HIPAA Compliance Checklist for Child Advocacy Center Medical Units

Use this checklist to review the privacy and security practices of a child advocacy center’s medical unit. HIPAA applies to covered entities and business associates—not automatically to every organization because it is a child advocacy center. Confirm the medical unit’s status and each partner’s role, and check applicable state laws, which may impose additional requirements. See HHS guidance on covered entities and business associates.

How should medical records and photographs be secured?

Protect paper records, electronic health records, examination photographs, and related notes as protected health information (PHI) when they identify a child and relate to health care. The Privacy Rule applies to PHI in any form; the Security Rule’s specific safeguards apply to electronic PHI (ePHI).

• Map where information is kept and sent. Include the health record system, scanned documents, cameras, workstations, removable media, backups, email, and vendors that create, receive, maintain, or transmit ePHI.
• Complete and update a HIPAA Security Rule risk analysis. Identify potential threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI, then select and document appropriate risk-management measures. HHS explains the risk analysis requirements.
• Set role-based access controls. Give each workforce member a unique account and access suited to their duties; promptly change or remove access when roles change or employment ends. Review access periodically and use audit controls to help detect inappropriate viewing, changes, or exports.
• Secure work areas and devices. Store paper files in restricted areas, protect screens from casual viewing, secure devices and media, and use approved procedures for disposal. Use encryption and other technical safeguards based on the risk analysis; HIPAA does not prescribe one identical technical setup for every organization.
• Review vendors’ roles. If a vendor performs services on behalf of the covered entity and handles PHI, determine whether a business associate agreement is required before sharing information with it.

HHS describes Security Rule safeguards such as risk analysis, appropriate access, and review of ePHI access records in its Summary of the HIPAA Security Rule. For vendors acting as business associates, review HHS guidance on business associates and written agreements.

Which written privacy policies and staff training are required?

Maintain written policies and procedures that fit the medical unit’s operations and explain how staff protect PHI, respond to privacy concerns, manage access, handle records and images, and report suspected incidents. Identify the privacy official and the Security Rule security official, define responsibility for complaints, and apply appropriate sanctions for workforce violations.

• Train workforce members on the privacy and security policies needed for their roles, including confidentiality, permitted disclosures, secure handling of images, access controls, and how to report a suspected incident.
• Train staff when policies or work duties change and provide appropriate training to new workforce members. Keep evidence of required training and policy documentation.
• Do not treat a course-completion certificate as proof that the organization is HIPAA compliant. HIPAA requires workforce training appropriate to job functions; it does not impose a universal annual certificate-renewal requirement.

HHS explains the workforce training requirement in its overview of Privacy Rule responsibilities. The Security Rule also requires appropriate security awareness and training, as described in HHS’s Security Rule summary.

When may medical records be disclosed and how should disclosures be documented?

Before sending records, confirm the recipient, purpose, authority, and applicable legal basis. A valid authorization for disclosure is generally needed when the Privacy Rule does not otherwise permit or require the disclosure. An authorization must meet HIPAA’s requirements; a general consent or a statement in a privacy notice is not a substitute when authorization is required. See HHS guidance on consent and authorization.

• Check permitted purposes and exceptions. HIPAA generally permits disclosures between health care providers for treatment without the patient’s authorization. It also permits reports of child abuse or neglect to a public health or other appropriate government authority authorized by law to receive them. These permissions do not automatically authorize disclosure to every member of a multidisciplinary team.
• Apply the minimum necessary standard where it applies. For disclosures subject to the standard, limit PHI to what is reasonably needed for the purpose. The standard does not apply to provider-to-provider disclosures for treatment or to certain other categories, including disclosures made under an individual’s authorization. Consult HHS’s minimum necessary guidance.
• Check authority to act for the child. A parent or guardian is often the minor’s personal representative, but state law and HIPAA exceptions can affect access and disclosure. In abuse or endangerment situations, do not assume a parent may receive the records; assess the facts under applicable law and policy. See HHS guidance on personal representatives.
• Keep a reliable disclosure workflow. As an operational safeguard, record the date, recipient, information sent, purpose, legal basis or authorization relied on, and staff member handling the disclosure. Verify the destination and retain the authorization or other supporting documentation when applicable.

HIPAA does not require an all-purpose accounting of every disclosure. Individuals have a right to an accounting for certain disclosures, subject to exceptions such as many disclosures for treatment, payment, and health care operations and disclosures made under authorization. Covered entities must document disclosures that are subject to accounting and retain required documentation under the applicable HIPAA rules. See the HHS Summary of the HIPAA Privacy Rule.

How should multidisciplinary team information sharing be governed?

Adopt a written protocol that distinguishes clinical treatment coordination from forensic interviewing, child protection, law enforcement, prosecution, and other team activities. A team member’s participation in a multidisciplinary team does not by itself create a right to access the medical record.

