Alabama Home Health Agency Privacy Law Requirements: HIPAA and State Compliance Guide

State Oversight and Certification

In Alabama, home health agencies (HHAs) are not licensed by the state. Instead, oversight centers on two pillars: obtaining a SHPDA Certificate of Need before establishing or expanding services, and achieving Medicare and/or Medicaid participation through Alabama Department of Public Health Certification surveys that assess compliance with federal Conditions of Participation (CoPs). You should treat SHPDA approval and ADPH survey readiness as parallel, interlocking tracks.

What to have in place

• SHPDA Certificate of Need for each county you plan to serve; expansions or major changes generally require additional SHPDA review.
• Medicare enrollment (NPI, PECOS, CMS-855A) and readiness for ADPH survey against Part 484 CoPs, including QAPI, infection control, emergency preparedness, and OASIS processes.
• Alabama Medicaid enrollment (if billing Medicaid) after Medicare certification, plus adherence to state program policies for claims, documentation, and audits.

Existing HHAs should track service-area rules (including limited contiguous-county arrangements) and keep governance documents, contracts, and policies aligned with SHPDA determinations and ADPH survey expectations.

HIPAA Privacy and Security Compliance

Alabama HHAs must fully implement the HIPAA Privacy Rule and HIPAA Security Rule. That means giving each patient a Notice of Privacy Practices at or before the first visit, applying the minimum-necessary standard to uses and disclosures, honoring timely right-of-access requests, and maintaining Business Associate Agreements with vendors that create, receive, maintain, or transmit PHI.

Security program essentials

• Conduct and routinely update an enterprise-wide risk analysis; implement administrative, physical, and technical safeguards proportionate to risk (access controls, audit logs, encryption-at-rest and in-transit where reasonable and appropriate, device and media controls, and secure remote access).
• Train your workforce initially and annually; enforce sanctions for violations; document all training, incidents, and mitigation.
• Maintain a breach response plan—risk assessment, patient and regulator notifications within applicable timelines, and corrective action tracking.

Align HIPAA with CoPs: protect clinical records, restrict access to need-to-know, and ensure portability practices (e.g., laptops and mobile devices moving between homes and the office) do not expose ePHI.

Patient Rights Notifications

Before care begins, provide a clear, written Patient Rights Disclosure and explain it verbally in language the patient understands. Document the discussion and the patient’s acknowledgement. Your notice should identify how to file complaints with the agency and with state/federal oversight, explain charges and coverage (Medicare, Medicaid, or other payers), and describe privacy practices.

Core rights to cover

• Participate in—and be informed about—the plan of care, frequency and types of services, and any changes.
• Be treated with dignity; be free from abuse, neglect, exploitation, and discrimination; and have property respected.
• Receive privacy and confidentiality of health information and access to one’s own clinical record.
• Voice grievances without reprisal and know how the agency will address them and by when.

Employee Background Screening Practices

Build written Employee Screening Policies that meet federal rules and Alabama expectations. Under “Shirley’s Law,” service providers including home health agencies must query the Alabama Elder and Adult in Need of Protective Services Abuse Registry for prospective and current employees and volunteers who will have direct contact with patients. Retain query results and follow your adverse-action procedures.

Recommended and payer-expected checks

• State and national criminal background checks (fingerprint-based where required by payer contracts or programs), plus monthly OIG exclusion checks.
• Professional license and certification verification (nurses, therapists, social workers) and registry checks for aides where applicable.
• Health screenings/immunizations per role, MVR checks for driving roles, reference checks, and eligibility verification (I‑9/E-Verify).
• Document screening decisions, risk adjudication, and any supervision or restrictions; re-screen on defined intervals.

Note: Alabama does not have a single, universal statute mandating fingerprint criminal checks for every HHA employee; however, registry checks are mandatory and many programs and payers require or expect criminal background screening as a condition of participation.

Worker Classification Standards

For employment law, Alabama applies common-law control factors (via the Alabama Department of Labor) to determine employee versus independent contractor status; at the federal level, the FLSA uses a totality-of-the-circumstances economic reality test. Classify workers based on actual control and economic dependence, not job titles.

For Medicare participation, your HHA must provide at least one core service directly (for example, skilled nursing) and may furnish other services under arrangement. When using contracted clinicians, the agency remains responsible for quality, supervision, competency, documentation, and compliance with the CoPs.

