Barbershop Blood Pressure Program Security Risk Assessment Checklist

A blood pressure screening program may handle sensitive readings, participant contact details, and referral notes. Use this checklist to map how the program collects, stores, and shares that information, identify who is responsible for it, and decide what safeguards are appropriate. HIPAA obligations depend on the organizations’ roles and activities—not simply on holding a screening in a barbershop.

Determine whether HIPAA applies to the barbershop and screening partner

First identify each organization involved: the barbershop, the clinical screening provider, any program sponsor, and any vendor that handles participant information. HIPAA applies to covered entities—health plans, health care clearinghouses, and certain health care providers—and to business associates performing specified functions for covered entities. A health care provider is a covered entity only if it conducts certain standard electronic transactions. See HHS guidance on who must comply with HIPAA and HHS guidance on covered entities and business associates.

• ☐ Record each organization’s role in planning and operating the screening program.
• ☐ Ask whether the clinical partner is a covered entity and whether it conducts standard electronic transactions.
• ☐ Determine whether the barbershop or another partner performs a service for a covered entity that involves creating, receiving, maintaining, or transmitting protected health information (PHI) on the entity’s behalf.
• ☐ Distinguish providing space or general event support from handling records or performing a contracted function involving PHI; assess the actual arrangement rather than assuming either role automatically creates HIPAA obligations.
• ☐ Document who makes decisions about screening, referrals, recordkeeping, and participant communications.

A barbershop is not automatically subject to HIPAA just because it hosts screenings. However, its role and obligations may change if it handles information on behalf of a covered entity. HHS describes business associate status as depending on the functions or services performed and their relationship to PHI. Review HHS’s business associate guidance when determining whether an arrangement requires a business associate agreement.

Identify where electronic protected health information is stored or transmitted

Inventory every place electronic protected health information (ePHI) may be created, received, maintained, or transmitted. A screening result is not automatically ePHI under HIPAA merely because it is a health measurement; the relevant questions include whether it identifies a person and whether it is handled by a HIPAA-regulated organization in that role. HHS explains that the Security Rule applies to ePHI held by regulated entities and calls for assessing the full scope of that information. See HHS guidance on HIPAA Security Rule risk analysis.

• ☐ List all information collected, such as names, contact details, blood pressure readings, referral notes, appointment details, or participant identifiers.
• ☐ Map the information’s path from collection through storage, access, sharing, retention, and deletion.
• ☐ Identify paper forms separately from electronic records, including spreadsheets, mobile apps, email, text messages, tablets, laptops, and cloud services.
• ☐ Record where each device or service is located, who controls it, who can access it, and whether a vendor stores or transmits information.
• ☐ Note whether staff use personal devices or accounts and determine whether program information is stored on them.
• ☐ Identify information that is sent to a clinician, referral service, program coordinator, or participant, and document the method used.

Include temporary copies, downloaded files, backups, and messages—not only the main recordkeeping system. If a cloud service creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate, assess the vendor relationship and applicable agreement requirements. HHS discusses these responsibilities in its guidance on HIPAA and cloud computing.

Assess administrative safeguards and staff access

Administrative safeguards are policies and procedures that help manage security risks and workforce access. For a HIPAA-regulated organization, the Security Rule requires an accurate and thorough assessment of risks and vulnerabilities to ePHI, along with security measures that are reasonable and appropriate to the organization’s circumstances. HHS notes that risk analysis should identify the ePHI in scope, relevant threats and vulnerabilities, and actions to manage risk.

• ☐ Assign a named person to coordinate the risk analysis, track decisions, and follow up on corrective actions.
• ☐ Define which staff or volunteers may collect readings, enter records, arrange referrals, or answer participant questions.
• ☐ Provide access only to people who need it for their assigned role, and remove access promptly when a person leaves or changes duties.
• ☐ Train staff on the program’s own procedures for confidentiality, safe handling, reporting concerns, and responding to participant requests.
• ☐ Maintain written procedures for data collection, use, sharing, retention, disposal, and incident escalation.
• ☐ Document identified risks, their likelihood and potential impact, planned safeguards, responsible owners, and completion dates.
• ☐ Revisit the assessment when systems, vendors, staffing, or program activities change, and periodically evaluate whether safeguards remain effective.

A checklist can help organize a review, but it does not replace an organization-specific risk analysis. HHS explains that there is no single risk-analysis method that guarantees compliance and that an entity must document its analysis and risk-management decisions. See HHS’s risk analysis guidance.

Review physical safeguards for records and devices

Consider how the screening location and any storage or work areas protect information from being seen, taken, or accessed by people who do not need it. Physical safeguards cover electronic information systems, workstations, devices, and media, whether they are located at the organization’s premises or elsewhere. See HHS’s explanation of physical safeguards.

• ☐ Position intake forms, devices, and displays so nearby participants or visitors cannot casually view names or readings.
• ☐ Avoid announcing a participant’s reading where others can hear it unless the participant has agreed and the program’s procedures permit it.
• ☐ Keep completed paper forms in a secured location and limit access to authorized personnel.
• ☐ Lock devices when unattended, and keep them under staff control during setup, screening, and cleanup.
• ☐ Set procedures for taking devices or records offsite, returning them, and reporting loss or theft.
• ☐ Decide how paper records, removable media, and retired devices will be securely disposed of or cleared before reuse.
• ☐ Check whether the physical layout creates privacy risks at sign-in, during measurement, or when discussing referrals.

