HIPAA Compliance Checklist for an Acute Care for Elders Unit

An Acute Care for Elders (ACE) unit depends on timely communication among clinicians and support staff. This checklist can help you protect protected health information (PHI) while supporting coordinated care. Apply it with your organization’s privacy and security policies; it is not a substitute for a unit-specific risk assessment or legal advice.

How should role-based access and minimum necessary rules apply in an ACE unit?

Set access according to each workforce member’s job duties, care responsibilities, and authorized role. Role-based access controls should identify who needs access, which categories of PHI they need, and the circumstances in which access is appropriate. Review access when responsibilities change and remove it when no longer needed.

The HIPAA minimum necessary standard generally limits PHI uses, disclosures, and requests to what is reasonably needed for the purpose. However, it does not apply to disclosures to, or requests by, a health care provider for treatment. That treatment exception does not eliminate the need for appropriate internal role-based access policies. HHS guidance on the minimum necessary requirement explains both the exception and workforce access policies.

• Document approved access by role, including the PHI categories and systems each role may use.
• Use routine protocols for recurring non-treatment uses or disclosures, and a review process for non-routine requests when the minimum necessary standard applies.
• Provide a controlled emergency-access process so authorized clinicians can obtain needed ePHI during urgent care, then review emergency access afterward.
• Do not treat “minimum necessary” as a reason to delay or withhold PHI needed for treatment.

Which workforce roles need access to patient information?

Grant access to workforce members whose assigned duties require patient information, rather than to everyone who works on or near the unit. The appropriate scope depends on the role, the care provided, the systems used, and the organization’s policies.

• Treating clinicians: Physicians, nurses, and other authorized providers may access information needed to assess, treat, and coordinate a patient’s care.
• Clinical support staff: Therapists, pharmacists, social workers, care coordinators, and other team members may need access relevant to their responsibilities.
• Operational staff: Scheduling, registration, billing, and administrative staff should receive access appropriate to their functions, not unrestricted clinical access by default.
• IT and security personnel: System administrators and support staff should have access appropriate to their technical duties, with safeguards and review for any access to PHI.
• Trainees and temporary staff: Use supervision and authorized accounts, and limit access to what their assigned duties require.

Make access authorization, establishment, modification, and termination part of onboarding and role-change workflows. HIPAA’s Security Rule requires workforce security policies and procedures for appropriate ePHI access. 45 CFR § 164.308.

How should the interdisciplinary care team share PHI for treatment?

Support prompt, accurate communication among authorized team members when it is needed for treatment. Providers may share relevant patient information for treatment without applying the minimum necessary standard to that provider-to-provider disclosure; the team should still follow applicable privacy policies and use reasonable safeguards.

• Use approved clinical systems and communication channels for care coordination, handoffs, consultations, and discharge planning.
• Confirm the recipient and patient before sending messages, documents, images, or reports.
• Share information with workforce members involved in the patient’s care or otherwise authorized for their duties; avoid unnecessary access by people who are not involved.
• Discuss sensitive details in an appropriate location and keep conversations discreet in shared rooms, hallways, and other areas where others may overhear.
• Follow organizational procedures when communicating with family members, representatives, or other people outside the care team; do not assume that a person’s presence makes them an authorized recipient.

HHS guidance on disclosures for treatment, payment, and health care operations describes the treatment exception and the separate role-based access policies covered entities must maintain.

What electronic PHI security controls should the checklist cover?

Inventory the systems and devices that create, receive, maintain, or transmit electronic protected health information (ePHI), including electronic health records, mobile devices, workstations, and approved messaging tools. Select safeguards based on a documented assessment of risks to ePHI’s confidentiality, integrity, and availability. HHS guidance on risk analysis explains that the assessment should inform the organization’s risk-management measures.

• Access control: Use unique user IDs, assign appropriate access rights, and establish an emergency-access procedure. Do not share accounts or passwords.
• User authentication: Verify that users are who they claim to be before granting access. Apply the organization’s authentication policies to clinical and administrative systems.
• Audit controls: Use mechanisms that record and examine activity in systems containing or using ePHI. Ensure logs can help identify access, changes, exports, or other activity relevant to security review.
• Transmission security: Use approved channels to protect ePHI sent electronically. Confirm recipients and destinations, and evaluate encryption and other safeguards according to the organization’s risk assessment and policies.
• Integrity and availability: Protect information from improper alteration or destruction, and maintain backup and recovery procedures appropriate to the systems and risks.
• Account lifecycle: Establish, review, modify, and terminate user access promptly when duties change or employment ends.

