HIPAA Compliance Checklist for Angelman Syndrome Clinics

Angelman syndrome care may involve several specialties, such as neurology, genetics, developmental medicine, rehabilitation, and speech therapy. When coordinating care, clinics need to protect patient information while making it available to authorized members of the care team and patients’ representatives.

Use this checklist to review key HIPAA privacy and security practices. First confirm whether your clinic is a HIPAA covered entity; the Rules apply to covered entities and business associates, rather than automatically to every organization that handles health information. A covered clinic should apply the requirements relevant to its operations and document how it protects protected health information (PHI), including HHS guidance on covered entities and business associates.

How should clinics assess HIPAA risks to electronic protected health information?

The HIPAA Security Rule requires an accurate and thorough risk analysis of potential threats and vulnerabilities to the confidentiality, integrity, and availability of all electronic protected health information (ePHI) the clinic creates, receives, maintains, or transmits. There is no required federal template or single method; the analysis should fit the clinic’s size, systems, and operations. See HHS guidance on the HIPAA Security Rule risk analysis.

Start by mapping where ePHI is stored or sent. For an Angelman syndrome clinic, that may include electronic health records, genetic and laboratory results, seizure and sleep records, therapy notes, patient portals, telehealth platforms, billing systems, mobile devices, backups, and information shared with other care providers.

• List the systems, devices, locations, workforce roles, and vendors that create, receive, maintain, or transmit ePHI.
• Identify reasonably anticipated risks, such as stolen devices, misdirected referrals, unauthorized account access, ransomware, accidental deletion, or service outages.
• Assess existing safeguards, the likelihood of each risk, and its potential impact on confidentiality, integrity, and availability.
• Document identified risks, planned safeguards, responsible owners, completion dates, and any remaining risks the clinic is managing.

Risk analysis is ongoing. HIPAA does not set one universal interval for repeating the full analysis. Review it when significant changes—such as a new system or vendor, a security incident, or changes in clinic operations—could affect ePHI protection, and set a review schedule suited to the clinic. HHS explains that risk analysis frequency depends on the organization and its environment.

Which administrative, physical, and technical safeguards should be documented?

The Security Rule calls for reasonable and appropriate administrative, physical, and technical safeguards to protect ePHI. Document the safeguards the clinic selects, how they are used, and how they address the risks identified in the analysis. HHS summarizes the safeguard standards in its HIPAA Security Rule overview.

Administrative safeguards

• Assign responsibility for security and maintain written security policies and procedures.
• Document workforce authorization, supervision, access management, security training, and incident response processes.
• Maintain a contingency plan that includes a data backup plan, disaster recovery plan, and emergency mode operation plan so the clinic can restore ePHI and continue critical operations.
• Periodically evaluate whether security measures remain appropriate and update documentation when changes affect ePHI security.

Physical safeguards

• Control access to facilities and rooms where systems containing ePHI are located.
• Set rules for using and securing workstations, including screens visible to patients or visitors.
• Track devices and media that contain ePHI, and document their secure movement, reuse, and disposal.

Technical safeguards

• Use access controls that allow only authorized users to access ePHI, along with unique user identification and authentication procedures.
• Implement audit controls to record and examine activity in systems containing ePHI.
• Protect ePHI against improper alteration or destruction and secure it during electronic transmission.
• Assess encryption and other safeguards in light of the clinic’s risks and document the decisions made.

Some Security Rule implementation specifications are designated “addressable,” but that does not make them optional. If an addressable specification is not reasonable and appropriate for the clinic, document why and adopt an appropriate alternative measure when needed to meet the standard. HHS explains this distinction in its Security Rule overview.

How can clinics manage workforce training, policies, and sanctions?

Written policies should explain how staff protect PHI in daily work: using secure messaging, verifying recipients, handling printed records, discussing care discreetly, reporting suspected incidents, and escalating privacy questions. Tailor procedures to each role, including clinicians, therapists, administrative staff, trainees, and relevant volunteers or contractors.

Train workforce members on the privacy and security procedures they need for their duties. Document training and provide it to new workforce members within a reasonable period and when a material policy change affects their work. HIPAA does not establish a universal annual training-certificate renewal deadline; training should follow applicable requirements and the clinic’s documented policies. See HHS’s summary of the HIPAA Privacy Rule training and sanctions requirements.

Adopt and apply appropriate sanctions when workforce members violate privacy policies or procedures. Maintain a consistent process for investigating concerns, recording findings, and taking corrective action. Make sure staff know how to report a suspected privacy or security incident promptly, without trying to investigate beyond their assigned responsibilities.

What access controls protect records across multidisciplinary Angelman syndrome care?

Use role-based permissions so workforce members can access the information needed for their job duties. A neurologist, therapist, and billing employee may each need different access. Review permissions when staff join, change roles, or leave, and disable accounts promptly when access is no longer needed.

Use audit controls to record and review access to ePHI. Establish a process for investigating unusual access, such as records viewed without a care-related reason or repeated access outside normal duties. Make sure staff use individual accounts rather than shared credentials so activity can be attributed to the appropriate user.

