HIPAA Compliance Checklist for Advance Directive Platform Companies

Use this checklist to assess how your advance directive platform creates, stores, shares, and protects health information. HIPAA obligations depend on your role and relationships: a company may be a business associate when it handles protected health information (PHI) on behalf of a covered entity, such as a healthcare provider. A company that does not meet the definition of a covered entity or business associate is not subject to the HIPAA Rules, though other laws may apply. Confirm your specific obligations with qualified legal and security professionals. HHS guidance on business associates and HHS guidance on covered entities explain the relevant roles.

Which vendors and subcontractors need business associate agreements?

Map every organization that creates, receives, maintains, or transmits PHI for your platform or its healthcare partners. If your company performs a covered function or service on behalf of a covered entity and handles PHI in doing so, it may be a business associate and generally needs a written business associate agreement (BAA) with that entity.

Review cloud hosting, analytics, customer-support, messaging, document-signing, backup, and other vendors based on what information they can access and the services they perform. A vendor that handles PHI on behalf of your company may be a subcontractor business associate; put the required downstream BAA in place before sharing PHI. A covered entity generally does not need to sign a separate BAA directly with your subcontractor. HHS business associate guidance describes these relationships and the required contractual assurances.

• List each vendor, the data it handles, its access, and the purpose of that access.
• Execute BAAs with applicable business associates and subcontractors, defining permitted uses, safeguards, incident reporting, and handling of PHI when the agreement ends.
• Reassess vendor access and agreements when your product, data flows, or service providers change.

How should role-based access controls protect patient records?

Build role-based access control around job duties, allowing each user to see or change only the records and functions needed for their work. Apply least-privilege access to clinical staff, administrators, support agents, and technical personnel; a role should not automatically grant access to every patient record.

Use unique user accounts, strong authentication, and documented approval for access. Review permissions periodically and promptly change or disable them when a person changes roles or leaves. Consider additional approval and logging for emergency access or actions that let staff view, export, alter, or delete directives. HIPAA requires technical access controls and user authentication; exact safeguards should be informed by your risk analysis. HHS’s Security Rule summary outlines access control and authentication requirements.

What safeguards secure protected health information in transit and at rest?

Identify where electronic protected health information (ePHI) is stored, transmitted, cached, downloaded, or backed up. Protect it with measures suited to the risks, such as encrypted network connections, secure storage, protected encryption keys, integrity checks, and controls that prevent unauthorized exports or sharing.

HIPAA treats encryption as an addressable implementation specification, not a universal, standalone mandate. Addressable does not mean optional: assess whether encryption is reasonable and appropriate; if it is not, document the determination and adopt an appropriate alternative when applicable. Apply the same risk-based discipline to ePHI at rest and in transit, and document your reasoning. HHS guidance on encryption explains how this specification works, while HHS risk-analysis guidance describes the role of risk analysis in security decisions.

Which audit logs should the platform maintain and review?

HIPAA requires audit controls: mechanisms to record and examine activity in systems that contain or use ePHI. The Rule does not prescribe one universal log format for every platform, so determine what information is needed to investigate risks and suspicious activity.

As a practical checklist, record who accessed a record, when they accessed it, and significant actions such as viewing, creating, editing, exporting, or deleting a directive. Include relevant administrative changes, permission changes, and security events. Protect logs from alteration, restrict access to them, and review them regularly for unusual access or activity. Document your audit-control decisions and follow up on findings. HHS’s Security Rule summary covers audit controls and the requirement to examine activity in information systems.

How should HIPAA authorizations be separated from treatment instructions?

Keep a HIPAA authorization for the use or disclosure of PHI distinct from an advance directive’s treatment instructions. They serve different purposes: the authorization addresses specified health-information uses or disclosures, while the directive communicates a person’s healthcare preferences. Do not treat signing one as automatically signing or changing the other.

Use a clearly labeled authorization workflow, separate from the process for drafting or updating clinical instructions. Make the authorization’s purpose and scope clear, and ensure it includes the elements required for a valid authorization. Provide a way to submit a written revocation and route it to the covered entity that relied on the authorization. Under HIPAA, revocation generally takes effect when that covered entity receives it, but it does not undo actions already taken in reliance on a valid authorization. HHS guidance on revoking an authorization explains these limits.

How should patients view, update, or revoke advance directives?

Offer a clear, secure way for patients to view and download their directives and to submit corrections or updates. Confirm identity before displaying or changing a record, preserve a history of changes, and make it clear which version is current. When appropriate, provide a process for communicating an updated directive to the relevant healthcare organization or authorized recipient.

Do not confuse changing an advance directive with revoking a HIPAA authorization. A patient’s right to access PHI in a designated record set generally belongs to the relationship with the covered entity. The covered entity remains responsible for meeting that obligation, while its BAA can require the platform to provide the information or support the process. The BAA can also address how the platform assists with amendment requests. HHS guidance on access to PHI held by a business associate describes these responsibilities.

What incident response, backup, and recovery procedures are required?

Maintain written incident response procedures to identify, respond to, contain, and mitigate security incidents, and document incidents and their outcomes. Your response plan should identify who investigates, how evidence and relevant logs are preserved, how affected systems are secured, and how the company coordinates with covered entities and subcontractors.

When a business associate discovers a breach of unsecured PHI, it must notify the covered entity without unreasonable delay and no later than 60 days after discovery; a BAA may set a shorter reporting deadline. The covered entity generally handles required notices to affected individuals and the government. Make sure your operational escalation process supports the applicable contract and legal deadlines. HHS’s Breach Notification Rule guidance explains the notification requirements.

Establish and implement contingency procedures for emergencies that affect systems containing ePHI. These include a data backup plan, a way to restore lost data, and procedures for continuing critical operations in emergency mode. Test recovery procedures and update them as your platform and risk assessment change. HHS’s Security Rule summary describes the contingency-plan requirements.

In practice, a strong HIPAA compliance checklist connects your platform’s role and vendor agreements to risk-based safeguards, limited access, usable audit records, clear patient workflows, and tested incident and recovery procedures.

FAQs

Does an advance directive platform company qualify as a HIPAA business associate?

It may qualify if it performs a service or function on behalf of a HIPAA covered entity and creates, receives, maintains, or transmits PHI in doing so. The answer depends on the company’s actual relationships and data handling, not simply on the fact that its product stores advance directives. HHS business associate guidance explains the definition.

When does a vendor need a business associate agreement?

A vendor generally needs a BAA when it is a business associate handling PHI for a covered entity, or a subcontractor handling PHI for another business associate. The agreement must establish permitted uses and disclosures and require appropriate safeguards and other applicable terms. Assess the vendor’s role and access before sharing PHI. HHS guidance on business associates and BAAs provides further detail.

Can a prototype store real protected health information?

There is no general HIPAA exemption just because a product is a prototype. If your company is acting as a business associate and the prototype creates, receives, maintains, or transmits ePHI for a covered entity, applicable safeguards and contractual requirements still matter. Use synthetic or properly de-identified data during testing when feasible, and do not introduce real PHI until you have assessed the relevant roles, agreements, risks, and protections. HHS risk-analysis guidance addresses identifying and assessing risks to ePHI.

How should patients revoke an advance directive authorization?

Provide a clear process for the patient to submit a written revocation and promptly route it to the covered entity that received or relied on the authorization. Under HIPAA, the revocation generally is not effective until that covered entity receives it, and it does not reverse actions already taken in reliance on the authorization. Revoking an authorization to disclose PHI is separate from changing an advance directive. HHS’s authorization-revocation guidance explains the rule.