• List the organizations and roles that may participate in each type of discussion, and define who may approve or make a disclosure.
• For each proposed sharing, identify whether it is permitted for treatment, required or permitted by another law, supported by a valid authorization, or otherwise allowed under HIPAA. If no basis applies, do not disclose the PHI.
• Use the minimum necessary standard when it applies, and limit access to workforce members whose roles require it. A treatment disclosure between health care providers is exempt from that standard, but that exception does not automatically cover every MDT participant or purpose.
• Use an authorization that identifies the information, recipient, purpose, and expiration when authorization is required. For a child, verify who has authority to authorize disclosure under HIPAA and applicable state law.
• Determine whether a partner is acting as a business associate before relying on a business associate agreement. Such an agreement governs a business associate’s handling of PHI; it is not a blanket substitute for authorization or another valid basis for disclosure to an independent team partner.

HHS explains that a business associate agreement is required for a business associate performing specified functions or services involving PHI on behalf of a covered entity, and that the agreement must establish permitted uses and safeguards. Review HHS business associate contract provisions.

How should examination images be stored and released?

Treat identifiable examination photographs as sensitive PHI when they are created or maintained in connection with care. Use only approved capture and storage methods, and ensure each image is associated with the correct patient and record without placing it in an unapproved personal account or device.

• Document the clinical purpose and follow applicable consent, examination, and organizational procedures for capturing images.
• Transfer images promptly to the approved record system; restrict access by role and use audit controls to review access and exports.
• Do not use personal phones, consumer photo libraries, or unapproved messaging and cloud services for PHI. Assess any technology provider’s role and safeguards before it handles images.
• Before release, verify the recipient and legal basis. If authorization is required, ensure it covers the relevant images, recipient, and purpose and is signed by someone authorized to act for the child.
• Transmit images through an approved secure method, document the release as required by policy and applicable accounting rules, and retain or dispose of copies under the medical unit’s retention and disposal procedures.

The Security Rule calls for risk-based administrative safeguards, physical safeguards, and technical safeguards for ePHI, including access controls and audit controls. Use the unit’s risk analysis to determine appropriate protections for the systems and devices that store or transmit examination images, as outlined in the HHS Security Rule summary.

How can facilities protect privacy during interviews and case discussions?

Use reasonable safeguards to prevent conversations and records from being overheard or seen by people who do not need access. HIPAA does not require eliminating every incidental disclosure, but a disclosure resulting from a failure to use reasonable safeguards is not permitted.

• Hold interviews and case discussions in a private room where conversations cannot readily be overheard; avoid discussing identifiable cases in hallways, waiting areas, elevators, or public reception spaces.
• Position screens and paperwork away from visitors, close records when not in use, and avoid displaying a child’s name or details where others can see them.
• Limit case discussions to participants with a defined role and a valid basis to receive the information. Use only the details needed for the particular discussion when the minimum necessary standard applies.
• For remote discussions, verify participants, use approved communication tools, and check that others cannot overhear at either end. Assess vendors that handle PHI for business associate obligations.
• Give staff clear instructions for correcting misdirected communications and reporting suspected privacy or security incidents.

HHS discusses reasonable safeguards and incidental uses or disclosures in its guidance on incidental uses and disclosures.

In practice, a strong checklist connects secure records and images, role-based access controls, staff training, valid disclosure authority, and carefully governed MDT sharing. Review the program regularly against its HIPAA risk analysis, current policies, and applicable state law.

FAQs

Can a child advocacy center share medical records with its multidisciplinary team?

Sometimes, but team membership alone is not a HIPAA permission. A medical unit may disclose PHI for treatment when the applicable conditions are met, and other disclosures may be permitted by authorization or a specific HIPAA provision or other law. Assess each recipient and purpose, and check state law and the child’s personal-representative status.

When should a disclosure of protected health information be documented?

Document disclosures according to the unit’s policies and applicable HIPAA requirements. HIPAA requires documentation for disclosures subject to the individual’s right to an accounting, but it does not require an accounting of every disclosure. A consistent operational record of the recipient, date, purpose, information shared, and legal basis can help staff support appropriate disclosures and respond to accounting requests.

How should examination photographs be stored securely?

Store identifiable examination photographs in an approved clinical system with access limited by role, audit controls, and safeguards selected through the Security Rule risk analysis. Avoid personal devices and unapproved photo, messaging, or cloud services. Verify authorization or another legal basis before release and use an approved secure transmission method.

What privacy measures should be used for family interviews and case discussions?

Use private rooms, protect screens and paperwork from view, and avoid discussing identifiable cases in public spaces. Limit discussions to participants who have a defined role and a valid basis to receive the information. For remote meetings, verify participants and use approved communication tools.