The minimum necessary standard generally limits uses, disclosures, and requests for PHI to what is reasonably needed for the intended purpose. However, it does not apply to disclosures to or requests by a health care provider for treatment purposes. Clinics can support timely care coordination among authorized providers while still using role-based internal access and appropriate safeguards. See HHS guidance on the minimum necessary standard.

For caregiver or family access, verify the person’s authority and document any permissions or restrictions. For minor patients, parents are generally personal representatives, but applicable law and HIPAA exceptions can affect access in particular circumstances. See HHS guidance on parents’ access to children’s medical records.

How should clinics oversee vendors and business associate agreements?

Determine whether a vendor is acting as a business associate before allowing it to create, receive, maintain, or transmit PHI on the clinic’s behalf. Examples can include certain cloud, EHR, billing, transcription, patient-portal, and IT support vendors. A health care provider receiving PHI to treat a patient is generally not a business associate merely because the clinic shares records for treatment.

Before a business associate handles PHI, put a written business associate agreement (BAA) in place. The BAA should define permitted and required uses and disclosures, require safeguards, address incident and breach reporting, and require applicable subcontractors to accept appropriate protections. It should also address support for patient access and other Privacy Rule obligations, access to relevant records for HHS, and return or destruction of PHI when the agreement ends if feasible. HHS lists these requirements in its sample business associate agreement provisions.

Keep an inventory of vendors that handle PHI, copies of current agreements, and a process to review material service or access changes. If the clinic learns of a material breach or violation by a business associate, take reasonable steps to address it and terminate the arrangement if the problem cannot be resolved and termination is feasible.

How can patients access their health information while privacy is protected?

Give patients a clear way to request access to PHI in their designated record set, including records held by a business associate on the clinic’s behalf. Verify the requester’s identity and, when someone acts for the patient, verify that person’s authority. Protect the information during delivery and provide access in the form and format required by HIPAA when readily producible.

A covered entity generally must act on an access request within 30 calendar days. If it cannot meet that deadline, it may take one additional 30-day period if it provides the patient, within the initial period, a written explanation and the date by which it will respond. Delays in obtaining records from a vendor count against the clinic’s response time. See HHS guidance on access-request timelines.

For pediatric patients, check applicable state law and HIPAA rules before responding to a parent or other representative. Document decisions and any limits on the representative’s authority rather than assuming that every family member is entitled to the same information.

What steps and deadlines apply to breach assessment and notification?

Maintain a written incident-response process that tells staff how to report suspected loss, unauthorized access, misdirected information, or system compromise. The clinic should secure affected systems, preserve relevant evidence, limit further exposure, and document the investigation and mitigation steps.

An impermissible use or disclosure of PHI is generally presumed to be a breach unless an exception applies or the clinic documents a low probability that the PHI was compromised through a risk assessment. That assessment considers the nature and extent of the PHI, who received or used it, whether it was actually acquired or viewed, and how far the risk was mitigated. See the HHS Breach Notification Rule guidance.

For a reportable breach of unsecured PHI, notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The clinic must also notify the HHS Secretary: for breaches affecting 500 or more individuals, without unreasonable delay and within 60 days; for breaches affecting fewer than 500 individuals, no later than 60 days after the end of the calendar year in which the breach was discovered. If more than 500 residents of a state or jurisdiction are affected, prominent media notice is also required within the applicable 60-day limit.

A business associate must notify the clinic of a breach without unreasonable delay and no later than 60 days after discovery, although the BAA may set a shorter deadline. Keep records showing the incident assessment, notification decisions, communications, and mitigation. Refer to HHS’s breach notification requirements when determining which notices apply.

Checklist takeaway: A sound HIPAA program connects a documented risk analysis to practical safeguards, trained staff, carefully managed access, written vendor agreements, a responsive patient-access process, and a documented incident-response plan.

FAQs

How often should an Angelman syndrome clinic conduct a HIPAA risk analysis?

HIPAA does not specify a fixed interval for repeating the full risk analysis. The process should be ongoing, with reviews when changes or incidents may affect ePHI security. A clinic may choose an annual review as its internal schedule, but it should also reassess risks when significant changes occur. See HHS risk analysis guidance.

What must a business associate agreement require when a vendor handles PHI?

A BAA must define permitted and required uses and disclosures, require appropriate safeguards and applicable Security Rule protections, address incident and breach reporting, and require protections for relevant subcontractors. It must also address the vendor’s support for applicable individual rights and other required Privacy Rule obligations. See HHS sample BAA provisions.

How quickly must a clinic notify affected individuals after discovering a reportable breach?

The clinic must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a reportable breach of unsecured PHI. Additional notice to HHS and, in certain cases, the media may also be required. See HHS breach notification guidance.

Can patients request access to their health information under HIPAA?

Yes. With limited exceptions, individuals have a right to access PHI in their designated record set. A covered entity generally must act on the request within 30 calendar days, with a possible one-time extension of up to 30 additional days if it provides the required written notice within the initial period. See HHS guidance on access requests.