A Midwife’s Guide to Security Risk Assessments for Home Birth Practices

What does a HIPAA security risk analysis require of a midwifery practice?

If your midwifery practice is a HIPAA-covered entity or business associate, the HIPAA Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic protected health information (ePHI) you create, receive, maintain, or transmit. The assessment should lead to documented decisions and measures to reduce risks to a reasonable and appropriate level. See HHS guidance on risk analysis.

HIPAA does not automatically cover every midwife or practice. A health care provider generally becomes a covered entity when it electronically conducts a transaction for which HHS has adopted a standard, such as certain electronic billing transactions. Using email alone does not make a provider a covered entity. A midwifery practice that performs transactions through a billing service may still be covered. See HHS’s summary of the HIPAA Privacy Rule.

For a covered practice, the risk analysis is not a checklist that guarantees compliance or a one-time exercise. Document what you assessed, the safeguards already in place, identified risks, decisions about how to address them, and who is responsible for follow-up. The Security Rule expects covered entities and business associates to maintain appropriate safeguards and documentation, with measures suited to their circumstances. See HHS’s summary of the HIPAA Security Rule.

Which client information, devices, and services belong in the risk assessment?

Start by mapping where ePHI is created, received, stored, viewed, changed, and shared. For a home birth practice, that may include prenatal and birth records in an electronic health record (EHR), scheduling and billing systems, lab or referral portals, email and messaging accounts, backup systems, and files stored by outside service providers.

Include every device and connection that can access or hold ePHI: practice computers, laptops, tablets, and phones; removable drives; home or office networks; remote-access tools; and devices used during visits or births. Consider who can access each system, whether devices are shared, and what happens if a device is lost, stolen, damaged, or left unattended.

List outside vendors that create, receive, maintain, or transmit ePHI on the practice’s behalf, such as an EHR host, cloud storage provider, billing service, or video-visit platform. Assess their role and safeguards, and determine whether a business associate agreement is required. HHS explains that covered entities generally need written assurances from business associates to safeguard PHI; the agreement requirement depends on the relationship and the services involved. See HHS guidance on business associate agreements.

Paper charts are not ePHI under the Security Rule, but they still contain protected health information and need appropriate privacy safeguards. Include paper-based workflows in the broader assessment of how the practice protects client information, especially when records move between the office, home visits, and birth locations.

How should midwives assess the likelihood and impact of security risks?

For each information system or workflow, identify plausible threats and weaknesses, then estimate how likely each risk is and how serious its effects could be. Consider risks to confidentiality, integrity, and availability: for example, an unauthorized person viewing a chart, a record being altered or lost, or a system outage preventing access to information needed for care.

Home birth work can involve risks that are easy to overlook in a conventional office assessment: a phone lost during travel, a chart visible to others in a vehicle, an account accessed through a shared device, a power or internet outage, or a vendor account compromised by a reused password. Assess the practice’s actual environment, including its workforce, locations, workflows, technology, and emergency arrangements.

Use a consistent method to record likelihood, potential impact, existing safeguards, and remaining risk. HIPAA does not prescribe one scoring system; the goal is to make an accurate assessment and use the results to make documented, reasonable decisions. HHS describes identifying ePHI, threats, vulnerabilities, and existing security measures as core parts of the analysis. See HHS’s risk analysis guidance.

Turn findings into a risk management plan. For each priority, record the action, responsible person, target date, and how you will check whether the safeguard works. Address urgent risks promptly, and document why a proposed safeguard is or is not reasonable and appropriate for the practice.

What administrative, physical, and technical safeguards protect client information?

The HIPAA Security Rule groups safeguards into three categories. For a covered midwifery practice, the right combination depends on the risks identified and the practice’s circumstances; a small practice still needs safeguards appropriate to its ePHI and operations. See HHS’s overview of the Security Rule.

• Administrative safeguards include assigning security responsibilities, maintaining policies and procedures, managing workforce access, providing role-appropriate training, preparing for emergencies, and reviewing security incidents. Make sure staff and contractors know how to report a suspected loss, disclosure, or unauthorized access.
• Physical safeguards include controlling access to places where systems or records are kept, securing workstations, and setting rules for handling devices and media that contain ePHI. For a mobile practice, consider where devices and charts are stored during travel and how access is restricted at home or in temporary care settings.
• Technical safeguards include access controls, unique user identification, authentication, audit controls, integrity protections, and transmission security. Use individual accounts where feasible, promptly remove access that is no longer needed, and protect devices and accounts against unauthorized use.

Encryption at rest and in transit can help protect ePHI on devices and across networks. Under the Security Rule, encryption is an addressable implementation specification, not a blanket requirement that every practice use one particular technology. “Addressable” does not mean optional: assess whether encryption is reasonable and appropriate, implement it when it is, or document the decision and any appropriate alternative. See HHS’s explanation of encryption under the Security Rule.

