HIPAA Compliance Checklist for a Therapeutic Apheresis Unit

A therapeutic apheresis unit may handle health information across clinical care, blood-component processing, laboratory coordination, scheduling, billing, and equipment support. Use this checklist to identify where electronic protected health information (ePHI) flows and to review the safeguards that apply to your organization. HIPAA obligations depend on whether the unit’s organization is a covered entity or business associate, and how it handles protected health information (PHI).

How to map ePHI across apheresis and cell-processing workflows

Start with the patient information used to identify, assess, treat, and follow up with each person receiving apheresis. Information is ePHI when it is individually identifiable health information that is created, received, maintained, or transmitted electronically by a covered entity or business associate.

Trace the information through the full workflow—from referral and scheduling to treatment, documentation, billing, and retention. HHS says a risk analysis should identify where ePHI is stored, received, maintained, or transmitted and document the data collected.

• Patient intake and care: Check registration and scheduling systems, referrals, consent records, electronic health records, clinical notes, orders, and treatment plans.
• Apheresis and cell processing: Review treatment documentation, procedure logs, machine or device exports, collection and processing records, labels, and records linking a product or procedure to a patient.
• Laboratory and care coordination: Identify laboratory systems, specimen or product tracking, result interfaces, secure messaging, and transfers to referring clinicians or other providers.
• Operations and storage: Include billing and claims, email, scanned documents, mobile devices, shared drives, removable media, backups, cloud services, and vendor-maintained systems.
• Paper-to-electronic transitions: Note when paper documents are scanned, transcribed, photographed, or entered into an electronic system.

Not every machine log, label, or operational record is ePHI. Determine whether it contains or can be linked to identifiable patient health information, and document systems that are out of scope with a clear reason. Use interviews, system inventories, interface diagrams, and vendor records to find data flows that may not be obvious from the unit’s main clinical software. HHS risk analysis guidance explains the need to identify and document where ePHI is located and how it moves.

How to conduct and document a HIPAA risk analysis

The HIPAA Security Rule requires an accurate and thorough assessment of risks and vulnerabilities affecting the confidentiality, integrity, and availability of ePHI. Risk analysis identifies and evaluates risks; risk management means implementing measures to reduce them to a reasonable and appropriate level. HHS explains the distinction between risk analysis and risk management.

• Define the scope: Include all systems, devices, locations, workforce members, and vendors that create, receive, maintain, or transmit the unit’s ePHI.
• Identify threats and vulnerabilities: Consider misdirected communications, inappropriate access, lost devices, compromised accounts, system outages, damaged records, and disruptions to connected systems.
• Assess current safeguards: Record what controls exist, whether they are configured and used effectively, and any gaps.
• Rate likelihood and impact: Assess how likely each threat is and the potential effect on confidentiality, integrity, and availability, including disruption to clinical operations.
• Document remediation: Assign each risk an owner, planned action, priority, target date, and status. Record accepted residual risks and the rationale.
• Keep supporting evidence: Retain the system inventory, data-flow information, assessment method, findings, decisions, and follow-up records.

HIPAA does not set a universal annual schedule for repeating the risk analysis. HHS describes it as an ongoing process: review and update it as needed, including when new technology or workflows are introduced, operations change, or an incident reveals a new risk. The frequency depends on the organization’s environment and circumstances. HHS guidance on risk analysis discusses ongoing review and notes that the Security Rule does not specify a fixed frequency.

Which safeguards should the unit verify during a compliance review

Review administrative, physical, and technical safeguards together. The Security Rule requires reasonable and appropriate protections for ePHI; the unit should be able to show both what safeguards are in place and how it evaluates whether they address identified risks.