Evaluate technical safeguards and system vulnerabilities

Review the technology used to collect, store, and send ePHI. The Security Rule’s technical safeguards address how systems control access to ePHI, record and examine activity, protect information from improper alteration or destruction, and secure transmission. HHS summarizes these requirements in its overview of the HIPAA Security Rule.

• ☐ Use individual accounts where available; avoid shared logins that make it difficult to identify who accessed a record.
• ☐ Review access permissions for the screening platform, email, shared folders, and any device that stores participant information.
• ☐ Use screen locks and device authentication, and keep operating systems and applications supported and updated.
• ☐ Check whether the system records access or changes and whether someone reviews those records for suspicious activity.
• ☐ Assess how information is transmitted, including whether staff send it through email, text, or other channels that may expose it to unintended recipients.
• ☐ Determine how records are backed up and restored, and who is responsible for responding if a device or service becomes unavailable.
• ☐ Review vendor security documentation and confirm the approved method for reporting suspected incidents.

Do not assume a particular product or security feature is sufficient on its own. The appropriate safeguards depend on the risks, the systems involved, and the organization’s circumstances. HHS advises regulated entities to use risk analysis to identify vulnerabilities and guide security decisions.

Document screening data handling and business associate responsibilities

Write down who controls each record and what each organization is permitted and expected to do with it. If a barbershop, screening partner, or vendor is a business associate, the covered entity generally must obtain satisfactory written assurances addressing the permitted use and safeguarding of PHI. The agreement should reflect the actual services and responsibilities rather than rely on a generic label. See HHS’s sample business associate agreement provisions.

• ☐ Identify which organization maintains the official screening record and which organization answers participant questions about it.
• ☐ Document the purpose and permitted recipients for each disclosure, including referrals to a clinician.
• ☐ Decide how records are corrected, retained, returned, or destroyed when the program ends or a partner relationship changes.
• ☐ If a business associate agreement is required, specify the services, allowed uses and disclosures, safeguards, subcontractor obligations, and incident reporting process.
• ☐ Establish how staff will route requests for access or copies to the organization responsible for the record.
• ☐ Confirm that vendors or subcontractors handling ePHI have been assessed and that required written arrangements are in place.
• ☐ Keep copies of agreements, data-flow notes, policies, training records, and decisions about who handles participant requests.

For covered entities, an individual’s access right can extend to PHI in a designated record set maintained by a business associate on the entity’s behalf. HHS explains that the covered entity remains responsible for providing access to information held by its business associate. See HHS guidance on the right of access. The program should therefore identify a clear contact and referral process rather than leave participants unsure which organization to approach.

Create incident response and breach notification procedures

Prepare a written process for responding to a lost device, misdirected message, unauthorized access, or other suspected incident. Staff should know whom to contact immediately and what information to preserve. A suspected exposure requires prompt investigation; it is not automatically a reportable HIPAA breach. For unsecured PHI, the covered entity or business associate must assess whether an impermissible use or disclosure qualifies as a breach under the applicable rules.

• ☐ Tell staff how and where to report a suspected incident, including after hours.
• ☐ Assign who will secure affected accounts or devices, preserve relevant records, and prevent further exposure.
• ☐ Record what information may have been involved, whose information it was, when the event occurred, and who may have received or accessed it.
• ☐ Notify the covered entity promptly if a business associate is involved, following the agreement’s reporting terms.
• ☐ Have the responsible HIPAA-regulated organization conduct and document the required breach notification assessment, including whether an exception applies or the assessment supports a low probability that PHI was compromised.
• ☐ Determine who is responsible for any required notifications to affected individuals, HHS, or others, and track applicable deadlines.
• ☐ Document the investigation, mitigation, notification decisions, and any changes made to prevent a recurrence.

Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery of a reportable breach of unsecured PHI. A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery, though the agreement may set a shorter reporting deadline. See HHS’s Breach Notification Rule guidance. Keep the risk analysis, agreements, access procedures, and incident plan current so responsibilities are clear before a problem occurs.

FAQs.

Is a barbershop automatically subject to HIPAA when it hosts blood pressure screenings?

No. Hosting a screening does not by itself make a barbershop a HIPAA covered entity or business associate. HIPAA status depends on the organization’s role and activities. A barbershop may need further assessment if it handles PHI on behalf of a covered entity as part of a service or function. See HHS guidance on covered entities and business associates.

Who is responsible for screening records and participant requests?

The program should identify in writing which organization maintains the screening record, which organization responds to participant requests, and how requests are routed. When a covered entity’s business associate maintains PHI in a designated record set on its behalf, the covered entity is responsible for providing access under HIPAA. See HHS guidance on the right of access.

Does completing a security checklist establish HIPAA compliance?

No. A checklist is a planning aid, not proof of compliance or a substitute for an organization-specific risk analysis, appropriate safeguards, and required documentation. HHS describes Security Rule compliance as an ongoing process that includes risk analysis, security measures, documentation, and periodic evaluation. See HHS guidance on evaluating Security Rule compliance.

What steps should the program take after a suspected exposure?

Report it promptly through the program’s incident process, secure affected accounts or devices, preserve relevant records, and notify the organization responsible for assessing the information and determining next steps. The covered entity or business associate should document its breach notification assessment and make any required notifications within applicable deadlines. See HHS’s Breach Notification Rule guidance.