HIPAA Compliance Checklist for AIDS Drug Assistance Programs

What protected and sensitive information do ADAP records contain?

AIDS Drug Assistance Program (ADAP) records may combine information about a person’s health with details used to determine program eligibility and arrange medication access. Depending on the program, files may include names and contact details, HIV status, prescriptions, provider or pharmacy information, income, insurance coverage, and state or territorial residency. HRSA identifies medication access, financial eligibility, and residency as aspects of ADAP administration; each program’s records and processes may differ. See HRSA’s ADAP overview.

Some of this information may be protected health information (PHI) when it is individually identifiable health information held or handled by a HIPAA-covered entity or its business associate. Other details, such as income or residency information, can still be sensitive personal information even if they are not PHI on their own. HIPAA applies to covered entities and business associates—not automatically to every organization or program that handles health information. Confirm the status of the ADAP and its parent organization before treating HIPAA as the only applicable privacy framework. See HHS guidance on covered entities and business associates.

As a practical starting point, inventory the information each ADAP activity collects, who can identify the client, where records are stored, and which staff or outside organizations receive them. Include paper files, electronic records, emails, and information shared with pharmacies, insurers, providers, or eligibility partners.

How should ADAPs obtain and document client authorization?

Before requesting an authorization for disclosure, identify what information needs to be shared, who will receive it, why it is needed, and whether a HIPAA permission or another law already allows the disclosure. When HIPAA requires an authorization, use clear language and explain the proposed disclosure to the client. An authorization is not a substitute for checking whether the program has authority to disclose the information under applicable state, territorial, or program-specific rules.

Document the completed authorization in the client’s record. Staff should be able to verify that it applies to the information, recipient, and purpose involved and that it has not expired or been revoked. Use a process for recording revocations and informing staff who handle disclosures. HIPAA specifies the required elements for a valid authorization; see HHS’s authorization requirements overview.

How can access to paper and electronic records be restricted?

Set access according to each person’s job duties, rather than giving every employee or contractor access to every client file. Role-based access control can help translate those duties into permissions—for example, allowing eligibility staff to access information needed for eligibility decisions while limiting access to unrelated records. Review access when a person changes roles or leaves the program.

For paper records, consider locked storage, restricted records areas, controlled key access, and procedures for checking files out and returning them. For electronic records, use individual accounts, authentication, audit logs, and permissions that limit users to approved records and functions. Secure workstations and devices, and protect information when it is transmitted. These are practical controls to consider; the HIPAA Security Rule calls for reasonable and appropriate administrative, physical, and technical safeguards for electronic PHI, based on the circumstances and risks. See HHS’s Security Rule summary and its guidance on physical safeguards.

Where HIPAA’s minimum necessary standard applies, limit internal use and most disclosures to the amount of PHI reasonably needed for the purpose. Establish routine access and disclosure rules, and review non-routine requests individually. The standard does not apply to certain situations, including disclosures to or requests by a health care provider for treatment and disclosures made pursuant to a valid individual authorization. See HHS guidance on the minimum necessary standard.

What should a release-of-information form include?

A release-of-information form intended to serve as a HIPAA authorization should identify the information to be disclosed, the person or organization allowed to disclose it, and the intended recipient. It should also state the purpose, include an expiration date or event, and be signed and dated by the client or an authorized personal representative. Use a specific description of the information rather than a broad permission to release any records.

Include the required statements about the client’s right to revoke the authorization in writing and whether treatment, payment, enrollment, or eligibility for benefits may be conditioned on signing it, as applicable. Explain how to submit a revocation and provide a copy of the completed form to the client. HIPAA requires an expiration date or event; a particular one-year term is not a universal federal rule. State law may impose additional or more restrictive requirements. See HHS’s authorization expiration guidance.

Adapt the form and workflow to applicable state or territorial law, the client’s circumstances, and the type of information involved. A form that meets HIPAA’s elements does not necessarily satisfy every other legal or program-specific requirement.

How should staff and contractor confidentiality be documented?

Maintain written privacy and security policies that explain how staff may access, use, discuss, store, and disclose client information. Keep records showing that applicable staff received role-appropriate training and acknowledged the program’s confidentiality expectations. HIPAA-covered entities must train workforce members as necessary and appropriate for their duties and apply appropriate sanctions for violations; the rule does not turn a training-completion certificate into proof that an organization is compliant. See HHS’s HIPAA Privacy Rule summary.

