Complete HIPAA Compliance Checklist for a Dermatology Mohs Surgery Suite

Achieving HIPAA compliance in a Mohs surgery suite requires a practical, risk-based program tailored to surgical workflows, histotechnology, digital imaging, and patient coordination. Use this checklist to operationalize the Security Rule and Privacy Rule while aligning daily tasks—before, during, and after Mohs procedures—with defensible controls and thorough documentation.

Security Rule Compliance

Administrative safeguards to anchor your program

• Assign a Security Official with authority to approve controls, prioritize remediation, and oversee Risk Assessments.
• Define role-based access to ePHI across EHR, LIS, slide scanners, photography apps, and billing systems.
• Establish a sanction policy for violations and an exception (“break-glass”) process with immediate post-incident review.
• Develop contingency plans: data backup, disaster recovery, and emergency operations with tested restoration objectives.
• Execute and track Business Associate Agreements for all vendors handling ePHI (EHR, cloud storage, pathology consults, billing, secure messaging).

Technical safeguards checklist

• Access Controls: unique user IDs, least privilege, MFA for remote or privileged access, automatic logoff, and emergency access procedures.
• Audit Controls: enable immutable logging on EHR/LIS/imaging systems; review high-risk events (VIP lookups, after-hours access) and retain logs per policy.
• Transmission Security: enforce TLS for portals and APIs, use secure messaging (not SMS) for ePHI, and require VPN or zero-trust for remote pathology access.
• Integrity and authentication: checksum/cryptographic hashes for exported images and reports; device and user authentication on scanners and microscopes.
• Data protection: encrypt ePHI at rest on servers and mobile devices; disable local storage where feasible; prohibit unsecured USB media.

System and network expectations

• Segment lab and imaging devices from guest networks; restrict outbound traffic to required destinations only.
• Harden workstations with endpoint protection, timely patching, and application allowlists for histology instruments.
• Maintain standardized, securely configured templates for new devices with documented baseline settings.

Privacy Rule Adherence

Minimum necessary and permitted uses

• Limit uses/disclosures to treatment, payment, and operations unless patient authorization is obtained.
• Apply minimum necessary to scheduling, pathology consults, and intraoperative coordination; mask nonessential identifiers in teaching materials.
• Use de-identification or a data use agreement for analytics and quality improvement when feasible.

Patient rights and transparent notices

• Provide and document receipt of your Notice of Privacy Practices at registration and upon update.
• Honor patient rights: access, amendments, restrictions, confidential communications, and an accounting of disclosures.
• Maintain timely processes for requests and track deadlines, responses, and denials with rationale.

Consent and authorization management

• Treatment-related clinical photography for Mohs mapping should be governed by policy and logged in the record.
• Obtain signed authorization for non-TPO uses (marketing, external education); track expirations and revocations.
• Record consent status in the EHR, surface it in workflows, and reconcile changes before disclosures.

Business associates and privacy

• Ensure Business Associate Agreements define permitted uses, safeguards, subcontractor flow-downs, and Breach Notification Requirements.
• Verify BA security attestations and incident reporting pathways annually.

Risk Analysis and Management

How to run an actionable Security Risk Analysis

1. Inventory systems handling ePHI: EHR, LIS, slide scanners/cameras, image repositories, patient portal, backups, and mobile devices.
2. Map data flows for images and reports between lab, surgical rooms, and external consultants.
3. Identify threats and vulnerabilities; rate likelihood and impact; calculate risk scores and populate a risk register.
4. Define mitigation plans with control owners, milestones, budgets, and measurable outcomes.
5. Validate remediation and update the register; brief leadership on residual risk and acceptance decisions.

Mohs-specific risk considerations

• Mislabeling of slides or photos causing patient mismatches; enforce barcode workflows and verification steps.
• Unsecured mobile photography; require approved apps with encryption and automatic upload to the record.
• Networked imaging devices exposed to the internet; place behind firewalls and restrict management interfaces.
• Staffing constraints during multi-stage procedures; use pause-checks for identity and site verification before each stage.

Ongoing risk management

• Perform formal Risk Assessments at least annually and whenever you introduce major technology, vendors, or locations.
• Monitor control effectiveness with metrics (patch latency, failed logins, audit review completion) and adjust plans accordingly.

Employee Training and Policies

Workforce Training that sticks

• Deliver onboarding training before system access and refresher training at least annually with Mohs-specific scenarios.
• Run phishing simulations and privacy drills (misdirected fax, overheard PHI) with documented outcomes.
• Provide role-based modules for surgeons, histotechnicians, nurses, front desk, billing, and IT support.

