A HIPAA Compliance Guide for Pediatric Eosinophilic Esophagitis Clinics

What electronic protected health information does a pediatric EoE clinic handle?

If your clinic is a HIPAA-covered entity, electronic protected health information (ePHI) includes individually identifiable health information that the clinic creates, receives, maintains, or transmits electronically. This can include information in an electronic health record (EHR), patient portal, email, billing system, or other digital system. The HIPAA Security Rule requires safeguards for ePHI to protect its confidentiality, integrity, and availability. HHS summary of the HIPAA Security Rule

For pediatric eosinophilic esophagitis (EoE) care, ePHI may include appointment and billing records; symptoms and treatment plans; medication and allergy lists; biopsy and pathology results; endoscopy reports and images; and growth, nutrition, food-trigger, or elimination-diet records. These details are identifiable ePHI when linked to a patient.

Information may also pass through a laboratory, EHR vendor, cloud storage provider, billing service, or patient-messaging platform. Identify where records are created, received, stored, viewed, and transmitted so your clinic can account for ePHI throughout its lifecycle.

How should clinics conduct an EHR risk analysis?

A security risk analysis is a systematic assessment of threats and vulnerabilities that could affect the confidentiality, integrity, and availability of the ePHI your clinic holds, and the likelihood of those risks occurring. It is required under the Security Rule and is not satisfied simply by purchasing an EHR or accepting a vendor’s security summary. HHS guidance on risk analysis and risk management

Start by defining the scope: inventory EHRs, devices, applications, storage, networks, and workflows that create, receive, maintain, or transmit ePHI. Include relevant paper-to-digital processes, remote access, staff devices, backups, and connections to outside laboratories or service providers. Then identify potential threats and vulnerabilities, assess their likelihood and potential impact, and document existing safeguards and gaps. HHS guidance on the scope and elements of a risk analysis

Use the results to prioritize and implement risk-management measures, assign responsibility, and document decisions and follow-up. The Security Rule calls for a thorough and accurate analysis, but does not prescribe one specific assessment method or a universal checklist.

Which safeguards protect EoE records across diagnosis and treatment?

The HIPAA Security Rule calls for reasonable and appropriate administrative, physical, and technical safeguards. Clinics should select measures in light of their size, capabilities, technology, costs, and the likelihood and potential impact of risks. The goal is to protect ePHI from reasonably anticipated threats and impermissible uses or disclosures while supporting its availability for care. HHS summary of Security Rule safeguards

• Administrative safeguards: Maintain security policies, assign security responsibility, train workforce members, manage user access, plan for security incidents and system outages, and assess risks.
• Physical safeguards: Control access to areas and workstations containing ePHI, secure devices, and establish procedures for handling and disposing of electronic media.
• Technical safeguards: Use appropriate access controls, user authentication, audit controls, integrity protections, and transmission security.

For example, establish how staff should securely share endoscopy images or pathology results with authorized clinicians, protect remote connections, and maintain appropriate backups and downtime procedures. HIPAA does not prescribe one universal technology for every clinic; document how the safeguards selected address the risks identified.

When an outside vendor creates, receives, maintains, or transmits ePHI on the clinic’s behalf, determine whether it is a business associate and put a business associate agreement (BAA) in place when required. The agreement should describe permitted uses and disclosures and include required safeguards and reporting obligations. HHS guidance on business associate agreements

How should clinics manage access to biopsy, endoscopy, and dietary records?

Use access control safeguards that allow authorized workforce members to reach the ePHI needed for their work while limiting access by role. For example, clinicians involved in EoE diagnosis and treatment may need access to biopsy results, endoscopy reports, and dietary histories, while other staff may need only scheduling or billing information. HIPAA requires technical procedures that allow access only to authorized persons and audit controls to record and examine activity in systems containing ePHI. HHS summary of technical safeguards

Give each user an individual account, promptly change or remove access when job duties change or employment ends, and review permissions periodically. Use available audit logs to investigate unusual access, such as repeated viewing of records unrelated to a person’s duties. Apply authentication and safeguards for remote access, shared workstations, and devices used to view or transmit records.