A confidentiality agreement can make expectations and consequences clear, but it does not replace training, access controls, or compliance with applicable law. For an outside contractor, first determine whether the contractor handles PHI on behalf of a HIPAA-covered entity. If the contractor is a business associate, the covered entity generally needs a written HIPAA business associate agreement (BAA) that sets permitted uses and disclosures, safeguards, and related obligations. Not every contractor qualifies as a business associate, and a BAA is not a client authorization. See HHS guidance on business associates.

Document relevant agreements, training, access approvals, and any required follow-up. Apply the program’s own policies and any additional grant, contract, state, or territorial requirements to employees, volunteers, and contractors.

When may ADAPs share client information for program operations?

When HIPAA applies, it permits covered entities to use or disclose PHI without an individual’s authorization for certain purposes, including treatment, payment, and health care operations, subject to the rule’s conditions. But a program should not assume that every eligibility check, medication coordination task, or data exchange qualifies. Assess the purpose, the parties’ roles, and the specific HIPAA permission or other legal authority for each sharing arrangement.

Care coordination between health care providers may fall within treatment, for which HIPAA does not apply the minimum necessary standard. Eligibility or coverage verification may involve payment or another permitted purpose depending on the arrangement. Where the minimum necessary standard does apply, disclose only what is reasonably needed for the task. Keep a record of the purpose, recipient, information shared, and authority relied on when required by policy or applicable law. See HHS’s summary of permitted HIPAA uses and disclosures and its minimum necessary guidance.

If a disclosure is not otherwise permitted under HIPAA, a valid authorization may be needed. A program should also check whether state or territorial HIV-confidentiality laws, agreements with partners, or other applicable rules impose additional limits. When sharing information with a service provider that handles PHI on behalf of a covered entity, determine whether a HIPAA business associate agreement is required before sharing.

What compliance limitations should ADAPs consider?

HIPAA is not a complete privacy checklist for every ADAP. Its requirements depend on whether the relevant organization is a covered entity or business associate and on the activity at issue. Even when HIPAA does not apply, HIV-related information may be protected by state or territorial law, program policies, grant conditions, or agreements with data recipients. CDC’s data-security guidance for public health programs also provides principles for protecting and appropriately sharing identifiable data; assess whether it applies to the program. See CDC’s Data Security and Confidentiality resources.

Before adopting a form, access policy, or sharing workflow, confirm current requirements with the organization responsible for the ADAP and qualified legal or privacy staff. A single template cannot resolve differences in program structure, jurisdiction, recipient roles, or the purpose of a disclosure.

In short: identify sensitive records, restrict access by role, document authorization and confidentiality practices, and verify the legal basis for each disclosure. Apply HIPAA where it governs, while checking for stricter or additional requirements that may apply to the ADAP.

FAQs.

What client information in ADAP records may be protected health information?

Identifiable information about HIV status, medications, prescriptions, providers, or care may be PHI when held or handled by a HIPAA-covered entity or its business associate. ADAP files may also contain income, residency, insurance, and contact information. Those details may be sensitive, but they are not automatically PHI in every setting. HIPAA coverage depends on the organization’s status and the information involved.

How long should an ADAP release-of-information authorization remain valid?

HIPAA requires a valid authorization to include an expiration date or an expiration event related to the individual or purpose. It does not establish one universal one-year term. Choose a clear end date or event that fits the disclosure, and check state or territorial law for stricter requirements. An authorization may also be revoked in writing before it expires.

Who should be allowed to access ADAP client records?

Access should be limited to staff and other authorized users who need particular information to perform their assigned duties. Use job-based permissions, protect paper and electronic records, and update access when responsibilities change. Where HIPAA applies, access policies must reflect workforce roles and the information needed for those roles.

When may an ADAP share information for eligibility verification or care coordination?

It depends on the purpose, the organizations involved, and the laws that apply. HIPAA may permit certain disclosures for treatment, payment, or health care operations without authorization, but not every eligibility check or coordination activity automatically fits those categories. Verify the legal basis, limit information where the minimum necessary standard applies, and obtain a valid authorization when required.