• Administrative safeguards: Confirm assigned security responsibility, workforce procedures, security awareness and training, sanction procedures, incident response processes, and periodic evaluation of safeguards.
• Physical safeguards: Check facility access, visitor controls, workstation placement and security, device and media handling, and secure disposal or reuse of media.
• Technical safeguards: Review unique user identification, emergency access procedures, system activity logging and review, authentication, protection against improper alteration or destruction, and transmission security.
• Encryption decisions: Assess encryption for stored and transmitted ePHI. HIPAA treats encryption implementation specifications as “addressable,” not a blanket instruction to encrypt every system in the same way. The organization must assess whether the specification is reasonable and appropriate and document its decision and any equivalent alternative measures.
• Evidence and follow-through: Check that policies, access reviews, training records, incident documentation, testing, and corrective actions are current and consistent with actual practice.

For an apheresis unit, also examine shared workstations near treatment areas, unattended sessions, portable devices used during procedures, printed labels and logs, service access to equipment, and interfaces between treatment systems and the electronic health record. HHS describes the Security Rule’s general compliance approach, and its guidance on physical safeguards covers facility access, workstations, and device and media controls.

How to apply role-based access and the minimum necessary standard

Use role-based access control (RBAC) to align system permissions with job duties, but do not treat the term as a specific HIPAA-mandated technology. HIPAA requires policies that limit workforce access according to role and requires technical access controls that permit access only to users or software with granted rights.

• Define access by role—for example, apheresis clinician, processing staff, laboratory staff, scheduler, billing personnel, and system administrator.
• Specify which patient information and functions each role needs, such as viewing treatment records, entering procedure data, or managing accounts.
• Use individual accounts rather than shared credentials where feasible, and promptly update or remove access when duties change or a person leaves.
• Review elevated, temporary, and emergency access; document the reason, approval, scope, and any required follow-up.
• Review access logs and investigate unusual access patterns in accordance with the unit’s policies and risk assessment.

The Privacy Rule’s minimum necessary standard generally calls for reasonable efforts to limit PHI used, disclosed, or requested to what is needed for the purpose. It does not apply to disclosures to or requests by a health care provider for treatment, among other exceptions. For internal use, covered entities must establish role-based policies that identify who needs access, to which categories of information, and under what conditions. HHS minimum necessary guidance describes the standard and its exceptions, while its Privacy Rule summary explains role-based policies for internal access.

How to manage business associates and third-party risks

Make an inventory of third parties that may handle PHI on the unit’s behalf. Depending on the services used, this may include cloud hosting, electronic record support, data storage, billing, transcription, equipment maintenance, or technical support. A vendor is not automatically a business associate just because it provides a service; consider whether it performs a function or service for the covered entity that involves creating, receiving, maintaining, or transmitting PHI.

• Determine and document whether each vendor is a business associate, a subcontractor, or another type of recipient.
• Where required, execute a business associate agreement (BAA) before the vendor handles PHI on the organization’s behalf.
• Check that the BAA defines permitted uses and disclosures, requires appropriate safeguards, addresses reporting of incidents, and covers return or destruction of PHI when the relationship ends where feasible.
• Confirm that business associates obtain appropriate agreements from subcontractors that handle PHI for them.
• Review vendor access, security practices, incident contacts, data return and deletion processes, and contract changes periodically and when services change.

A BAA does not replace the unit’s own risk analysis or oversight. HHS explains that business associates and their subcontractors may have direct Security Rule obligations, and that a covered entity generally needs written assurances when a business associate handles ePHI on its behalf. Disclosures to another health care provider for treatment are an example of a situation that does not require a BAA. HHS business associate guidance describes the definition, contract requirements, and exceptions.

What patient notices and authorizations are required

Confirm that the covered entity responsible for the unit’s care provides its Notice of Privacy Practices (NPP) as required. A covered health care provider with a direct treatment relationship generally provides the notice by the first service and makes a good faith effort to obtain written acknowledgment of receipt, except in an emergency treatment situation. The acknowledgment confirms receipt; it is not patient authorization for other uses or disclosures.

The NPP should explain how the organization may use and disclose PHI, patient privacy rights, the organization’s legal duties, and how patients can ask questions or make a complaint. Keep the current notice available, provide it on request, post it on the organization’s relevant website when required, and revise it when material privacy practices change. HHS NPP guidance describes these requirements.

