ASL-Accessible Primary Care Clinic Security Risk Assessment Checklist

An ASL-accessible clinic needs to protect patient information while making sure patients can communicate effectively at every stage of care. Use this checklist to review interpreter access, emergency procedures, facility controls, and safeguards for electronic health information.

Document each risk you identify, who is responsible for addressing it, and how you will verify that the safeguard works. Adapt the checklist to your clinic’s services, layout, technology, and patient needs.

Assess ASL Interpreter Access

• Ask patients about their preferred communication method during scheduling and again when circumstances or care needs change.
• Maintain a reliable process for arranging a qualified sign language interpreter when needed for effective communication. Confirm the interpreter can interpret accurately and impartially, including relevant medical terminology.
• Plan for interpreting during conversations that may involve medical history, symptoms, diagnoses, treatment choices, consent, medication instructions, mental health care, or follow-up plans.
• Do not assume that written notes, lip-reading, or a patient’s companion will be an effective substitute. Ask the patient what works for them and assess the communication needs of the specific interaction.
• Define how staff request an interpreter, handle urgent and walk-in visits, and arrange coverage when the usual interpreter or vendor is unavailable.
• Review interpreter scheduling and service arrangements for privacy risks, including how appointment details are shared and how remote interpreters connect.
• Train staff to recognize when interpreter support may be needed, how to arrange it promptly, and how to communicate directly with the patient.

Review Emergency Communication Safeguards

• Check how patients and visitors who are Deaf receive fire, severe-weather, evacuation, lockdown, and other urgent instructions.
• Consider visual emergency notification systems alongside audible alarms. Check whether alerts are visible from waiting areas, exam rooms, restrooms, and other spaces patients may occupy.
• Prepare accessible instructions for evacuation routes, shelter locations, and changes to clinic operations. Use more than one communication method when needed, such as written notices, text messages, or direct staff communication.
• Assign staff to make sure Deaf patients receive and understand urgent directions, without relying on hearing companions to relay them.
• Plan how to access an interpreter during an emergency and how staff will communicate if internet, power, or video services fail.
• Practice emergency procedures with staff and review whether patients can receive alerts and instructions in time to act safely.

Evaluate Facility Access Controls

• Identify areas where patient records, clinical workstations, network equipment, or other systems containing electronic protected health information (ePHI) are accessed or stored.
• Review how staff, patients, contractors, and visitors enter restricted areas. Use appropriate authorization, visitor procedures, and supervision.
• Check that doors, cabinets, and equipment rooms are secured when unattended, and that keys, badges, and access codes are managed appropriately.
• Consider physical risks such as theft, unauthorized viewing, water damage, fire, power loss, and equipment failure.
• Document who is responsible for facility access controls and how access permissions are reviewed when staff roles change.

Secure Workstations Devices and Media

• Position monitors so people in waiting areas or passing through clinical spaces cannot casually view patient information.
• Use screen locks and individual user accounts; require staff to secure unattended workstations and sign out when their work is complete.
• Track clinic laptops, tablets, phones, removable drives, and other devices that may access, store, or transmit ePHI.
• Review safeguards for portable devices, including secure storage, approved access, and a process for reporting loss or suspected theft.
• Set procedures for moving, reusing, repairing, and disposing of devices and media so stored information is not exposed to unauthorized people.
• Include printers, scanners, and multifunction devices in the review, and retrieve printed patient information promptly.

Analyze Electronic Health Information Risks

A HIPAA Security Rule risk analysis should consider risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI that the clinic creates, receives, maintains, or transmits. It should cover the systems and workflows used across the clinic, not only the electronic health record.

• Map where ePHI is collected, stored, accessed, shared, backed up, and transmitted, including through remote access and third-party services.
• Identify threats relevant to the clinic, such as unauthorized access, phishing, malware, accidental disclosure, device loss, power failure, and service outages.
• Assess the likelihood and potential impact of each risk, then record the safeguards in place and any remaining gaps.
• Review administrative physical and technical safeguards, including workforce access, facility protections, account controls, and security monitoring.
• Set priorities, owners, and target dates for addressing risks. Document decisions and the reasons for selecting particular safeguards.
• Review the analysis when systems, vendors, clinic operations, or identified risks change, and periodically evaluate whether safeguards remain effective.

Protect Patient Privacy

• Discuss sensitive information in a space where conversations are not readily overheard by other patients or visitors.
• Limit staff access to patient information to what is appropriate for their job responsibilities, and promptly update access when roles change.
• Use approved methods to share appointment information, records, and interpreter session details. Avoid exposing patient information on unsecured devices or in public areas.
• Train staff to verify the intended recipient before sharing information and to report suspected privacy or security incidents promptly.
• Review how interpreter services and other vendors handle patient information, including the safeguards and agreements applicable to the service.
• Make patient-facing forms and privacy notices available in communication formats patients can use, and provide a way to ask questions privately.

Verify Accessible Communication Channels

• Test how patients request communication support when booking, confirming, changing, or arriving for an appointment.
• Check whether phone, text, email, patient portal, and telehealth options are accessible to the patients who use them, and offer practical alternatives when needed.
• Assess video remote interpreting (VRI) before relying on it. Confirm the connection is stable, the picture clearly shows the interpreter’s face and hands, audio is understandable, and staff can set up the service promptly.
• Check that the patient can see the screen and participate comfortably. If video interpreting does not enable effective communication in the circumstances, have another option available, such as an on-site interpreter.
• Train staff to test equipment, protect the video session from unauthorized viewing, and switch to a backup communication method if the connection fails.
• Review feedback and communication problems to identify barriers in scheduling, check-in, clinical conversations, and follow-up.

Keep the checklist current by documenting identified risks, assigning follow-up actions, and verifying that safeguards work in practice. A sound assessment protects ePHI while supporting accessible, private communication throughout the patient visit.

FAQs

When must a clinic provide a qualified ASL interpreter?

A clinic should arrange a qualified ASL interpreter when one is needed for the patient to communicate effectively, taking account of the patient’s communication method and the nature, length, complexity, and context of the interaction. This may include discussions about medical history, symptoms, diagnosis, treatment choices, consent, or medication instructions. Ask the patient about their needs; do not assume that writing, lip-reading, or a companion will work equally well.

How should clinics assess whether video interpreting enables effective communication?

Check the connection quality, image clarity, view of the interpreter’s face and hands, audio, screen position, and the patient’s ability to see and participate. Confirm that staff can set up and troubleshoot the service quickly, and that the video session is private. If any of these conditions prevent effective communication, switch to another suitable option, such as an on-site interpreter.

What visual alerts should clinics include in emergency planning?

Review how patients and visitors who are Deaf will receive visible alerts for emergencies such as fire, severe weather, evacuation, or lockdown. Consider visual notification systems in spaces patients may occupy, along with written or text-based instructions and staff support. Include a plan for communicating urgent directions if power, internet, or other alerting systems fail.

How often should a clinic reassess risks to electronic protected health information?

Reassess risks periodically and when a meaningful change could affect ePHI, such as a new system or vendor, a change in clinic operations, a security incident, or a newly identified vulnerability. The assessment should be ongoing enough to identify when safeguards need updating; it is not a one-time task.