How can midwives secure devices, communications, and video visits?

Use supported devices and software, enable automatic screen locking, protect accounts with strong unique passwords and multifactor authentication where available, and keep operating systems and applications updated. Restrict access to authorized users, avoid shared logins, and have a process to remotely lock or erase a lost device when the device supports it. These are practical safeguards to consider based on your risk analysis, not a guarantee of HIPAA compliance by themselves.

For email, messaging, file sharing, and video visits, review how information is transmitted, stored, and accessed. Configure accounts to limit access, avoid sending client details to unintended recipients, and do not record sessions unless there is a clear need and appropriate safeguards. Check whether a vendor creates, receives, maintains, or transmits ePHI on the practice’s behalf; if it does, a business associate agreement may be required. HHS notes that a telecommunications provider acting only as a conduit may be treated differently from a vendor that stores or otherwise maintains PHI. See HHS guidance on remote communication technologies.

Choose video-visit platforms and settings that limit participation to intended parties, and review the vendor’s security terms and business associate arrangements where applicable. Do not assume a product is suitable just because it is marketed as “HIPAA compliant”; the practice remains responsible for its own configuration, access practices, and decisions. See HHS telehealth guidance on technology and HIPAA.

Plan for disruptions as well as unauthorized access. Keep secure backups, know how to reach essential records during an outage, and decide how staff should report a missing device or suspected account compromise. Include these steps in relevant procedures and practice them as needed.

How should paper records and client information be protected during transport?

Paper records are not covered by the Security Rule’s ePHI requirements, but the HIPAA Privacy Rule requires covered entities to use reasonable safeguards to protect PHI. HHS explains that covered entities should review their own practices and determine what steps are reasonable. See HHS guidance on reasonable safeguards for PHI.

For travel, take only the records needed for the visit or birth, place them in a closed, secure container, and keep them under your control. Do not leave charts visible in a vehicle or unattended in a public area. At the destination, keep records out of sight of people who are not involved in care, and return them to secure storage promptly.

Set a clear process for checking records in and out, returning paperwork to the correct file, and reporting a missing chart. If you use a phone or tablet instead of paper, apply the same careful handling practices and include device protections, encryption, and remote access in the ePHI risk assessment.

How often should a practice review audit logs and update its risk management plan?

The Security Rule calls for regular review of information system activity, including access control audit logs, access reports, and security incident tracking reports. It does not set one universal review interval for every practice. Establish and document a schedule suited to the practice’s systems and risk level, and investigate unusual access or activity promptly. See HHS’s audit protocol on information system activity review.

HIPAA also requires periodic technical and nontechnical evaluations, with further evaluation in response to environmental or operational changes that affect ePHI security. Update the assessment and risk management plan when you add or replace systems, change vendors or workflows, expand the workforce, experience an incident, or identify a new risk. HIPAA does not establish a universal annual deadline for every risk assessment; set a review cadence and reassess when meaningful changes occur. See HHS guidance on periodic evaluations.

In short, map where client information goes, assess the risks in your real home birth workflows, choose and document appropriate safeguards, and revisit your decisions as the practice changes. Regular log reviews and a current risk management plan help make protection of ePHI an ongoing part of care operations.

FAQs.

Does every midwifery practice need a HIPAA security risk analysis?

Not necessarily. The HIPAA Security Rule’s risk analysis requirement applies to covered entities and business associates subject to the Rule. A health care provider generally qualifies as a covered entity when it conducts certain standard transactions electronically, such as specified electronic billing transactions; using email alone does not make a provider a covered entity. Practices that are not covered by HIPAA may still have obligations under other laws or contracts. See HHS guidance on covered entities and business associates.

Which records and devices should a home birth practice include in its assessment?

Include all ePHI the practice creates, receives, maintains, or transmits, along with the systems, devices, networks, and vendors that access or handle it. That can include EHRs, billing and scheduling tools, computers, phones, tablets, backups, messaging services, and video-visit platforms. Also review paper-record workflows as part of protecting PHI, even though paper records are not ePHI covered by the Security Rule.

How should midwives secure paper charts while traveling to a birth?

Carry only the records needed, keep them in a closed secure container under your control, and avoid leaving them visible or unattended. Secure them from unauthorized access at the destination and return them to appropriate storage promptly. These are practical ways to support reasonable safeguards; HIPAA does not prescribe one particular travel container or transport method.

When should a midwifery practice update its security risk assessment?

Review it periodically and when changes could affect ePHI security, such as adopting new technology, changing vendors or workflows, adding staff, or responding to a security incident or newly identified risk. HIPAA does not set a universal annual deadline, so document a reasonable review schedule and update the assessment when relevant changes occur.