HIPAA Compliance Checklist for Craniofacial Anomalies Teams

Craniofacial care can involve surgeons, orthodontists, speech-language pathologists, audiologists, nurses, social workers, and other specialists who need to coordinate around sensitive health information. Use this checklist to identify who has HIPAA responsibilities, control access to records and medical photographs, and prepare for privacy or security incidents.

HIPAA obligations depend on the organization’s legal status and its activities—not simply on whether a team treats patients with craniofacial anomalies. Apply this checklist alongside your organization’s policies and any stricter state or professional requirements.

Which craniofacial care organizations and vendors must comply with HIPAA?

Start by determining the organization’s covered entity status. HIPAA covered entities include health plans, health care clearinghouses, and health care providers that conduct certain standard electronic transactions, such as electronic claims or payment transactions. A provider’s specialty or nonprofit status alone does not determine whether it is a covered entity. Review the HHS overview of covered entities and the organization’s actual billing and transaction practices.

• Confirm which legal entity provides care. A multidisciplinary team may work within a hospital, health system, private practice, or other organization. Determine which entity controls the records and is responsible for HIPAA policies.
• Map information flows. Identify where clinical notes, treatment plans, billing details, referrals, scans, and photographs are created, stored, or shared.
• Classify outside services. A vendor that handles protected health information (PHI) for a covered entity—such as a billing service, cloud storage provider, or certain record-management vendors—may be a business associate.
• Do not assume every participant is a separate covered entity. A clinician’s obligations depend on their relationship to the organization and the work they perform. Workforce members generally follow their organization’s policies; an outside provider or vendor may have separate obligations depending on its role.

HIPAA covers covered entities and business associates, not every organization that encounters health information. Some businesses outside HIPAA may still have obligations under other laws or contracts. See HHS guidance on who must comply with the Privacy Rule.

How should multidisciplinary teams limit access to patient information?

Build access around a person’s duties and the purpose of the access. Craniofacial teams may need to coordinate across specialties, but team membership alone should not grant every person unrestricted access to every chart, photograph, or image archive.

• Assign role-based permissions. Configure access to reflect job functions—for example, a billing worker may not need access to clinical photographs, while a clinician providing treatment may need relevant records.
• Use individual accounts. Avoid shared logins so the organization can identify who accessed or changed information.
• Review access regularly. Update or remove permissions when a person changes roles, leaves the organization, or no longer needs access.
• Set clear sharing procedures. Use approved channels to share records with treating clinicians and verify the recipient before sending information.
• Train the workforce on local policy. Explain how your organization handles chart access, consultations, photographs, messaging, and suspected privacy incidents.

The Privacy Rule generally requires reasonable efforts to limit uses, disclosures, and requests for PHI to the minimum necessary standard for the intended purpose. The minimum necessary standard does not apply to disclosures to or requests by a health care provider for treatment, but role-based controls and careful handling remain important safeguards. Review HHS minimum necessary guidance and its guidance on controlling access to electronic PHI.

What consent and authorization forms should craniofacial teams maintain?

Distinguish general consent from a HIPAA authorization. HIPAA permits covered entities to obtain consent for treatment, payment, and health care operations, but it does not generally require that consent for those uses. When HIPAA requires an authorization, a general consent form is not enough unless it meets the authorization requirements. See HHS guidance distinguishing consent and authorization.

• Maintain applicable privacy notices and acknowledgments. Follow your organization’s procedures for providing the Notice of Privacy Practices and documenting its receipt or the effort to obtain acknowledgment.
• Use a valid authorization when required. The form should identify the information to be used or disclosed, who may disclose it, who may receive it, the purpose, an expiration date or event, and the individual’s right to revoke, along with other required statements.
• Address clinical photographs specifically. Identifiable photographs connected to a patient’s care can be PHI. Using or disclosing them for treatment may be permitted without a separate HIPAA authorization; using them for public-facing education, marketing, publication, or social media may require a valid authorization, depending on the circumstances.
• Keep permissions separate and clear. Explain whether a requested permission covers internal care, teaching, research, publication, or public promotion. Do not treat permission for one purpose as permission for every purpose.
• Record the applicable representative’s authority. When a parent, guardian, or other personal representative acts for a patient, follow applicable HIPAA rules and state law concerning that person’s authority and any exceptions.

For information about authorization requirements and treatment-related disclosures, consult HHS Privacy Rule guidance and its authorization FAQs. A release form should match the intended use; do not rely on a broad, informal consent when a HIPAA authorization is required.

Which safeguards protect electronic protected health information?

The HIPAA Security Rule requires covered entities and business associates to protect electronic protected health information (ePHI) through reasonable and appropriate administrative, physical, and technical safeguards. Start with a documented risk analysis that considers the systems and applications where your team creates, receives, maintains, or transmits ePHI. HHS explains the Security Rule risk analysis requirements.

