HIPAA Compliance Checklist for Adult Severe Asthma Clinics

Adult severe asthma clinics use electronic protected health information (ePHI) across many parts of care, including electronic health records, pulmonary function testing, biologic therapy coordination, patient portals, telehealth, and referrals. This checklist helps you assess how your clinic protects that information under the HIPAA Security Rule and related requirements.

How to conduct and document an ePHI security risk analysis

Start with an inventory of where your clinic creates, receives, maintains, or transmits ePHI. Include clinical and administrative systems, connected devices and testing equipment, staff workstations, mobile devices, backups, email and messaging tools, and systems operated by vendors.

Then assess reasonably anticipated threats and vulnerabilities that could affect the confidentiality, integrity, or availability of that information. Consider risks such as unauthorized access, lost devices, phishing, ransomware, system outages, and inappropriate access by workforce members or vendors. The HHS guidance on HIPAA Security Rule risk analysis describes the scope and key elements of this process.

• Document the ePHI systems, locations, users, and data flows included in the analysis.
• Record relevant threats, vulnerabilities, existing safeguards, and the likelihood and potential impact of risks.
• Prioritize risks and create a risk-management plan that identifies actions, owners, and target dates.
• Keep evidence of decisions, including why particular safeguards or alternative measures are appropriate.

The risk analysis must be accurate, thorough, and documented, but HIPAA does not prescribe a particular format or a universal annual schedule. Treat it as an ongoing process: review it when the clinic changes systems or workflows, adds a vendor or new technology, or experiences a security incident. HHS explains that the appropriate review frequency depends on the organization and its circumstances.

Which administrative physical and technical safeguards should an asthma clinic implement

The HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards to protect ePHI. Select and maintain safeguards based on your risk analysis and the clinic’s environment. See the current requirements for administrative safeguards, physical safeguards, and technical safeguards.

• Administrative safeguards: Assign responsibility for security; manage workforce access; provide security awareness and training; review system activity; respond to incidents; maintain contingency plans; and evaluate safeguards periodically.
• Physical safeguards: Control physical access to rooms and equipment; set rules for workstation use and security; and manage devices and media that store ePHI, including their movement, reuse, and disposal.
• Technical safeguards: Use access controls, unique user identification, emergency access procedures, audit controls, authentication, integrity protections, and transmission security.

HIPAA labels some implementation specifications “addressable.” That does not mean you can ignore them: evaluate whether each is reasonable and appropriate for your clinic, implement it or an appropriate alternative when needed, and document your decision. For example, encryption is addressable under the current rule; HHS explains that a clinic must assess whether it is appropriate and document any alternative decision. HHS has proposed updates to the Security Rule, but its current Security Rule NPRM page states that the current rule remains in effect while rulemaking proceeds.

How to manage workforce access and apply the minimum necessary standard

Use role-based access controls to grant workforce members the ePHI they need for their assigned duties. Define roles for clinicians, nursing staff, medical assistants, billing staff, and administrative personnel; authorize access accordingly; and update or remove it promptly when a person’s role changes or their employment ends. Periodically review accounts and system activity for access that is no longer appropriate.

Apply the minimum necessary standard to uses, disclosures, and requests for PHI where it applies, such as many payment and health care operations activities. Set role-based policies and procedures that limit access or disclosure to what is reasonably needed for the purpose. The Privacy Rule does not apply the minimum necessary standard to disclosures to, or requests by, a health care provider for treatment purposes. That exception does not remove the need to manage workforce access appropriately. See HHS guidance on the minimum necessary requirement.

What HIPAA policies and security documentation should clinics maintain

Maintain written or electronic Security Rule policies and procedures, and keep records of required actions, activities, and assessments. Make documentation available to the workforce members responsible for carrying out the related procedures, and review and update it as needed when operational or environmental changes affect ePHI security. The Security Rule documentation requirements generally require covered entities to retain required Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later.

