HIPAA Compliance Checklist for Allergen Immunotherapy Compounding Practices

Allergen immunotherapy practices handle two related but distinct responsibilities: protecting patient information and preparing prescription sets safely. Use this checklist to review your privacy and security practices alongside your compounding procedures. HIPAA applies to covered entities and business associates; a health care provider is generally a covered entity if it conducts certain transactions electronically. See HHS guidance on covered entities.

Which immunotherapy records contain protected health information?

Protected health information (PHI) is individually identifiable information about a person’s health, care, or payment for care that a covered entity or business associate holds or transmits. It can be electronic, paper, or spoken information—not just entries in an electronic health record. HHS explains what information HIPAA protects.

Shot records and compounding logs contain PHI when they identify a patient and relate to their treatment. Examples include a patient’s name or identifier alongside an injection date, dose, reaction, allergen profile, prescription set, vial label, or treatment note. A log that records only non-identifying operational information may not be PHI, but assess the information in context and consider whether it could reasonably identify a patient.

Protect paper and electronic schedules, intake and consent forms, prescriptions, billing records, temperature or administration records linked to a patient, and communications about treatment. Keep patient names and vial labels from being visible to people who do not need them, and avoid discussing identifiable treatment details where others can overhear.

How should practices control access and disclosures?

Set access according to job duties. For example, a compounding team member may need the prescription and relevant allergy information to prepare a patient-specific set, while a billing employee may need billing details but not access to compounding notes. HIPAA’s minimum necessary standard generally requires reasonable steps to limit PHI uses, disclosures, and requests to what is needed for the purpose.

The minimum necessary standard does not apply to disclosures to or requests by a health care provider for treatment, among other exceptions. It still makes sense to define appropriate access so staff can do their work without exposing information unnecessarily. For routine disclosures, establish procedures; review unusual requests individually and verify the recipient and permitted purpose.

Before using a vendor that creates, receives, maintains, or transmits electronic PHI on the practice’s behalf, determine whether it is a business associate and put the required written agreement in place. Secure paper files, use private communication channels, verify fax or email recipients, and follow the practice’s procedures for incidents and misdirected information.

What staff privacy training and authorizations are needed?

Train workforce members on the practice’s privacy policies in a way that fits their duties, and document that training. HIPAA requires training for new workforce members within a reasonable period after they join and for affected staff after a material policy change; it does not establish a universal annual HIPAA certificate-renewal requirement. See 45 CFR § 164.530. Staff should also know how to report suspected privacy incidents and whom to contact with questions.

Clinical consent for allergen immunotherapy and a HIPAA authorization serve different purposes. Clinical consent documents a patient’s agreement to care and supports informed decision-making; a HIPAA authorization permits specified uses or disclosures of PHI when the Privacy Rule requires one. Routine treatment, payment, and health care operations generally do not require a HIPAA authorization, though other laws or circumstances may impose additional requirements. HHS explains the difference between consent and authorization.

When an authorization is required, use a valid document that identifies the information, the person or entity permitted to disclose it, the recipient, and the purpose or expiration as applicable. Do not treat a general clinical consent form as a substitute unless it also meets HIPAA’s authorization requirements.

Which electronic safeguards protect immunotherapy records?

Protect electronic protected health information (ePHI) through safeguards chosen to address your practice’s risks. Start with a documented risk analysis, then assign a security official, restrict system and file access by role, use unique user accounts, and promptly change access when someone’s job changes or they leave.

Use safeguards such as strong authentication, automatic screen locking, secure transmission, encryption where appropriate, audit logging, and reliable backups. These are practical protections to evaluate as part of a risk-based program; HIPAA requires appropriate safeguards, not one identical technology setup for every practice. The HHS Security Rule summary describes requirements for risk management, access controls, audit review, security incidents, and contingency planning.

Document how staff report suspected phishing, lost devices, unauthorized access, or other security incidents. Review system activity and safeguards periodically, and make sure vendors handling ePHI have appropriate agreements and protections.

What compounding records and procedures should be maintained?

Keep the compounding documentation required for your practice’s applicable standards and state rules. For allergenic extract prescription sets, USP General Chapter <797> Section 21 applies when the process uses sterile needles and syringes to transfer conventionally manufactured sterile allergen products and appropriate sterile added substances, with manipulations limited to penetrating vial stoppers and transferring sterile liquids into sterile vials. Other processes may be subject to the broader requirements of the chapter. See the USP <797> FAQs and FDA guidance on mixing, diluting, or repackaging biological products. Confirm applicable state requirements as well.

