Community Paramedicine Program HIPAA Compliance Checklist

A community paramedicine program’s HIPAA obligations depend on how it is organized and what it does. First determine whether the program operates as part of a HIPAA covered entity or performs services involving protected health information (PHI) on behalf of one as a business associate. Health care providers are covered entities when they conduct certain standard electronic transactions; a program’s name or community-based role alone does not determine its status. See HHS guidance on covered entities and business associates.

Use this checklist to shape local procedures, then assess applicable state and other federal requirements with qualified compliance or legal support. HIPAA requirements can depend on the program’s structure, partners, information, and activities.

What patient consent and authorization procedures should the program use?

• Explain privacy practices. If the organization is a covered entity, provide its Notice of Privacy Practices (NPP) as required and retain the required acknowledgement or documentation of an unsuccessful effort to obtain it. An acknowledgement confirms receipt; it is not a HIPAA authorization or agreement to special disclosures. See HHS guidance on the Notice of Privacy Practices.
• Distinguish consent from authorization. HIPAA generally permits covered entities to use and disclose PHI for treatment, payment, and health care operations without a signed consent form. A written HIPAA authorization is generally needed when a use or disclosure is neither permitted nor required by the Privacy Rule. A notice or general consent does not replace an authorization when one is required. See HHS guidance on treatment, payment, and health care operations.
• Use a compliant authorization when necessary. Ensure it describes the information, who may disclose and receive it, the purpose, and an expiration date or event; includes the individual’s signature and date, revocation instructions, and required statements; and is written in plain language. Track expiration and revocation, and do not treat revocation as undoing a disclosure already made in reliance on the authorization. See HHS’s HIPAA Privacy Rule summary.
• Account for individual circumstances. Set procedures for verifying identity and authority when a personal representative acts for a patient, and for recording relevant patient preferences, restrictions, or communication requests. Apply additional rules for minors and other situations where state law may govern who can authorize care or disclosure.

How should patient information be shared with referral partners?

• Identify the purpose and recipient before sharing. HIPAA generally allows disclosure to another health care provider for treatment without patient authorization. A referral to a community resource does not automatically fit that category: assess the partner’s role, the purpose of the disclosure, and any other applicable permission. Obtain a valid authorization when no HIPAA permission or requirement applies and no other lawful basis allows the disclosure. See HHS guidance on treatment disclosures.
• Apply the minimum necessary standard where it applies. For disclosures subject to this standard, limit PHI to what is reasonably needed for the purpose. HIPAA exempts provider-to-provider disclosures for treatment from the minimum necessary standard; it also does not apply to disclosures made under an individual’s authorization. See HHS guidance on the minimum necessary standard.
• Determine whether a business associate agreement is needed. A referral partner is not automatically a business associate just because it receives PHI. A business associate generally performs certain services or functions on behalf of a covered entity involving PHI. When a business associate relationship exists, use a written agreement that sets permitted uses and disclosures and requires appropriate safeguards. See HHS guidance on business associates.
• Use approved sharing channels. Establish procedures to verify recipients, use organization-approved systems, address misdirected messages, and secure paper records and field devices. These are operational safeguards to implement according to the program’s risks and applicable policies.

What HIPAA training and written policies do personnel need?

For covered entities, workforce members must receive training on privacy policies and procedures as necessary and appropriate to their duties. Training is also required for new workforce members within a reasonable period and when a material policy change affects their functions; the covered entity must document that training. HIPAA does not impose one universal annual training schedule. An employer, state law, contract, or other rule may set a more frequent schedule. See HHS’s HIPAA audit protocol.

Train personnel on the procedures they need in the field: handling PHI, confirming identity and authority, documenting consent or authorization when applicable, sharing information with referral partners, protecting devices and paperwork, and promptly reporting suspected privacy or security incidents. Keep training records, but do not treat a training completion certificate as proof that the organization or program is HIPAA compliant.

Maintain written policies appropriate to the organization’s role and activities. These should address permitted uses and disclosures, access to records, authorization workflows, referral communications, incident response, sanctions for workforce violations, and how patients can ask questions or make complaints. Review policies when workflows, partnerships, technology, or applicable requirements change.

Which privacy and security safeguards protect patient health information?

The HIPAA Security Rule requires covered entities and business associates to use appropriate administrative, physical, and technical safeguards for electronic PHI (ePHI). The safeguards should reflect a risk analysis; HIPAA does not prescribe one identical security setup for every program. See HHS’s summary of the HIPAA Security Rule.

