Clean Desk Policy Checklist for Auditory Processing Disorder Clinics

Use this checklist to reduce the chance that patient information is seen, heard, lost, or accessed by someone who does not need it. It is designed for auditory processing disorder clinics handling items such as intake forms, assessment notes, test results, referral records, and electronic health records (EHRs).

For clinics subject to HIPAA, protected health information (PHI) may be spoken, written, or electronic. HIPAA requires appropriate safeguards, but the right steps depend on your clinic’s setting and risks. Use this checklist alongside your organization’s policies and applicable state law. See the HHS Summary of the HIPAA Privacy Rule.

How should clinics secure patient information at workstations?

Set up work areas so patients, visitors, and staff without a work-related need cannot readily see or access PHI. HIPAA’s Security Rule calls for physical safeguards at workstations that access electronic PHI (ePHI), and policies describing appropriate workstation use. See 45 CFR § 164.310.

• Position monitors away from waiting areas, hallways, and public sightlines; use a privacy screen where appropriate.
• Lock or sign out of the EHR whenever you step away, even briefly. Do not leave a patient chart open for the next person to find.
• Use individual logins; never share passwords or leave credentials where others can see them. HIPAA requires unique user identification for users of systems containing ePHI. See the HHS guidance on unique user IDs.
• Apply role-based access control so each workforce member has access appropriate to their job. Review and update access when staff duties change or employment ends.
• Keep paper charts and devices in staff-only areas; secure rooms, cabinets, and equipment when unattended.
• Speak quietly about patient information and avoid discussing identifiable details where patients or visitors may overhear.

What should staff clear from desks at the end of each shift?

Before leaving, collect or securely store materials that identify a patient or reveal care. Do not leave PHI visible on desks, counters, clipboards, or shared work surfaces overnight or between shifts.

• Put intake forms, referral documents, assessment notes, test results, and printed EHR pages in an authorized locked cabinet or other approved secure storage.
• Remove patient labels, appointment lists, handwritten reminders, sticky notes, and printouts from work areas.
• Place documents no longer needed in an approved secure document disposal container rather than an open wastebasket or recycling bin.
• Clear shared printers, scanners, fax machines, and trays promptly; confirm that each page belongs to the intended recipient.
• Close patient records on shared computers, lock the workstation, and store portable devices and removable media according to clinic policy.

How can staff protect confidential materials during the workday?

Keep only the information needed for the task at hand within reach. When you must step away or pause work, cover, secure, or return documents to their designated storage. These everyday measures help limit incidental exposure of PHI.

• Use a cover sheet or folder when moving patient paperwork between rooms, and carry only the records needed for that activity.
• Keep charts and forms under staff control during testing and consultations; do not leave them unattended in shared clinic areas.
• Use the clinic’s approved process to verify a recipient before handing over, faxing, or otherwise sending patient information.
• Keep conversations about patients out of reception and other areas where people without a care-related need may hear them.
• Report misplaced records, misdirected documents, or suspected unauthorized access promptly under clinic incident procedures.

HIPAA’s minimum necessary standard generally calls for reasonable limits on PHI used, disclosed, or requested for payment and health care operations. It does not apply to disclosures to or requests by a health care provider for treatment purposes. See HHS guidance on the minimum necessary requirement.

How should clinics dispose of paper records containing patient information?

Follow your clinic’s written retention and disposal procedures; do not discard identifiable patient paperwork in a container accessible to the public or unauthorized people. HIPAA does not prescribe one disposal method for every situation, but it requires safeguards that protect PHI through disposal. See HHS guidance on disposing of PHI.

• Place papers awaiting destruction in an approved secure bin or locked container, not an open trash or recycling bin.
• Use a method that renders PHI essentially unreadable and not reconstructable, such as shredding, pulping, or pulverizing.
• If a disposal vendor handles PHI, use the clinic’s approved process for engaging the vendor and safeguarding the information through destruction. See HHS guidance on disposal vendors.
• Train relevant staff on the clinic’s disposal procedures, including how to handle misprints and documents that contain only partial patient information.

What safeguards protect electronic patient records?

Protect EHR access with technical and administrative controls as well as secure workstation practices. HIPAA’s Security Rule requires access controls for ePHI and unique user identification; the specific safeguards your clinic uses should be selected based on its risks and documented security practices. See 45 CFR § 164.312.

• Give each staff member an individual account and limit EHR permissions to the records and functions needed for their role.
• Use strong, clinic-approved authentication; do not share credentials or leave them written near a workstation.
• Lock screens when unattended and use clinic-approved secure connections and devices to access EHRs.
• Review access and activity logs as directed by clinic policy, and promptly report unusual access or suspected security incidents.
• Maintain routine data backups and a recovery plan. HIPAA requires procedures to create and maintain retrievable exact copies of ePHI as part of its contingency planning provisions. See 45 CFR § 164.308.
• Follow clinic procedures for disposing of or reusing devices and media that may contain ePHI.

When may patient information be disclosed without written permission?

HIPAA does not require written authorization for every use or disclosure of PHI. A covered entity may generally use or disclose PHI for its own treatment, payment, and health care operations, subject to applicable Privacy Rule requirements. See HHS guidance on treatment, payment, and health care operations.

Other permitted circumstances can include disclosures required by law, certain public health activities, and disclosures necessary to address a serious and imminent threat to health or safety. The rules and limits depend on the specific circumstance and may also depend on state law. See HHS guidance on serious and imminent threats and HHS guidance on public health disclosures.

Before sharing information, confirm that a HIPAA permission or other legal basis applies, check for any relevant restrictions, and follow clinic procedures. The minimum necessary standard applies to many disclosures, but not to disclosures to or requests by a health care provider for treatment purposes. A disclosure that requires an individual’s HIPAA authorization must follow the applicable authorization requirements; do not assume verbal permission or a general consent form is sufficient.

A consistent clean desk routine, secure workstation practices, controlled EHR access, and careful disposal help protect patient information throughout the workday. Follow your clinic’s written policies and verify the applicable basis before disclosing PHI.

FAQs

What patient information must be removed from a desk at the end of a shift?

Remove or securely store any visible information that identifies a patient or relates to their care. This may include intake forms, assessment notes, test results, referral records, appointment lists, labels, printouts, and handwritten reminders. Follow your clinic’s storage and retention policies.

Can staff leave patient documents unattended in a shared clinic area?

Staff should not leave patient documents exposed or accessible to people who do not need them. If you must step away, secure the documents in an approved location or keep them under staff control, consistent with clinic policy.

How should unnecessary paper records containing patient information be disposed of?

Use the clinic’s approved secure disposal process. HIPAA does not mandate one specific method, but HHS describes shredding, pulping, or pulverizing as examples that can render paper PHI unreadable and not reconstructable. Do not leave patient information in publicly accessible trash or recycling containers.

When can a clinic disclose patient information without written permission?

HIPAA generally permits certain uses and disclosures without written authorization, including many disclosures for treatment, payment, and health care operations, as well as specified disclosures required or permitted by law. The clinic should verify that the particular disclosure is allowed, follow any applicable limits and state laws, and consult its privacy procedures when uncertain.