• Document the risk analysis, risk-management decisions, and follow-up actions.
• Maintain policies for access, workforce security, security training, incident response, contingency planning, and sanctions.
• Keep records of access reviews, system activity reviews, evaluations, training, and security incidents as applicable.
• Record the clinic’s decisions about addressable implementation specifications and any alternative safeguards.

Keep documents current and make sure staff can find the procedures they are expected to follow. The six-year period applies to required Security Rule documentation; it does not replace any longer retention period that may apply under state law or other requirements.

How to address business associate agreements and ePHI protections

Identify vendors and other organizations that create, receive, maintain, or transmit PHI on the clinic’s behalf, such as certain hosted record systems, billing services, or data-storage providers. When a vendor is a business associate, obtain a written business associate agreement (BAA) or other compliant written arrangement before allowing it to handle the clinic’s PHI.

The BAA should describe permitted uses and disclosures, require appropriate safeguards, address reporting of unauthorized uses or disclosures and security incidents, and set expectations for subcontractors and the return or destruction of PHI when the arrangement ends, where feasible. Review vendor access and the protections relevant to the ePHI the vendor handles. HHS provides sample business associate agreement provisions and explains the responsibilities of covered entities and business associates.

Set a clear reporting process in each BAA so the clinic learns promptly about incidents and can assess its obligations. A BAA may require the business associate to report sooner than the outer deadline provided by the Breach Notification Rule.

How to identify assess and respond to security incidents and breaches

Establish a process for workforce members to report suspected or known security incidents promptly. The clinic’s response should identify and investigate the incident, contain it where appropriate, mitigate harmful effects as practicable, preserve relevant evidence, document actions and outcomes, and assess whether ePHI was affected. Review the event afterward and update safeguards or procedures where needed.

A security incident is not automatically a reportable breach. If an impermissible use or disclosure of unsecured PHI occurs, it is generally presumed to be a breach unless the clinic demonstrates a low probability that the PHI was compromised through a documented risk assessment, or an exception applies. The assessment considers factors including the information involved, who received or accessed it, whether it was actually acquired or viewed, and steps taken to mitigate the risk. Follow the HIPAA breach notification rule and document the analysis and notification decisions.

For a reportable breach of unsecured PHI, notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The HIPAA breach notification rule also imposes additional reporting duties: breaches affecting 500 or more individuals must be reported to HHS within that timeframe, and breaches affecting more than 500 residents of a state or jurisdiction generally require notice to prominent media outlets serving that area. Breaches affecting fewer than 500 individuals may be reported to HHS annually, no later than 60 days after the end of the calendar year in which they were discovered.

In summary, an adult severe asthma clinic should maintain a documented, ongoing risk-management process; implement safeguards suited to its systems and workflows; limit workforce access appropriately; maintain current policies and records; oversee business associates; and be prepared to investigate incidents and meet breach-notification deadlines.

FAQs.

How often should an adult severe asthma clinic review its ePHI security risk analysis?

HIPAA does not set one universal annual schedule. The clinic should keep the analysis current as an ongoing process and review it when changes or events—such as new technology, a new vendor, workflow changes, or a security incident—may affect ePHI risks. The appropriate frequency depends on the clinic’s circumstances, as explained in HHS risk analysis guidance.

Does the minimum necessary standard apply to treatment disclosures between health care providers?

No. The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment purposes. The clinic should still manage workforce access under its role-based policies. See HHS guidance on the minimum necessary requirement.

What must a clinic do after discovering a potential breach of protected health information?

Promptly investigate and contain the event as appropriate, preserve relevant evidence, document the response, and determine whether unsecured PHI was involved and whether the event is a reportable breach. For an impermissible use or disclosure, document the required risk assessment and notification decision. If notification is required, notify affected individuals and the HHS Secretary—and, when applicable, the media—within the required timeframes.

When must affected individuals be notified of a reportable breach?

Notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. The clinic must also provide the required notices to HHS and, when applicable, the media. See the HHS Breach Notification Rule guidance.