Clean Desk Policy Checklist for Transition-Age Youth Mental Health Programs

A clean desk policy helps staff protect protected health information (PHI), personally identifiable information, and other confidential material from accidental viewing, loss, or disclosure. Use this checklist alongside your program’s confidentiality procedures, security policies, and applicable state and federal requirements. HIPAA applies to covered entities and business associates; it does not automatically govern every youth program or every record. HHS guidance on reasonable safeguards explains that safeguards should reflect the organization’s circumstances.

What should staff remove or secure before leaving a desk?

• Put paper charts, intake forms, referral documents, handwritten notes, schedules, and printouts containing client information in an approved locked drawer or records area.
• Remove visible names, appointment details, phone messages, and other client identifiers from desk surfaces, whiteboards, and sticky notes. Keep documents closed or face down while they are actively in use.
• Secure keys, access badges, portable devices, and removable storage according to program policy. Do not leave them where clients, visitors, or unauthorized staff can reach them.
• Lock the computer screen or sign out before leaving the workstation unattended. Follow your organization’s policy even when stepping away briefly.

How should staff protect records at printers, copiers, and in shared spaces?

Collect printouts promptly and check the output tray, copier feeder, and nearby surfaces for originals, extra copies, or misprints. Take only the documents you are authorized to handle, and place unwanted copies in the program’s approved secure-disposal container—not in an open recycling bin or regular trash.

Use secure release printing or other approved controls when available. Keep records out of sight in shared spaces, avoid discussing identifiable client details where others may overhear, and return documents to secure storage as soon as the task is complete. HIPAA calls for reasonable safeguards against inappropriate disclosures; it does not require eliminating every possible incidental disclosure. HHS guidance on incidental uses and disclosures

How can staff secure workstations and screens from unauthorized viewing?

• Lock the screen whenever you leave the workstation unattended; use a password-protected screen saver or other approved workstation control.
• Position monitors so clients and visitors cannot easily view records, and use an approved privacy screen where the workspace creates a meaningful viewing risk.
• Use your own account and credentials. Never share passwords or leave an active session open for another person to use.
• Use the program’s physical safeguards and technical safeguards for workstations, including settings for automatic logoff or screen locking. HIPAA requires appropriate workstation safeguards, but does not set one universal screen-lock interval for every program. HHS Security Rule guidance on physical safeguards and HHS guidance on technical safeguards

How should staff dispose of protected health information?

Place paper records and misprints containing PHI in the approved confidential document shredding container or follow another destruction process authorized by the program. Do not abandon PHI in a public or otherwise accessible trash or recycling area. HIPAA does not prescribe one specific paper-destruction method; organizations must choose reasonable safeguards for their circumstances. HHS disposal guidance

Follow your organization’s process for electronic records and devices, including approved deletion or media sanitization before reuse or disposal. If an outside vendor handles PHI, the organization should evaluate the vendor’s role and required safeguards, including a business associate agreement when applicable. Train staff to use the organization’s disposal procedures rather than improvising.

What procedures govern access to client records?

Use role-based record access: staff should access only the records and information needed for their assigned responsibilities, consistent with program policy and applicable law. HIPAA’s minimum necessary standard generally calls for reasonable efforts to limit access and use, with exceptions—including certain disclosures for treatment. HHS minimum necessary guidance

• Use individual accounts and follow approval procedures before requesting additional access.
• Do not look up a client’s record out of curiosity or share login credentials with a coworker.
• Report suspected unauthorized access or disclosure promptly through the program’s incident-reporting process.
• Follow procedures for changing or removing access when a staff member’s duties change or their employment ends.

How can programs protect the privacy of youth and families?

Use private or appropriately discreet spaces for conversations about care, and avoid discussing a young person’s identity or treatment details where others may overhear. Share information with family members only after staff follow the program’s procedures for verifying authority, consent, and any applicable limits on disclosure.

For minors, a parent or guardian’s access to mental health information can depend on the minor’s treatment circumstances and applicable state or other law. Programs should not assume that every parent has access to every record, or that every youth can withhold all information from a parent. HHS mental health and HIPAA guidance explains these distinctions. In school settings, student health records may be governed by FERPA rather than HIPAA, depending on the circumstances. HHS guidance on HIPAA and school records

Where should written records be stored securely?

Keep active records in a supervised work area and store records not in use in locked drawers, cabinets, or rooms with access limited to authorized staff. Do not leave files on desks overnight or in rooms where clients, visitors, or unauthorized personnel can enter unsupervised. Reasonable safeguards may include locking records storage and limiting access to keys or passcodes. HHS guidance on reasonable safeguards

Follow program procedures for checking records in and out, transporting files, and storing records off-site. A consistent clean desk checklist—secure paper, retrieve printouts, lock screens, and restrict record access—helps staff protect confidentiality throughout the workday.

FAQs

What client information must staff secure before leaving their desk?

Secure any paper or screen displaying PHI, personally identifiable information, or other confidential client details. This can include charts, intake forms, notes, schedules, printouts, messages, and electronic records. Follow your program’s policy for locking paper records and workstation screens.

How should staff handle protected information left at a shared printer?

Retrieve it promptly, keep it out of view, and deliver it only to the authorized recipient. Place misprints or unwanted copies in the approved secure-disposal container. If you find another person’s document, do not read or circulate it; secure it and notify the appropriate staff member.

When must staff lock a computer screen?

Lock the screen whenever you leave a workstation unattended, including for a brief interruption. Use the program’s approved automatic-lock settings, but do not rely on a timeout instead of locking the screen when you step away.

How should unneeded protected health information be destroyed?

Use the program’s approved process, such as a secure confidential document shredding container for paper or authorized sanitization or destruction for electronic media. Do not place PHI in an accessible public trash or recycling area. HIPAA requires reasonable safeguards but does not mandate one particular disposal method.