HIPAA Compliance Checklist for a Congenital Diaphragmatic Hernia Program

A congenital diaphragmatic hernia (CDH) program may collect highly sensitive information across clinical care, quality improvement, and research. This checklist covers practical safeguards for registry data, including electronic protected health information (ePHI). HIPAA obligations depend on the participating organizations’ roles: the HIPAA Rules apply to covered entities and business associates, so each center should involve its privacy and security officers when deciding how the rules apply. See HHS guidance on covered entities and business associates.

How should a CDH program conduct and document its HIPAA risk analysis?

Each participating covered entity and business associate should identify where registry ePHI is created, received, maintained, or transmitted. Include the registry platform, electronic health records, data-entry workstations, file transfers, backups, mobile devices, and vendors or subcontractors that handle the information. The HIPAA Security Rule calls for an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. HHS explains that no single risk-analysis method is prescribed; the approach should fit the organization’s size, complexity, and capabilities. See HHS guidance on Security Rule risk analysis.

• Inventory information and systems: Record the registry data elements, identifiers, users, system locations, data flows, and external services involved.
• Assess threats and vulnerabilities: Consider inappropriate access, misdirected disclosures, lost devices, ransomware, accidental edits or deletions, service interruptions, and risks introduced by data exchange between centers.
• Estimate and prioritize risk: Document the likelihood and potential impact of each relevant threat, existing safeguards, and any remaining risk.
• Track remediation: Assign an owner and target date to each action, such as tightening permissions, improving backup procedures, or changing a transfer process.
• Review and update: Reassess when the registry, its vendors, workflows, or threat environment changes, and periodically evaluate whether safeguards remain effective.

Keep the risk analysis, decisions, remediation records, and related Security Rule documentation in a form that responsible staff can access. HIPAA requires covered entities and business associates to retain required Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later. See HHS’s summary of the HIPAA Security Rule.

Which HIPAA privacy rules govern registry data collection and use?

Define the purpose for each registry activity before collecting or sharing patient-level data. A use for treatment or health care operations is not automatically the same as a use for research; whether a specific activity qualifies depends on its purpose, the organizations involved, and the applicable HIPAA provisions. Document the basis for each use or disclosure and consult the participating organizations’ privacy officers when a registry serves multiple centers.

For research involving identifiable PHI, a covered entity generally needs a valid individual authorization or a permitted alternative, such as documented approval of a waiver or alteration of authorization by an Institutional Review Board (IRB) or Privacy Board. HHS also describes limited provisions for preparatory-to-research activities and research on decedents’ information. See HHS guidance on HIPAA and research and HHS research-use FAQs.

Apply the minimum necessary standard to uses, requests, and disclosures where it applies. Set reasonable criteria for routine registry tasks and review non-routine requests so that staff share only the PHI needed for the stated purpose. The standard does not apply in certain circumstances, including disclosures for treatment and uses or disclosures made pursuant to an individual’s authorization. Research disclosures made with appropriate IRB or Privacy Board documentation have specific minimum-necessary rules. See HHS guidance on the minimum necessary requirement.

If the program can meet its goals with de-identified information, consider using it for analysis or sharing. HIPAA recognizes two methods for de-identification: Safe Harbor and Expert Determination. Information that meets the HIPAA de-identification standard is no longer PHI under the Privacy Rule. See HHS guidance on de-identification.

How can programs control staff access to electronic protected health information?

Use role-based access control (RBAC) to match registry permissions to job duties. For example, a site coordinator may need to enter and correct records for their center, while a statistician may need access to a limited analysis dataset rather than direct identifiers. Configure the system so that users receive only the access appropriate to their role, and review access when responsibilities change.

• Use unique user accounts and authentication procedures; avoid shared accounts.
• Limit access by role, center, task, and data type where the system supports it.
• Establish a process for approving, changing, and periodically reviewing access.
• Remove or adjust access promptly when a person leaves the workforce or changes responsibilities.
• Define and document emergency access procedures for situations in which normal access controls could interfere with care or operations.

The Security Rule requires technical policies and procedures that allow access to ePHI only by authorized persons, and administrative policies for authorizing access based on a workforce member’s role. The Privacy Rule’s internal-use requirements also call for policies that restrict workforce access according to role. See HHS’s Security Rule summary and HHS’s Privacy Rule summary.

What audit and integrity controls protect CDH registry data?

Configure audit controls to record and support review of activity in systems that contain or use ePHI. For a registry, useful audit records can help show which user viewed, entered, changed, exported, or deleted information and when the action occurred. Establish who reviews those records, how suspicious activity is escalated, and how findings are documented. HIPAA requires mechanisms to record and examine information-system activity; it does not prescribe one particular log format for every program. See HHS’s summary of the Security Rule’s audit-control requirements.

Protect data integrity by limiting who can edit registry records and by retaining a traceable record of corrections. Use validation rules and documented procedures to reduce entry errors, and establish a process for investigating unexpected changes. The Security Rule requires policies and procedures to protect ePHI from improper alteration or destruction. See HHS’s Security Rule summary.