• Electronic protected health information access controls: Restrict systems and records to authorized users and appropriate roles; use unique user identification and procedures for emergency access.
• Audit controls: Use mechanisms to record and examine activity in systems containing ePHI. Review logs when investigating unusual access or other security concerns.
• Authentication and transmission security: Verify user identity and protect ePHI sent over electronic networks using safeguards appropriate to the organization’s risk assessment.
• Physical safeguards: Protect workstations, devices, storage media, and areas where ePHI can be accessed. Secure paper files and imaging equipment as well.
• Security management: Document risks, select and implement risk-reducing measures, and update them as systems, workflows, and threats change.
• Contingency plan: Establish procedures for responding to emergencies that damage systems containing ePHI, including data backup, disaster recovery, and emergency-mode operations.
• Workforce procedures: Provide role-appropriate security training, establish incident-reporting steps, and apply organizational sanctions where appropriate.

These safeguards are part of an ongoing compliance process, not a one-time checklist. For an overview of Security Rule standards, see HHS’s summary of the HIPAA Security Rule.

How should teams respond to and document a breach?

Prepare staff to report suspected exposure, loss, or unauthorized access promptly to the organization’s privacy or security lead. Do not wait to determine whether an incident is a reportable breach before escalating it internally.

• Contain and preserve evidence. Follow incident-response procedures to limit further access while preserving relevant logs, messages, and other records.
• Assess the event. Determine what information was involved, who accessed or received it, whether it was acquired or viewed, and what steps reduced the risk.
• Complete and document a breach risk assessment when appropriate. An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an exception applies or the organization demonstrates a low probability that the PHI was compromised through the required risk assessment.
• Coordinate notifications. The covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a reportable breach. Depending on the number of individuals affected, notice to HHS and the media may also be required.
• Follow the business associate agreement. A business associate must notify the covered entity of a breach at or by the business associate without unreasonable delay and no later than 60 days after discovery; the agreement may set a shorter reporting period.
• Document the decision and response. Retain the investigation, risk assessment, mitigation steps, notifications, and the reasoning for any determination that notification was not required.

Use HHS Breach Notification Rule guidance for the applicable notification requirements and decision factors. The 60-day limit is an outside deadline, not a reason to delay a response.

What HIPAA responsibilities apply to business associates?

A business associate is generally a person or organization outside the covered entity’s workforce that performs certain functions or services involving PHI on the covered entity’s behalf. Examples may include vendors that handle billing, data storage, or other services involving PHI. A vendor’s access to information should be assessed based on its actual role, not its label or marketing claims.

• Put the relationship in writing. Before disclosing PHI to a business associate, obtain a written business associate agreement (BAA) or other permitted written arrangement that describes the services and required protections.
• Specify safeguards and permitted uses. The agreement should address appropriate safeguards, restrictions on uses and disclosures, incident reporting, and other required terms.
• Address subcontractors. A business associate that uses a subcontractor to create, receive, maintain, or transmit PHI generally must obtain appropriate written assurances from that subcontractor.
• Coordinate incident response. Set operational reporting deadlines and identify which party will gather information and support any required notifications.
• Reassess vendor relationships. Review contracts and access when services, systems, or information flows change, and remove access when it is no longer needed.

Covered entities remain responsible for their own HIPAA duties when they use vendors, while business associates are directly subject to certain HIPAA requirements. See HHS business associate guidance and its overview of covered entity and business associate responsibilities.

FAQs.

Does HIPAA apply to every craniofacial anomalies team?

No. HIPAA applies to covered entities and business associates, not automatically to every team or organization involved in craniofacial care. A provider’s covered entity status depends in part on whether it conducts certain standard electronic transactions. Vendors and other service providers may have business associate responsibilities when they handle PHI on behalf of a covered entity.

Can craniofacial teams use medical photographs without patient authorization?

Sometimes. A covered provider may generally use or disclose PHI, including relevant clinical photographs, for treatment without a separate patient authorization. Using or disclosing identifiable photographs for purposes such as public education, publication, marketing, or social media may require a valid HIPAA authorization. Assess the specific purpose and disclosure before using an image.

How quickly must a team notify patients after a breach?

For a reportable breach of unsecured PHI, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery; its agreement may require earlier notice.

What HIPAA records should a craniofacial team document?

Maintain applicable privacy and security policies, required notices and acknowledgments, workforce training and access records, risk analyses and security activities, business associate agreements, and incident investigations and breach assessments. HIPAA-required documentation generally must be retained for six years from creation or the date it was last in effect, whichever is later; this is not a universal retention period for patient medical records. See HHS Security Rule documentation guidance and its HIPAA audit protocol.

In practice, a sound compliance program begins with confirming covered entity and business associate roles, limiting access appropriately, protecting clinical images, documenting safeguards, and preparing the team to report and assess incidents promptly.