• Administrative safeguards: Assign privacy and security responsibilities, control workforce access, train personnel, manage identified risks, and establish procedures for security incidents and service interruptions.
• Physical safeguards: Protect workstations, facilities, vehicles, devices, and paper records from unauthorized access, loss, or improper disposal.
• Technical safeguards: Use access controls and authentication, maintain appropriate audit mechanisms, and protect ePHI from unauthorized alteration or transmission.
• Field-specific protections: Include mobile devices, remote access, shared workspaces, printed handoffs, and conversations that may be overheard in the program’s risk assessment. Select controls based on the information and risks involved.

Document the risk analysis and the actions taken to manage identified risks. Reassess when the program’s systems, partners, or operations change, and maintain procedures for investigating incidents and addressing any required breach notifications. See HHS guidance on Security Rule risk analysis.

What program protocols and documentation should be maintained?

• Maintain current policies, procedures, NPP materials, authorization forms, training records, and applicable business associate agreements.
• Keep a written referral workflow that identifies who may share information, with which partners, for what purposes, and through which approved channels. Record the information needed to administer the workflow and demonstrate compliance with applicable requirements.
• Document the Security Rule risk analysis, risk-management decisions, relevant evaluations, access controls, and incident investigations. Maintain a process for responding to suspected or confirmed inappropriate access or disclosure.
• Set retention and secure-disposal schedules that account for HIPAA, state law, contracts, and other recordkeeping requirements. HIPAA requires documentation maintained under the applicable Privacy and Security Rule provisions to be retained for six years from its creation or the date it was last in effect, whichever is later. See 45 C.F.R. § 164.316 and 45 C.F.R. § 164.530.

HIPAA does not generally require a covered entity to document every oral communication about treatment, payment, or health care operations. Keep records required by law and those needed to carry out the program’s approved procedures; do not assume that an internal documentation practice is itself a universal HIPAA mandate. See HHS guidance on documenting oral communications.

How should the program assess state and other federal confidentiality requirements?

HIPAA is not the only applicable privacy law. A state law may provide greater privacy protection or stronger individual rights; when a more stringent state provision conflicts with HIPAA, the more stringent provision may apply. When the laws are not in conflict, covered entities may need to comply with both. Identify the laws for each state where the program operates and review requirements that may apply to specific information, patients, or referral activities. See HHS guidance on more stringent state privacy laws.

Also assess whether specialized federal confidentiality rules apply. For example, 42 C.F.R. Part 2 protects certain substance use disorder records maintained in connection with a federally assisted program that provides substance use disorder diagnosis, treatment, or referral for treatment. The program’s role and the origin of the records matter; do not assume Part 2 applies to every substance use disorder-related disclosure. The revised Part 2 requirements had a compliance date of February 16, 2026. See HHS’s Part 2 Final Rule fact sheet.

In summary, a sound Community Paramedicine Program HIPAA Compliance Checklist starts with determining the program’s legal role, then addresses authorization and referral decisions, workforce practices, risk-based safeguards, required documentation, and any stricter state or specialized federal rules.

FAQs

When is patient authorization required before sharing information with a referral resource?

Authorization is generally required when a covered entity plans a use or disclosure that HIPAA does not otherwise permit or require. HIPAA generally allows provider-to-provider disclosures for treatment without authorization, but a disclosure to a referral resource must be assessed based on the recipient’s role, purpose, and applicable law. State law or specialized confidentiality rules may require additional permission.

What should a community paramedicine Notice of Privacy Practices explain?

For a covered entity, the NPP should explain how the organization may use and disclose PHI, the individual’s privacy rights, the organization’s duties to protect PHI, how to contact the organization with questions, and how to make a complaint. It does not substitute for an authorization when one is required. See HHS guidance on NPP requirements.

Which HIPAA safeguards should community paramedicine programs document?

Covered entities and business associates should document applicable security policies and procedures, the ePHI risk analysis and risk-management decisions, workforce access and training practices, relevant evaluations, and incident-response records. The specific safeguards should be based on the organization’s circumstances and risks, not assumed to be identical across all programs.

Can state privacy laws impose stricter requirements than HIPAA?

Yes. A state law may provide stronger privacy protections or individual rights than HIPAA. A more stringent state provision may prevail when it conflicts with HIPAA, and both laws may apply when they are not in conflict. Review the rules for each state where the program operates and for the information it handles. See HHS’s explanation of state-law preemption.