PHI and requires the business associate to protect it. It should match the actual services the collective provides, identify what information the collective may use or disclose, and make clear that the collective cannot use or disclose PHI beyond what the agreement or law permits.

HIPAA-required BAA provisions address appropriate safeguards, reporting impermissible uses or disclosures and breaches of unsecured PHI, and support for the covered entity’s obligations concerning individuals’ access, amendments, and disclosure accounting. The agreement must also address cooperation with HHS review, return or destruction of PHI at termination when feasible, and restrictions that flow down to subcontractors handling PHI. It must permit termination for a material breach. See HHS’s required BAA provisions.

Keep signed agreements, amendments, and a record of which members and vendors are covered by each agreement. A general confidentiality clause may not include all required BAA terms.

How to assess and reduce privacy and security risks

If your collective is a covered entity or business associate handling electronic protected health information (ePHI), the HIPAA Security Rule requires a documented risk analysis and risk management. The analysis should identify where ePHI is created, received, maintained, and transmitted; likely threats and vulnerabilities; the safeguards already in place; and the steps needed to reduce risks to a reasonable and appropriate level. HHS explains the HIPAA Security Rule risk assessment, and the current regulation sets out the risk analysis and risk management requirements.

For a doula collective, map common information flows such as intake forms, care notes, client messages, referral documents, billing records, shared drives, mobile phones, and backups. Then assign an owner and due date to each improvement, such as removing unnecessary access, strengthening account security, updating a device or paper-record procedure, or testing backup and recovery arrangements. Reassess when you adopt new systems, change services, or identify new risks.

Apply the minimum necessary standard where it applies: limit PHI use, disclosure, and access to what is reasonably needed for the purpose. The standard generally does not apply to disclosures to, or requests by, a health care provider for treatment, but don’t assume every information exchange involving a doula qualifies for that exception. See HHS guidance on the minimum necessary requirement.

Which communication and recordkeeping tools may handle protected health information?

A tool may handle PHI when the collective has assessed the risks, configured suitable safeguards, and—if the vendor creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate—obtained the required BAA. This can include cloud-based storage and communication services. HHS notes that a cloud provider may be a business associate even when it stores only encrypted ePHI and cannot view the data. See HHS guidance on HIPAA and cloud computing.

When evaluating an electronic record system, secure messaging service, email provider, or videoconferencing tool, check whether the vendor will sign a BAA for the specific service and account you plan to use. Also assess access controls, individual accounts, authentication, audit records, backup and recovery, device security, and how you will remove access when a member leaves. A vendor’s marketing claim that a product is “HIPAA compliant” does not, by itself, establish that your collective’s use is compliant.

Set a written protocol for the information members may share, approved channels, identity checks before sending records, handling misdirected messages, and reporting lost devices or suspected disclosures. Personal accounts and consumer apps should not be used for PHI unless the collective has verified that the arrangement, safeguards, and any required BAA are appropriate.

How to train members and document compliance

Train workforce members on the privacy policies and procedures relevant to their roles, and provide training to new members within a reasonable period and to affected members after material policy changes. The Security Rule also requires a security awareness and training program for workforce members. Federal rules do not set a universal annual HIPAA certificate-renewal schedule; your collective may set a regular refresher schedule based on its risks, policies, contracts, or other applicable requirements. See 45 CFR § 164.530 on workforce privacy training and 45 CFR § 164.308 on security training.

Keep practical records of the training provided, dates and attendees, current policies, signed BAAs, risk analyses, risk-management actions, access reviews, and incident follow-up. Train members on the collective’s real workflows: what can be documented, who may see it, which tools to use, how to respond to a client’s request, and whom to contact if PHI is lost or sent to the wrong person.

Training documentation helps demonstrate that training occurred; a course-completion certificate does not certify that the collective itself is HIPAA compliant. Compliance depends on the organization’s roles, policies, agreements, safeguards, and day-to-day practices.

What HIPAA training does California require for Medi-Cal doulas?

DHCS currently requires all doulas enrolling as Medi-Cal providers to complete basic HIPAA training. Its enrollment checklist allows applicants to provide a training certificate or attest to completion in PAVE. DHCS does not require a certificate from a particular training organization, provided the training covers the requirements in the Medi-Cal Provider Manual: Doula Services. See the DHCS Doula Services FAQs and Medi-Cal Doula Provider Enrollment Checklist.

This basic HIPAA training is distinct from the separate 16-hour doula training pathway: those hours cover specified doula service topics and are not described by DHCS as 16 hours of HIPAA training. DHCS’s FAQ says it has no schedule for recertification. The state enrollment requirement also does not replace any employer-specific or contracting organization’s privacy and security training, or the training a covered entity must provide to its own workforce.

In short, determine each member’s and the collective’s HIPAA role, put required agreements in place, assess and reduce ePHI risks, choose tools based on their actual safeguards, and document role-appropriate training. For Medi-Cal doula services, meet DHCS’s basic training and enrollment requirements separately from any broader compliance duties.

FAQs.

Does HIPAA apply to every doula collective?

No. HIPAA applies when the collective or a relevant provider is a covered entity, or when the collective acts as a business associate handling PHI on a covered entity’s behalf. Separately, DHCS requires basic HIPAA training for all doulas enrolling as Medi-Cal providers.

When does a doula need a business associate agreement?

A doula or collective generally needs a BAA when it performs a function or service on behalf of a covered entity or business associate and handles PHI in that role, unless a HIPAA exception applies. A referral, payer relationship, or claim submission alone does not automatically create a business associate relationship.

Do subcontractors who handle protected health information need an agreement?

Yes, when a business associate engages a subcontractor to create, receive, maintain, or transmit PHI on its behalf, the business associate must obtain written assurances that the subcontractor will follow the required restrictions and safeguards. The agreement must pass applicable protections down the chain.

What HIPAA training is required for California Medi-Cal doulas?

DHCS requires basic HIPAA training for Medi-Cal doula enrollment and accepts a training certificate or an attestation of completion through PAVE. DHCS does not require a specific training organization, and this enrollment requirement is distinct from a universal federal annual certificate-renewal rule.