Operational policies to guide behavior

• Acceptable use, password/MFA standards, secure messaging, and clean desk guidelines.
• BYOD and clinical photography: approved apps only, automatic upload to the record, and prohibition on local camera roll storage.
• Identity verification for callers and portal users; callback procedures before disclosing PHI.
• Sanctions policy with consistent enforcement; maintain attestations for all Workforce Training completions.

Physical Safeguards

Facility access and layout

• Restrict entry to the Mohs surgery suite and histology lab via keys or badges; maintain visitor logs and escorts.
• Design check-in and staging areas to protect spoken PHI; use sound masking or private rooms for sensitive discussions.

Workstation and device protections

• Position monitors away from public view; use privacy filters in procedure rooms and at front desk.
• Auto-lock workstations; secure devices with cable locks or cabinets; maintain an asset inventory with owners and locations.
• Implement device and media controls for slide images and backups; track movement, reuse, and disposal of media.

Environmental and contingency measures

• Provide backup power for critical lab equipment; monitor temperatures and humidity where required.
• Keep shredding consoles and locked bins for paper/labels; prohibit mixed waste that could expose identifiers.

Breach Notification Procedures

Identify, contain, and investigate

• Activate your incident response plan upon suspected unauthorized access, loss, or disclosure of ePHI.
• Isolate affected systems, preserve logs, and notify the Privacy/Security Officials immediately.

Determine if it is a breach

• Complete the four-factor risk assessment: nature/extent of PHI, unauthorized person, whether PHI was actually acquired/viewed, and mitigation success.
• Document rationale for breach vs. non-breach determinations and all mitigation steps taken.

Breach Notification Requirements

• Notify affected individuals without unreasonable delay and no later than 60 calendar days from discovery, using written notice (mail or consented email).
• Notify HHS as required; if 500 or more individuals in a jurisdiction are affected, also notify prominent media.
• Business associates must notify your practice of their incidents promptly per the Business Associate Agreement.
• Offer remediation such as credit monitoring when appropriate, and track all communications and responses.

Documentation and Record Keeping

What to maintain

• Policies and procedures, Risk Assessments, risk management plans, training logs, and sanctions records.
• Access logs, Audit Controls reviews, incident and breach assessments, and evidence of contingency plan tests.
• Notices of Privacy Practices, patient rights requests and responses, authorizations, and Business Associate Agreements.

Retention, versioning, and proof

• Retain required HIPAA documentation for at least six years from creation or last effective date; honor longer state or payer retention rules.
• Track versions with effective dates and approvers; store records securely with controlled access and backups.

Operational monitoring

• Schedule periodic reviews of access reports and audit logs; investigate anomalies and record outcomes.
• Use metrics to demonstrate program effectiveness and drive continuous improvement.

Conclusion

By aligning technical safeguards, privacy practices, Risk Assessments, Workforce Training, and clear Breach Notification Requirements, your Mohs surgery suite can protect patients and operate confidently. Treat compliance as an ongoing quality program, not a one-time project, and reinforce it with disciplined documentation.

FAQs

What are the key HIPAA requirements for a Mohs surgery suite?

Focus on Security Rule controls (Access Controls, Audit Controls, Transmission Security, encryption, and contingency planning), Privacy Rule adherence (minimum necessary, patient rights, and authorization management), signed Business Associate Agreements for all vendors, and rigorous documentation. Tailor each control to Mohs workflows like intraoperative photography, slide processing, and rapid pathology reporting.

How often should risk assessments be conducted?

Perform a comprehensive Security Risk Analysis at least annually and whenever you adopt new systems, vendors, or locations, or make significant workflow changes. Update the risk register after incidents, audits, or control changes, and track remediation to closure with assigned owners and deadlines.

What steps must be taken if a data breach occurs?

Activate incident response, contain and investigate, complete the four-factor risk assessment, and document findings. If it is a breach, send individual notices without unreasonable delay and no later than 60 days from discovery, notify HHS (and media if required), provide mitigation support, and implement corrective actions to prevent recurrence.

How is patient consent managed under HIPAA?

Consent is not required for treatment, payment, and operations, but you must apply minimum necessary outside of treatment workflows. Obtain written authorization for non-TPO uses such as marketing or public education, record consent status in the EHR, surface it in workflows, and honor revocations promptly across all systems and vendors.