Make sure authorized staff can retrieve complete and accurate records needed for care. Protect the integrity of biopsy reports, images, and treatment notes against improper alteration or destruction, and plan for appropriate access during outages. These measures support the Security Rule’s objectives of confidentiality, integrity, and availability.

What steps are required after a reportable breach?

When an impermissible use or disclosure involves unsecured protected health information (PHI), assess whether it is a breach under the HIPAA Breach Notification Rule. A breach is generally presumed unless an exception applies or the clinic documents a risk assessment showing a low probability that the PHI was compromised. The assessment considers the type of information, who used or received it, whether it was actually viewed or acquired, and steps taken to mitigate the risk. HHS Breach Notification Rule guidance

Act promptly to contain the incident, preserve relevant evidence, determine what information and individuals were affected, and document the investigation and decisions. If a business associate is involved, the BAA should address its reporting obligations; the business associate must notify the covered entity of a breach as required by the rule. The clinic remains responsible for ensuring required notices are made.

For a reportable breach, notify affected individuals and the Secretary of Health and Human Services, and provide media notice when the applicable threshold is met. Maintain documentation showing that required notifications were made or why notification was not required. HHS breach notification requirements

When are patient and media notifications required?

A covered entity must notify affected individuals after discovering a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. The notice generally describes what happened, the types of information involved, steps individuals can take, the clinic’s response, and how to ask questions. HHS guidance on individual breach notices

If a breach affects more than 500 residents of a state or jurisdiction, the clinic must also notify prominent media outlets serving that area, without unreasonable delay and within the same 60-day maximum. For breaches affecting 500 or more individuals, notify the Secretary without unreasonable delay and within 60 days. For breaches affecting fewer than 500 individuals, the clinic may report to the Secretary annually, no later than 60 days after the end of the calendar year in which the breach was discovered. HHS guidance on media and HHS reporting

How often should HIPAA security measures be reviewed?

The Security Rule requires periodic technical and nontechnical evaluations and requires security measures to be reviewed and modified as needed. It does not set a universal annual schedule for risk analyses or evaluations. HHS explains that appropriate frequency depends on the organization and its environment; clinics should also reassess when changes or incidents could affect ePHI security. HHS guidance on periodic review and risk analysis

Review safeguards when introducing new technology or workflows, changing vendors or locations, experiencing a security incident, or making significant operational changes. Document evaluations, identified risks, decisions, and corrective actions so you can show how the clinic maintains reasonable and appropriate protections over time.

In short, an EoE clinic’s HIPAA program should map its ePHI, assess and manage risks, apply role-appropriate safeguards, and revisit those protections as its systems and operations change.

FAQs

Does HIPAA apply to pediatric eosinophilic esophagitis clinics?

HIPAA applies when a clinic is a covered entity, such as a health care provider that conducts certain covered electronic transactions, or when it acts as a business associate. A covered clinic must protect ePHI under the Security Rule and follow applicable Privacy and Breach Notification Rule requirements. HHS summary of the HIPAA Security Rule

What must an EHR risk analysis include?

It must cover the ePHI the clinic creates, receives, maintains, or transmits; identify relevant threats and vulnerabilities; assess their likelihood and potential impact; and document existing safeguards, risks, and decisions about risk management. The analysis should reflect the clinic’s actual systems and workflows, including vendors and connected services. HHS guidance on risk analysis

When must a clinic notify patients after a breach?

For a breach of unsecured PHI requiring notification, the clinic must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Whether an incident is a reportable breach depends on the rule’s exceptions and, where applicable, a documented assessment of the probability that PHI was compromised. HHS breach notification guidance

Can parents access a minor's EoE medical records?

Generally, a parent who is authorized under applicable law to make health care decisions for a minor is treated as the child’s personal representative and may access relevant records. Exceptions can apply, including when state or other law allows the minor to consent to particular care without parental consent, or when treating the parent as the personal representative could endanger the child. Clinics should check applicable state law and the circumstances of the care. HHS guidance on personal representatives and minors