The Security Rule sets standards for access control, audit controls, person or entity authentication, and transmission security; specific implementation choices should reflect applicable requirements and the organization’s risk analysis. See 45 CFR § 164.312 and the HHS Summary of the HIPAA Security Rule.

How can the unit protect paper records, workstations, and clinical spaces?

Use reasonable safeguards suited to the unit’s layout and care activities. In shared clinical spaces, privacy measures should reduce avoidable exposure without obstructing necessary care. HIPAA permits certain incidental disclosures when they arise from an otherwise permissible activity and the organization has applied reasonable safeguards and minimum necessary policies where applicable. HHS guidance on incidental uses and disclosures provides examples and explains this standard.

• Store paper charts and printed reports in controlled areas; do not leave them unattended where unauthorized people may view them.
• Collect printed materials promptly and dispose of PHI using approved secure disposal procedures.
• Position screens to limit viewing by visitors or passersby; lock or log off unattended workstations in accordance with unit policy.
• Limit access to staff-only clinical and records areas, and follow visitor-control procedures.
• Speak discreetly about patient details in shared rooms and public areas; use private spaces for conversations that can reasonably be moved.
• Review whiteboards, sign-in sheets, labels, and handoff materials for unnecessary visible patient details, and remove or secure them when no longer needed.
• Handle mobile devices and removable media under organizational policies for approved use, storage, transport, and disposal.

The Security Rule includes standards for facility access, workstation use and security, and device and media controls. See 45 CFR § 164.310. Practical steps such as screen positioning and prompt collection of printouts help implement safeguards appropriate to the unit’s environment.

How should staff monitor access and respond to security risks?

Assign responsibility for reviewing system activity and escalating concerns. Establish a regular process to examine audit logs, access reports, and security incidents records, with particular attention to unusual access patterns, inappropriate record viewing, and activity inconsistent with a user’s role.

• Define who reviews activity, how suspected issues are escalated, and how findings and corrective actions are documented.
• Train workforce members to recognize and promptly report lost devices, misdirected messages, suspicious login activity, and suspected inappropriate access or disclosure.
• When an incident is suspected, follow the organization’s response procedure to assess it, limit ongoing exposure where appropriate, preserve relevant information, and document the response and outcome.
• Refer potential PHI breaches to the designated privacy or security official for assessment under the organization’s procedures and applicable requirements.
• Reassess risks when systems, workflows, staffing, or the unit’s physical environment change, and address identified risks through the organization’s risk-management process.

The Security Rule requires regular review of information-system activity and procedures to respond to and document security incidents. See 45 CFR § 164.308. A consistent process for access review, reporting, response, and remediation helps the ACE unit protect PHI while keeping treatment-related communication timely.

FAQs.

Does the minimum necessary standard apply to provider disclosures for treatment?

No. The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment. Covered entities must still maintain role-based policies for workforce access to PHI. HHS guidance on the minimum necessary requirement explains this distinction.

Which members of an ACE care team may access patient information?

Workforce members may access information appropriate to their assigned duties and authorized role. This can include treating clinicians and relevant clinical support staff; operational, technical, temporary, and trainee access should be tailored to job responsibilities and organizational policy. A job title alone does not establish unrestricted access.

What electronic PHI activity should an ACE unit record and review?

HIPAA requires mechanisms to record and examine activity in information systems that contain or use ePHI, and regular procedures to review information-system activity. An ACE unit should use its risk assessment and policies to determine useful log details and review triggers, such as user access, changes, exports, failed login attempts, and emergency access. See 45 CFR § 164.312 and 45 CFR § 164.308.

How can an ACE unit reduce incidental disclosures in shared clinical spaces?

Use reasonable safeguards that fit the care environment: speak discreetly, move sensitive discussions to private areas when practical, position screens away from public view, secure paper records, and limit visible details on boards or printed materials. HIPAA does not require eliminating every incidental disclosure, but the underlying use or disclosure must be permitted and reasonable safeguards must be in place. HHS guidance on incidental uses and disclosures explains the rule.