HIPAA Compliance Checklist for a Conservative Kidney Management Clinic

Use this checklist to organize privacy and security practices for a conservative kidney management clinic that is a HIPAA covered entity. HIPAA generally applies to health care providers that conduct certain standard transactions electronically; confirm the clinic’s status and tailor safeguards to its systems, workforce, and services. HHS guidance on covered entities explains which organizations are subject to the HIPAA Rules.

Conservative kidney management may involve sensitive records about symptoms, laboratory results, treatment preferences, care planning, and communications with people involved in a patient’s care. HIPAA does not prescribe a separate checklist for this type of clinic, so build your safeguards around the electronic protected health information (ePHI) the clinic creates, receives, maintains, or transmits.

How to conduct and document a HIPAA security risk analysis

The HIPAA Security Rule requires an accurate and thorough security risk analysis covering threats and vulnerabilities to the confidentiality, integrity, and availability of the clinic’s ePHI. Use the results to select safeguards and manage identified risks; a risk analysis is not simply a vendor questionnaire or a one-time certification. HHS guidance on conducting a risk analysis describes the scope and documentation expected.

• Inventory ePHI and its movement: Identify where patient information is created, accessed, stored, backed up, and transmitted, including the electronic health record, billing systems, email, telehealth tools, mobile devices, paper-to-digital workflows, and vendor systems.
• Identify threats and vulnerabilities: Consider risks such as misdirected messages, stolen devices, inappropriate staff access, phishing, system outages, weak backups, and vendor incidents.
• Assess likelihood and impact: Record how each risk could affect patient privacy, record integrity, or the availability of information needed for care.
• Document decisions and remediation: For each significant risk, note existing safeguards, remaining risk, planned corrective action, an accountable owner, and a target date. Track completion and accepted residual risk.
• Review and update: Reassess when the clinic changes systems, vendors, workflows, or locations, or when new risks or incidents arise. HIPAA does not set one universal schedule for conducting the analysis; HHS says frequency depends on the organization and its circumstances.

Keep the analysis, risk-management plan, and follow-up evidence together. HHS describes risk analysis as an ongoing process and notes that a covered entity should reevaluate risks and update safeguards as needed. See HHS risk analysis guidance.

Which administrative physical and technical safeguards protect ePHI

Choose safeguards based on the clinic’s risk analysis, size, resources, and technical environment. HIPAA requires compliance with each Security Rule standard, while certain implementation specifications are “addressable”—meaning the clinic must assess whether they are reasonable and appropriate, implement them when appropriate, or document a suitable alternative and why it is appropriate. HHS’s Security Rule summary explains this distinction.

• Administrative safeguards: Assign a security official; establish workforce authorization and supervision procedures; define role-appropriate access; train staff; respond to security incidents; evaluate safeguards; and maintain contingency plans for backups, recovery, and emergency operations.
• Physical safeguards: Control access to facilities and areas containing systems; define acceptable workstation use; position screens to limit casual viewing; secure devices; and control the movement, reuse, and disposal of electronic media containing ePHI.
• Technical safeguards: Restrict system access to authorized users; use audit controls to record and examine activity; protect information from improper alteration or destruction; authenticate users; and protect ePHI transmitted over electronic networks.

For example, the clinic may use individual user accounts, role-based permissions, screen locks, secure disposal procedures, and tested backups. Consider encryption and other technical measures through the risk analysis; do not assume that a particular technology alone establishes compliance. HHS details the administrative, physical, and technical standards in its HIPAA Security Rule summary.

How to manage privacy policies patient rights and complaints

Maintain written privacy policies that explain permitted uses and disclosures, staff responsibilities, safeguards, complaint handling, and how the clinic responds to patient requests. Designate a privacy official and a contact person or office for privacy questions and complaints.

Provide a current Notice of Privacy Practices (NPP) that explains how the clinic may use and share health information, the clinic’s privacy duties, patient rights, and how to contact the clinic or file a complaint. Give the notice as required, make it available on request, and post it on the clinic’s website if it has one. Ask patients to acknowledge receipt in writing, but do not treat their signature as consent to uses or disclosures; document a refusal to acknowledge. See HHS guidance on the Notice of Privacy Practices.

Have a process to receive, route, track, and resolve requests and complaints. Staff should know how to handle requests for access, amendments, restrictions, confidential communications, and applicable accountings of disclosures. A patient’s access request generally must be acted on within 30 calendar days; if the clinic needs an extension, it must provide a written explanation and completion date within the initial period. HHS guidance on access-request deadlines explains the deadline and extension.

Record complaints, investigation steps, findings, responses, and any corrective action. Do not retaliate against a patient or workforce member for raising a privacy concern or exercising a HIPAA right. Review policies and the NPP when clinic practices change.

What workforce training and sanctions should the clinic document

Train workforce members—including employees, volunteers, and trainees—on the privacy and security policies relevant to their duties. Training should cover appropriate access, discreet conversations, secure messaging, device handling, incident reporting, and the clinic’s process for escalating suspected disclosures or lost devices. Update training when policy or job responsibilities change.

Keep records showing who completed training, when it occurred, what topics or materials were covered, and whether required follow-up was completed. HIPAA calls for training that is necessary and appropriate to workforce functions; it does not establish a universal annual certificate-renewal requirement. A generic completion certificate does not replace training on the clinic’s own policies. HHS summarizes the workforce training and sanctions requirements in its HIPAA Privacy Rule guidance and Security Rule guidance.