HIPAA generally allows PHI to be used or disclosed for treatment, payment, and health care operations without a separate authorization, subject to the Privacy Rule’s requirements. Written authorization is generally needed when a use or disclosure is not otherwise permitted or required by the Privacy Rule—for example, many marketing uses and disclosures of psychotherapy notes, which have limited exceptions. Research disclosures may also require authorization unless another permitted pathway applies. Follow the covered entity’s process to verify that an authorization is valid, covers the intended information and recipient, and has not been revoked. HHS’s Privacy Rule summary explains permitted uses and disclosures and authorization requirements.

Do not treat a general treatment consent as a HIPAA authorization. HIPAA permits—but does not generally require—a covered entity to obtain consent for routine treatment, payment, and health care operations uses and disclosures. Apply more protective state law or organization policy when it governs the information or workflow.

How to prepare for incidents and maintain contingency procedures

Keep a written process for reporting, triaging, containing, and documenting suspected security incidents. Staff should know whom to contact if a device goes missing, a patient record is sent to the wrong recipient, an account is compromised, or a system used for patient care becomes unavailable.

• Define how staff report incidents and who leads investigation, technical response, privacy review, and operational decisions.
• Document the incident, affected systems and information, containment steps, mitigation, investigation results, and follow-up actions.
• Use a breach-assessment and notification process that considers the facts of the event and applicable HIPAA requirements; preserve records supporting the determination and any notifications.
• Maintain retrievable data backup and procedures to restore ePHI after data loss.
• Establish emergency-mode procedures so critical business processes can continue while protecting ePHI during an outage or other disruption.
• Test and revise contingency procedures periodically, including downtime access, communications, recovery, and reconciliation of records entered during downtime.

The HIPAA Security Rule’s contingency planning standard includes required data backup, disaster recovery, and emergency mode operation plans; testing and revision procedures are addressable implementation specifications. Adapt the plans to the unit’s clinical and information-system dependencies, and coordinate them with the organization’s broader downtime and continuity procedures. The HHS audit protocol and the HHS Breach Notification Rule guidance provide references for evaluating safeguards and incident documentation.

In summary, a reliable compliance review connects the unit’s ePHI inventory to documented risks, appropriate safeguards, controlled access, vendor agreements, patient privacy processes, and tested incident and contingency procedures.

FAQs

Which systems in a therapeutic apheresis unit may contain ePHI?

Potential examples include scheduling and registration systems, electronic health records, treatment and processing documentation, laboratory and product-tracking systems, device exports, billing and claims platforms, secure messaging, email, mobile devices, scanned records, backups, and vendor-hosted applications. A system contains ePHI when it holds or transmits individually identifiable health information electronically; assess each system and its links to patient identity rather than assuming every device log or operational record is ePHI.

How often should the unit review its HIPAA risk analysis?

HIPAA does not prescribe one fixed interval, such as an annual review, for every organization. Treat the risk analysis as ongoing, revisit it when risks or operations change, and document updates—for example, after a security incident or before introducing a new system or workflow. HHS guidance says frequency depends on the organization’s circumstances.

When does a vendor handling patient information need a business associate agreement?

A BAA is generally required when a vendor performs a function or service for a covered entity involving the creation, receipt, maintenance, or transmission of PHI on the entity’s behalf. The agreement should be in place before the vendor handles PHI and should address permitted uses, safeguards, incident reporting, and other required terms. Some disclosures, such as sharing PHI with another health care provider for treatment, do not require a BAA. HHS business associate guidance describes the definition and exceptions.

When is written patient authorization required for disclosure of protected health information?

Written authorization is generally required when a use or disclosure is not otherwise permitted or required by the Privacy Rule. Examples include many marketing uses and most uses or disclosures of psychotherapy notes, subject to limited exceptions. Other disclosures, including many for treatment, payment, and health care operations, may be permitted without authorization when HIPAA’s requirements are met. HHS’s Privacy Rule summary explains the authorization rules and permitted disclosures.