HIPAA Compliance Checklist for Bronchiectasis and NTM Clinics

Determine whether HIPAA applies to your clinic

HIPAA generally applies to health care providers that electronically transmit health information in connection with a transaction for which HHS has adopted a standard, such as electronic billing. A clinic’s specialty does not determine whether HIPAA applies; its legal and operational role does. Confirm whether your clinic is a covered entity, part of a covered entity, or a business associate. HHS guidance on covered entities explains these categories.

If HIPAA applies, treat patient-identifying details and clinical information—such as diagnoses, medication lists, sputum culture results, referrals, and appointment information—as protected health information (PHI) when they identify or could identify a patient. The Security Rule covers electronic PHI (ePHI) that your organization creates, receives, maintains, or transmits.

• Record which legal entity operates the clinic and who is responsible for HIPAA compliance.
• Confirm how the clinic submits claims or other standard electronic transactions.
• Identify related organizations and vendors that handle PHI on the clinic’s behalf.
• Document the clinic’s decision about HIPAA applicability and revisit it if its ownership, billing, or services change.

Document a security risk analysis and remediation plan

The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough security risk analysis of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Use it to understand where patient information is stored, received, maintained, and transmitted, including in the EHR, email, cloud services, mobile devices, backups, and vendor systems. See HHS guidance on security risk analysis and the Security Rule’s administrative safeguards.

• Inventory systems, devices, locations, and workflows that store or handle ePHI.
• Identify reasonably anticipated threats and vulnerabilities, and assess their likelihood and potential impact.
• Record existing safeguards, gaps, and decisions about which risks need action.
• Maintain a remediation plan with an assigned owner, target date, and status for each action.
• Update the analysis when changes to systems, services, operations, or threats make an update necessary.

A risk analysis identifies and evaluates risk; the remediation plan documents how the clinic will address it. Keep both as evidence of the clinic’s process, and make decisions about safeguards in light of the clinic’s circumstances and the risks identified.

Train staff and track completion

The Security Rule requires a security awareness and training program for all workforce members, including management. It calls for periodic security updates but does not set a universal annual training interval. Set a schedule that fits your clinic’s risk, workforce, and policies, and provide additional training when roles or procedures change. See the Security Rule training requirement.

• Cover how staff handle PHI in the EHR, email, phone calls, referrals, and patient communications.
• Explain how to report misdirected messages, suspicious logins, lost devices, and other potential security incidents.
• Keep dated records of training topics, attendance, acknowledgments, and follow-up for missed sessions.
• Use role-specific instruction for staff with access to billing, records, research, or system administration.

A training completion certificate can document an individual’s participation; it does not establish that the clinic as an organization complies with HIPAA. Staff must also follow employer-specific policies and procedures.

Review access controls for EHR and email systems

Limit access to ePHI to authorized users and the information they need for their work. Use individual accounts rather than shared logins, promptly remove access when a person leaves or changes roles, and review permissions regularly. The Security Rule addresses access control, person or entity authentication, and audit controls; see 45 CFR § 164.312.

• Assign EHR and email permissions by role, and document who approves access.
• Use multifactor authentication (MFA), especially for remote access and accounts with elevated privileges, as a safeguard selected in response to the clinic’s risk analysis.
• Set procedures for access changes, account closure, and emergency access.
• Use approved email and messaging methods for PHI; verify recipients before sending and avoid personal accounts for clinic work.
• Review access and audit records for unusual activity, such as unexpected access to patient charts or repeated failed logins.

Protect facilities devices backups and audit logs

Protect the rooms, equipment, and devices that can expose PHI. The Security Rule requires physical safeguards for facilities and systems, as well as technical safeguards such as mechanisms to record and examine activity in systems containing ePHI. See 45 CFR § 164.310 and 45 CFR § 164.312.