Adopt and apply appropriate sanctions when workforce members violate privacy or security policies. Document the reported conduct, investigation, decision, sanction or corrective action, and follow-up, while limiting access to personnel records to those who need it.

How to secure access devices audit logs and electronic records

Establish written procedures for granting, changing, and removing access. Use unique accounts so activity can be attributed to individual users, assign permissions according to job responsibilities, review access periodically, and promptly disable access when a workforce member leaves or changes roles. Define and document an emergency-access process for situations where staff need ePHI to support care.

Protect workstations and mobile devices that can access ePHI. Set expectations for secure storage, screen privacy, remote access, approved software, and reporting lost or stolen equipment. Use technical safeguards such as authentication, encryption where appropriate, secure transmission, and device protections based on the risk analysis.

Configure audit controls to record and examine relevant activity in systems containing ePHI. Define who reviews logs, how often reviews occur, which events are escalated, and how findings are documented. Keep evidence of reviews and responses to unusual access or other suspected security incidents. HHS identifies access controls, authentication, transmission security, and audit controls in its Security Rule summary.

How to manage business associate agreements and breach reporting

Before allowing a business associate to create, receive, maintain, or transmit ePHI on the clinic’s behalf, obtain a written business associate agreement (BAA). Review vendors by what they do and what information they can access—not just by the product they sell. Vendors providing EHR hosting, cloud storage, billing, transcription, or IT support may require a BAA when their work involves PHI. A software vendor with no PHI access may not be a business associate; assess the actual arrangement. See HHS’s business associate guidance.

Check that each BAA sets permitted uses and disclosures, requires appropriate safeguards, addresses incident and breach reporting, supports patient-rights obligations where relevant, and covers subcontractors that handle PHI. Keep signed agreements, amendments, vendor contacts, and review notes. HHS provides sample BAA provisions as a reference.

Maintain a written breach notification rule response procedure that tells staff how to report a suspected incident, whom to contact, and how to preserve relevant records. The response team should contain and investigate the incident, determine what PHI was involved and whether it was unsecured, assess whether an exception applies or whether a documented risk assessment supports a low probability that PHI was compromised, mitigate harm, and document the decision and actions.

For a reportable breach of unsecured PHI, notify affected individuals without unreasonable delay and no later than 60 days after discovery. Notify HHS as required; breaches affecting 500 or more individuals must be reported to the Secretary without unreasonable delay and no later than 60 days, while reports of breaches affecting fewer than 500 are due within 60 days after the end of the calendar year in which they were discovered. Additional media notice applies when a breach affects more than 500 residents of a state or jurisdiction. A business associate must notify the clinic without unreasonable delay and no later than 60 days after discovery, although the BAA may require faster notice. See the HHS Breach Notification Rule guidance.

What HIPAA compliance records should the clinic retain

Keep required HIPAA documentation in written or electronic form, make it available to staff responsible for implementing the relevant procedures, and review it periodically. HIPAA generally requires Security Rule documentation to be retained for six years from its creation or the date it was last in effect, whichever is later. The Privacy Rule also has a six-year retention requirement for documentation it requires. See HHS’s Security Rule documentation requirements and HHS’s Privacy Rule summary.

• Risk analyses, risk-management actions, evaluations, and security incident records.
• Current and prior privacy and security policies, procedures, and NPPs.
• Training completion records, workforce access authorizations, and sanction documentation.
• Patient acknowledgments of the NPP or records of good-faith efforts when an acknowledgment was not obtained.
• Complaint logs, request decisions, required breach assessments, notification records, and corrective actions.
• BAAs, amendments, vendor reviews, and relevant audit-log review records.

The HIPAA six-year documentation requirement is not a general requirement to keep every medical record for six years. The Privacy Rule does not set a medical-record retention period; state law and other applicable requirements may govern how long the clinic retains patient records. See HHS guidance on medical-record retention.

In practice, a reliable HIPAA program connects risk analysis, patient privacy, workforce procedures, system safeguards, vendor oversight, incident response, and documentation. Review the checklist regularly and update it when the clinic’s care workflows, technology, or risks change.

FAQs.

How often should a conservative kidney management clinic conduct a security risk analysis?

HIPAA does not prescribe a fixed interval. Conduct the analysis as an ongoing process and update it when changes—such as a new system, vendor, workflow, or identified threat—could affect ePHI security. Set a review schedule suited to the clinic’s risks and document why updates are needed or completed. See HHS risk analysis guidance.

What must a HIPAA breach-response procedure include?

It should explain how staff report suspected incidents, who investigates, how the clinic contains and mitigates harm, how it assesses whether unsecured PHI was breached and whether notification is required, who makes and sends required notices, and how the clinic documents the incident and its outcome. The procedure should also identify how staff are trained and how violations are addressed. See the HHS Breach Notification Rule guidance.

When must a clinic notify patients of a reportable breach?

Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured PHI. Additional reporting to HHS—and, in some cases, media outlets—depends on the number of individuals affected and other applicable requirements. See HHS breach-notification deadlines.

Which vendors need a business associate agreement?

A vendor generally needs a BAA when it performs services for the clinic that involve creating, receiving, maintaining, or transmitting PHI on the clinic’s behalf. Examples can include EHR hosting, cloud storage, billing, transcription, and IT support with PHI access. A vendor that merely supplies software without PHI access may not be a business associate, so assess the specific service and access involved. See HHS business associate guidance.