Include audit-log review and integrity checks in the program’s risk management and incident response procedures. For example, investigate unusual export activity, repeated failed access attempts, or edits inconsistent with a user’s assigned duties.

How should programs secure stored and transmitted patient data?

Choose safeguards based on the risk analysis and the registry’s data flows. For stored data, consider encryption, controlled administrative access, secure backups, protection against unauthorized device use, and procedures for safely disposing of media. For transfers between centers or to approved service providers, use secure channels, verify the recipient, and limit the information sent to what is permitted and needed.

HIPAA requires technical safeguards for access control and transmission security. Encryption is an addressable implementation specification under the Security Rule: the organization must assess whether it is reasonable and appropriate in its circumstances; if not, it must document that decision and implement an equivalent alternative measure when reasonable and appropriate. Encryption remains a practical safeguard to assess for stored devices, backups, and data in transit. See HHS risk-analysis guidance and HHS’s Security Rule summary.

Prepare for data loss or system disruption with documented backup, restoration, and emergency-operation procedures. Test those procedures so the program can recover registry information and continue essential functions while protecting ePHI.

What workforce training and business associate safeguards are required?

Train workforce members on the organization’s security policies and procedures, including the parts that apply to registry work. Cover how to handle identifiers, use approved transfer methods, protect credentials, recognize and report suspicious activity, and follow local rules for research access. HIPAA requires a security awareness and training program for workforce members, but it does not establish a universal annual certificate-renewal requirement. Training should reflect the organization’s policies and the person’s responsibilities. See HHS’s Security Rule summary.

Keep records of training and explain how staff can report suspected privacy or security incidents. Apply the organization’s policies consistently, including appropriate sanctions for workforce members who violate them.

Determine whether registry vendors, hosting providers, data managers, or other outside organizations are business associates based on the services they perform and their access to PHI. When a business associate relationship exists, put a written business associate agreement (BAA) in place before allowing the business associate to handle PHI. The agreement should set permitted uses, require safeguards, address incident reporting, and require appropriate protections from relevant subcontractors. See HHS’s sample BAA provisions and HHS guidance on business associates.

How should a program assess and report a potential breach?

Have a clear process for promptly reporting and responding to suspected loss, inappropriate access, or disclosure of registry PHI. Preserve relevant evidence, restrict ongoing access when appropriate, identify the affected data and individuals, and involve the privacy or security officer. Document the investigation, decisions, mitigation, and any required notices.

An impermissible use or disclosure of PHI is generally presumed to be a breach unless an exception applies or the organization demonstrates a low probability that the PHI was compromised through a documented risk assessment. That assessment must consider at least the nature and extent of the PHI, who received or used it, whether it was actually acquired or viewed, and the extent to which the risk was mitigated. See HHS’s HIPAA Breach Notification Rule guidance.

For a reportable breach of unsecured PHI, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery. When a breach affects 500 or more individuals, the covered entity must also notify the Secretary of HHS within that timeframe; media notice is required when more than 500 residents of a state or jurisdiction are affected. For fewer than 500 individuals, the covered entity must report the breach to the Secretary within 60 days after the end of the calendar year in which it was discovered. A business associate must notify the covered entity under the applicable rule and BAA; the covered entity remains responsible for ensuring required individual notices are made. See HHS breach notification guidance and HHS instructions for reporting breaches to the Secretary.

In summary, a strong CDH registry program documents its risks, limits data use and staff access, protects and monitors information, trains its workforce, oversees business associate relationships, and responds promptly to potential breaches. Revisit the checklist as the registry and its participating centers’ workflows change.

FAQs

Can participating CDH centers use registry data for clinical research and outcome monitoring?

They may use registry data only when the activity is permitted under the applicable HIPAA Privacy Rule provisions and each center’s policies. Clinical outcome monitoring may be treated differently from research depending on its purpose and circumstances, so do not assume that every registry project fits the same category. For research involving identifiable PHI, a center generally needs individual authorization or a permitted alternative, such as a documented IRB or Privacy Board waiver. See HHS guidance on HIPAA and research.

What access controls should a CDH program use for registry data?

Use unique accounts, role-based access control, appropriate authentication, and permissions limited to the user’s work and authorized data. Review and update access when duties change or employment ends, and use audit controls to record and examine activity involving ePHI. The specific safeguards should reflect the program’s risk analysis and applicable policies.

When must a CDH program notify individuals about a reportable breach?

For a reportable breach of unsecured PHI, the covered entity must notify affected individuals without unreasonable delay and no later than 60 days after discovering the breach. A business associate must notify the covered entity as required by the Breach Notification Rule and their BAA so the covered entity can meet its obligations. See HHS breach notification guidance.

How are breaches affecting fewer than 500 individuals reported to federal authorities?

The covered entity reports the breach to the Secretary of HHS through the online breach reporting portal no later than 60 days after the end of the calendar year in which it was discovered. It may report sooner and must submit a separate notice for each breach incident. See HHS instructions for submitting breach notices.