Maintain written or electronic standard operating procedures (SOPs) describing the compounding process, along with personnel training and competency records, relevant certification reports for a primary engineering control (PEC), refrigerator temperature logs, complaint and adverse-event information, investigations, and corrective actions.

For each patient-specific prescription set, maintain a compounding record that identifies each component’s name, concentration, volume, manufacturer or vendor, lot number, and expiration date; the preparation date and time; an internal identification number; the people who compounded and verified the set; the quantity prepared; the assigned beyond-use date (BUD) and storage requirements; and quality-check results. The USP Section 21 excerpt lists documentation elements and competencies. Keep patient-identifying records secure because those records may also be PHI.

How should the allergen extract compounding area be controlled?

For qualifying allergenic extract prescription sets, compounding must take place in an ISO Class 5 PEC or a dedicated allergen extract compounding area (AECA). Position the PEC or AECA away from unsealed windows, exterior doors, busy traffic, and environmental challenges such as restrooms, warehouses, or food preparation areas. Keep the PEC or AECA work surface at least one meter from a sink. If you use a PEC, it must be certified at least every six months.

Mark an AECA’s visible perimeter, restrict access during compounding to authorized personnel, and do not conduct unrelated activities in the area while compounding is underway. The area must have cleanable surfaces, and carpeting is not allowed. See the USP Section 21 facility requirements.

Follow written cleaning procedures. Clean and disinfect the PEC’s interior surfaces or the AECA work surfaces used for direct compounding each day of use and when contamination is known or suspected. Apply sterile 70% isopropyl alcohol to the horizontal work surface between prescription sets, and wipe sterile ingredient vial stoppers with sterile 70% isopropyl alcohol, allowing them to dry before use. Follow the applicable cleaning schedule for other AECA surfaces.

What competency, labeling, and dating requirements apply?

Before independently compounding, personnel need training and must demonstrate knowledge and skill in the applicable procedures. For allergenic extract compounding, USP Section 21 includes written or electronic knowledge testing, initial gloved fingertip and thumb sampling on both hands on three separate occasions, and recurring competency assessments. Personnel must complete fingertip and thumb sampling and media-fill testing at least every 12 months; if they fail an assessment, they must pass reevaluation in the deficient area before resuming compounding. A person who has not compounded a prescription set in more than six months must be evaluated in all core competencies before returning to compounding duties. Document training, evaluations, failures, and corrective actions. See the AAAAI competency guidance and the USP Section 21 excerpt.

Each vial’s label must prominently and understandably display the patient’s name, the type and fractional dilution for each vial with its corresponding vial number, the BUD, and storage conditions. Check that the label matches the compounding record and patient-specific prescription.

The BUD for an allergenic extract prescription set must not be later than the earliest expiration date of any extract or diluent in the set, and it cannot exceed one year from the date the set was mixed or diluted. The one-year limit is a maximum, not an automatic BUD: assign an earlier date when required by a component expiration date or applicable instructions. See the FDA guidance for allergenic extract prescription sets.

In summary, protect patient-specific records with role-appropriate privacy and security safeguards, while maintaining separate, documented controls for compounding, competency, labeling, and dating. Confirm that your procedures also meet applicable state requirements.

FAQs

Do shot records and compounding logs contain protected health information?

They do when they identify a patient and relate to the person’s health or care. A patient-linked injection record, dose, reaction, prescription set, or vial log is generally PHI when maintained or transmitted by a covered entity or business associate. A log with no patient identifiers may not be PHI, depending on whether the information could reasonably identify someone.

Should clinical consent for immunotherapy be separate from a HIPAA authorization?

They address different matters. Clinical consent concerns the patient’s agreement to treatment; a HIPAA authorization permits particular PHI uses or disclosures when required by the Privacy Rule. Routine treatment, payment, and health care operations generally do not require a HIPAA authorization. If one is needed, ensure the document meets HIPAA’s specific requirements rather than assuming clinical consent is sufficient.

How often should compounding competency be reassessed?

For allergenic extract compounding under USP Section 21, key competency checks, including gloved fingertip and thumb sampling and media-fill testing, are required at least every 12 months. Personnel who have not compounded a prescription set for more than six months must be evaluated in all core competencies before resuming. Document the results and any corrective training.

What is the maximum beyond-use date for a compounded allergen extract vial?

The BUD cannot exceed one year from the date the patient-specific prescription set was mixed or diluted, and it must be no later than the earliest expiration date of any extract or diluent in the set. The appropriate BUD may therefore be shorter than one year.