Binational Border Health Program HIPAA Compliance Checklist

Use this checklist to plan cross-border health data activities involving U.S. organizations subject to HIPAA and partners in Mexico. HIPAA compliance depends on each organization’s role, the purpose and legal basis for each disclosure, and the safeguards used—not simply on the fact that information crosses an international border.

Define HIPAA Covered Entity and Business Associate Roles

• Confirm covered entity status. Determine whether each U.S. health plan, health care clearinghouse, or health care provider is a HIPAA covered entity. For providers, covered entity status generally depends on conducting certain transactions electronically.
• Identify business associates. A contractor or service provider may be a business associate if it handles protected health information on behalf of a covered entity or another business associate. Assess each partner’s actual functions, not just its job title or location.
• Do not assume a Mexican partner is automatically a business associate. A partner receiving information for its own authorized public health purposes may have a different role from a contractor performing services on behalf of a U.S. covered entity. Document the arrangement and get qualified legal review where the role is unclear.
• Map responsibility for each exchange. Record who decides why information is used, who sends or receives it, and who operates the systems that store or transmit it.

Business associate status can apply when a vendor creates, receives, maintains, or transmits electronic protected health information for a covered entity. If the relationship qualifies, a written business associate agreement generally establishes permitted uses, safeguards, reporting duties, and other required terms.

Identify Protected Health Information in Cross-Border Activities

• Inventory the information. Identify records, messages, test results, case reports, referrals, and datasets shared across the border.
• Check identifiability. Health information linked or reasonably linkable to an individual can be protected health information when held by a covered entity or business associate. Names are not the only identifiers: dates, locations, record numbers, and combinations of details can also identify someone.
• Trace every data path. Document the systems and people that create, access, transmit, store, or receive the information, including intermediaries and subcontractors.
• Separate identifiable data from de-identified information. Where the purpose allows, consider using de-identified information or a limited data set with an appropriate data use agreement.

Include electronic protected health information in the inventory and assess how cross-border access, transmission, storage, and subcontracting affect its confidentiality, integrity, and availability.

Establish Permitted Uses and Disclosures

• Document the purpose and legal basis. For each disclosure, identify the applicable HIPAA permission, authorization, or legal requirement. A binational program relationship alone does not establish permission to disclose protected health information.
• Verify public health authority involvement. The HIPAA Privacy Rule permits certain disclosures to public health authorities legally authorized to receive information for public health purposes. A covered entity may, at the direction of a public health authority, disclose information to an official of a foreign government agency collaborating with that authority.
• Apply the minimum necessary standard where required. For many public health disclosures, limit information to what is reasonably needed for the stated purpose. Establish standard protocols for routine exchanges and review unusual requests individually.
• Check other applicable requirements. Confirm whether a separate law, valid individual authorization, data use agreement, or program-specific requirement affects the proposed exchange.
• Record disclosure decisions. Keep the purpose, recipient, authority, data elements, and approval for each routine protocol or non-routine disclosure.

HIPAA’s public health provision permits specified disclosures without individual authorization, including a disclosure to a foreign government agency official when made at the direction of a public health authority and the foreign official is acting in collaboration with that authority. The minimum necessary standard generally applies to public health disclosures, subject to exceptions such as disclosures required by law or made under an individual’s authorization.

Implement Administrative Safeguards for Binational Coordination

• Perform and update a risk analysis. Assess risks to electronic protected health information across participating organizations, systems, locations, and transmission routes; document identified risks and mitigation decisions.
• Assign accountable leads. Name privacy and security contacts in each organization and define who approves disclosures, manages access, handles incidents, and coordinates responses across the border.
• Set workforce rules. Train staff on approved purposes, minimum necessary access, secure communications, identity verification, and escalation procedures. Provide access only to people who need it for their duties.
• Establish operational procedures. Define how partners verify requests, correct inaccurate information, manage urgent cases, and suspend or change an exchange when risks or program needs change.
• Review the arrangement periodically. Reassess roles, access, risks, and procedures when partners, technology, data types, or program purposes change.

The HIPAA Security Rule requires covered entities and business associates to conduct a risk analysis for electronic protected health information and to use appropriate administrative safeguards, physical safeguards, and technical safeguards.

Apply Technical Safeguards to Health Data Exchanges

• Control access. Use unique user accounts, role-based permissions, strong authentication, and timely removal of access when duties change or end.
• Protect transmission and storage. Use secure, appropriately configured systems to protect electronic protected health information in transit and at rest. Assess the security of email, portals, devices, networks, and third-party platforms used in the exchange.
• Maintain auditability. Enable and review logs that help identify who accessed, changed, sent, or received information.
• Protect data integrity and availability. Use safeguards to detect improper changes and support backup, recovery, and continuity of access for authorized users.
• Test the controls. Regularly review configurations, access permissions, and security measures against the risks identified in the risk analysis.

Encryption can reduce the risk of unauthorized access, but it does not replace the broader safeguards needed to protect the confidentiality, integrity, and availability of electronic protected health information.

Document Agreements and Breach Response Procedures

• Put required agreements in place. When a partner is a business associate, execute a business associate agreement that addresses permitted uses and disclosures, safeguards, incident reporting, subcontractors, and the handling of information when the relationship ends.
• Document other exchange terms. For partners that are not business associates, use suitable written terms to define the purpose, permitted data, authorized users, security expectations, retention, and incident coordination for the exchange.
• Set incident-reporting timelines. Establish how partners will promptly report suspected unauthorized access, disclosure, loss, or alteration, and identify who will investigate and coordinate across organizations.
• Follow the Breach Notification Rule. Assess whether an impermissible use or disclosure involving unsecured protected health information is a breach, document the assessment, and make required notifications within applicable timelines.
• Retain evidence. Keep agreements, approvals, risk-analysis records, training records, access logs, incident assessments, and documentation of required notifications or the basis for determining that notification was not required.

The HIPAA Breach Notification Rule generally requires covered entities and business associates to provide notifications following a breach of unsecured protected health information. Business associate agreements must address reporting obligations, and covered entities must document that required notices were made or why notice was not required.

In practice, a compliant binational exchange starts with clear roles, a documented legal basis, minimum necessary data, a risk analysis, appropriate safeguards, written terms, and a tested incident response process.

FAQs

Does HIPAA apply to binational border health program activities?

HIPAA applies to covered entities and business associates, not automatically to every organization participating in a binational program. A U.S. covered entity remains responsible for complying with HIPAA when it uses or discloses protected health information as part of cross-border activities. A foreign partner’s obligations depend on its role and relationship to the covered entity or business associate.

When can protected health information be shared with Mexican public health partners?

A covered entity may disclose protected health information without individual authorization in certain public health circumstances, including when a disclosure is made at the direction of a public health authority to an official of a foreign government agency acting in collaboration with that authority. The covered entity should verify the authority and purpose, limit the information as required by the minimum necessary standard, and document the basis for the disclosure. Other permissions or requirements may apply to particular exchanges.

Is a business associate agreement required for cross-border health data exchange?

Not for every exchange. A business associate agreement is generally required when a partner meets HIPAA’s definition of a business associate by handling protected health information on behalf of a covered entity or another business associate. A public health partner receiving information for its own authorized public health purpose may have a different role. Assess the actual relationship and document the appropriate terms before sharing data.

What safeguards should be used when sharing infectious disease information?

Use safeguards suited to the information and exchange: confirm the recipient and disclosure authority, share only the information needed for the purpose, restrict access to authorized staff, use secure transmission and storage, maintain access logs, and train staff on handling and incident reporting. Include these exchanges in the risk analysis and establish a coordinated response for suspected unauthorized access or disclosure.