Practical guardrails

• Use W‑2 employment when you set schedules, methods, and ongoing supervision. Use “under arrangement” contracts when contractors control their means and methods, yet agree to your credentialing, competency, documentation, and quality requirements.
• Spell out supervision, documentation, HIPAA, incident reporting, and audit rights in every contract; monitor performance and keep complete records.

Home Health Services and Documentation

Home health services are delivered on a visiting basis in the patient’s residence and must follow an individualized, measurable plan of care. The comprehensive assessment (including OASIS) supports eligibility, planning, and outcomes tracking.

Documentation checkpoints

• Comprehensive assessment: complete within 5 days of start of care; update no less frequently than the last 5 days of every 60-day period, within 48 hours of return from qualifying inpatient stays, and at discharge.
• OASIS: OASIS‑E2 has been in effect since April 1, 2026; submit all required assessments accurately and on time. All‑payer OASIS submission has been required since July 1, 2025.
• Plan of care: include diagnoses, measurable goals, ordered services with frequency/duration, safety measures, education needs, and discharge planning; review and re‑sign at least every 60 days or sooner as needed.
• Verbal orders: promptly document, date, time, and authenticate per policy; keep cross-discipline coordination visible in the record.
• Home health aide services: ensure supervisory assessments at least every 14 days when aide services are provided.
• Clinical records: timely, legible, signed/datetime entries; retain at least 5 years after discharge; safeguard PHI.

Reimbursement and Eligibility Criteria

Medicare requires that patients need intermittent skilled nursing or therapy, are certified as homebound, have a face‑to‑face encounter with an allowed practitioner within the required timeframe (generally within 90 days prior to or 30 days after start of care), and receive services under a signed plan of care. Submit a Notice of Admission within 5 days of the start of care. Payment follows the PDGM model in 30‑day periods; telecommunication encounters do not count as billable visits. Agencies must meet Home Health Quality Reporting Program (OASIS) requirements to avoid payment reductions and are subject to the expanded Home Health Value‑Based Purchasing model, which applies upward or downward payment adjustments based on quality performance.

Alabama Medicaid coverage follows federal Medicaid rules for home health (for example, no homebound requirement), requires a practitioner-ordered plan of care and a qualifying face‑to‑face encounter, and demands strict documentation and program integrity. Build your “Medicare and Medicaid Compliance” program to harmonize eligibility verification, face‑to‑face documentation, OASIS/QRP submissions, NOA timeliness, secondary payer rules, and audit readiness across both payers.

Conclusion

In Alabama, successful HHA compliance hinges on three through-lines: obtain SHPDA CON and pass Alabama Department of Public Health Certification surveys for Medicare/Medicaid participation; operationalize HIPAA, patient rights, and rigorous Employee Screening Policies (including the state abuse registry query); and execute meticulous documentation, worker classification, and billing practices that meet federal CoPs and payer rules. Treat these as one integrated compliance system, not a checklist.

FAQs

What are the HIPAA requirements for Alabama home health agencies?

You must implement the HIPAA Privacy Rule (patient Notice of Privacy Practices, minimum necessary, right of access) and the HIPAA Security Rule (risk analysis; administrative, physical, and technical safeguards; workforce training). Maintain Business Associate Agreements, a breach response process, and policies that address in‑home and mobile-device workflows. Align HIPAA controls with your clinical record standards and survey readiness.

How must patient rights be communicated to home health patients in Alabama?

Provide a written Patient Rights Disclosure at or before the first visit and explain it verbally in understandable language. Cover participation in the plan of care, privacy and confidentiality, nondiscrimination, freedom from abuse/neglect, grievance procedures, financial responsibilities and coverage, and how to contact oversight authorities. Document delivery and patient acknowledgement.

Are criminal background checks mandatory for Alabama home health agency employees?

Alabama requires HHAs to query the state Elder and Adult in Need of Protective Services Abuse Registry (“Shirley’s Law”) for applicable staff and volunteers. There is no single law mandating fingerprint criminal checks for all HHA employees statewide, but many payer programs (including Medicaid waivers) and sound risk management expect state/national criminal background screening, monthly OIG exclusion checks, license/registry verification, and documented adjudication.

What certifications are required for home health agencies to bill Medicare in Alabama?

Secure a SHPDA Certificate of Need for your service area, enroll with Medicare (NPI, PECOS) and successfully complete Alabama Department of Public Health Certification surveys to obtain Medicare certification by meeting all Home Health CoPs. After Medicare approval, complete Alabama Medicaid enrollment if you will bill Medicaid. Maintain ongoing compliance with OASIS/QRP, NOA timeliness, and all CoP and billing rules.