• Control access to clinical and records areas, and establish visitor procedures.
• Position monitors to reduce casual viewing; secure paper records and dispose of them using approved procedures.
• Track clinic devices and apply safeguards such as screen locks and encryption where appropriate to the risks identified.
• Maintain backup and recovery procedures for ePHI, and test whether the clinic can restore data when needed.
• Retain and review audit logs according to written procedures; restrict access to logs and document follow-up on suspicious activity.

Encryption is an addressable Security Rule implementation specification. Addressable does not mean optional without analysis: assess whether encryption is reasonable and appropriate, implement it when it is, or document the decision and any reasonable alternative. HHS explains the Security Rule’s encryption provision.

Maintain business associate agreements with vendors

A vendor may be a business associate when it creates, receives, maintains, or transmits PHI on the clinic’s behalf as part of its work. Depending on the service and access involved, this may include EHR hosting, cloud storage, billing, or IT support. Before a vendor handles PHI as a business associate, determine whether a business associate agreement (BAA) is required and put the appropriate written arrangement in place. See HHS guidance on business associates.

• Inventory vendors and the services they provide, then identify which ones handle PHI on the clinic’s behalf.
• Confirm that each required BAA describes permitted uses and disclosures, safeguards, and how incidents are reported.
• Check that the agreement addresses applicable subcontractors and what happens to PHI when the service ends.
• Store signed agreements centrally and review them when vendors, services, or data flows change.

A signed BAA is one part of vendor oversight, not proof that the clinic or vendor meets every HIPAA requirement. The clinic remains responsible for its own obligations, including choosing and managing safeguards based on risk.

Document incident response and breach procedures

Write down how staff report, assess, contain, and document suspected security incidents. Assign responsibility for preserving relevant records, assessing affected systems and PHI, coordinating with vendors, and deciding what corrective steps are needed. The Security Rule requires procedures to address security incidents, and HHS describes the applicable Breach Notification Rule.

• Give staff a clear, prompt way to report a suspected incident, including outside business hours if needed.
• Record what happened, when it was discovered, what systems and information may be involved, and the actions taken.
• Assess whether an impermissible use or disclosure of unsecured PHI is a reportable breach; document the assessment and its basis.
• Identify who will notify affected individuals, HHS, and, when applicable, the media, and who will coordinate with a business associate.
• Review incidents and near misses to identify corrective actions and update policies or training.

For reportable breaches of unsecured PHI, the Breach Notification Rule generally requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovery; other reporting duties depend in part on how many individuals are affected. A business associate must notify the covered entity under the applicable rule and agreement. Confirm the requirements and deadlines for the specific incident using HHS breach notification guidance.

Together, these steps help your clinic identify where PHI is handled, assess risks, apply appropriate safeguards, oversee vendors, and respond to incidents with clear documentation. Keep the checklist aligned with your clinic’s actual systems, workforce, and written policies.

FAQs

When does HIPAA apply to a bronchiectasis and NTM clinic?

HIPAA generally applies when the clinic is a health care provider that electronically transmits health information in connection with a standard transaction, such as electronic billing. The clinic’s specialty alone does not decide whether HIPAA applies. Confirm the clinic’s legal and billing arrangements using HHS covered-entity guidance.

What should a HIPAA security risk analysis document?

Document where ePHI is created, received, maintained, and transmitted; the systems and people involved; potential threats and vulnerabilities; current safeguards; and the likelihood and potential impact of risks. Record identified gaps and how the clinic plans to address them. HHS risk-analysis guidance provides further detail.

How often should clinic staff complete HIPAA training?

The Security Rule requires a training program for all workforce members and periodic security updates, but it does not specify a universal annual training interval. Choose a schedule that fits the clinic’s risk and policies, provide training for new or changed responsibilities, and keep completion records.

Which vendors need a business associate agreement?

A vendor generally needs a BAA when it creates, receives, maintains, or transmits PHI on the clinic’s behalf as a business associate. The answer depends on the service and the vendor’s role, so review actual data flows rather than assuming every vendor does or does not require an agreement. HHS business associate guidance includes examples and requirements.