HIPAA Compliance Checklist for Crime Victim Trauma Recovery Centers

A crime victim trauma recovery center may handle counseling notes, treatment records, referrals, and other sensitive information. Whether HIPAA applies depends on the center’s role and the information it handles—not simply on its mission or funding source. Use this checklist to assess your obligations and organize practical privacy and security measures.

Determine whether HIPAA applies to your center

Start by determining whether your center is a HIPAA covered entity, a business associate, both in different activities, or neither. Covered entities include health plans, health care clearinghouses, and health care providers that conduct certain covered transactions electronically, such as electronic billing. A business associate performs certain functions or services for a covered entity that involve protected health information (PHI). Review the HHS overview of covered entities and business associates.

Receiving a grant does not, by itself, make a center subject to HIPAA. Instead, check what services your center provides, how it handles health information, whether it conducts covered electronic transactions, and whether it performs services involving PHI on behalf of a covered entity. Grant or contract terms, state confidentiality laws, and other requirements may impose separate obligations, so review those independently.

Document your analysis, including the center’s services, electronic transactions, relationships with health care organizations, and any contracts involving PHI. If the center’s role changes—for example, if it begins billing electronically or contracts to handle records for a covered provider—reassess its status.

Identify and protect PHI in counseling and treatment records

Inventory the information your center creates, receives, maintains, or shares. Depending on your role, records that identify a person and relate to health care may be PHI. Consider counseling and treatment records, appointment details, referrals, billing information, case-management records, and identifiable information in email, text messages, or shared files.

Keep clinical records distinct from other case files where practical, and limit access according to staff responsibilities. Apply safeguards to paper and electronic records, including secure storage, controlled access, and safe disposal. The Privacy Rule requires covered entities to use reasonable safeguards for PHI in any form; the HHS summary of the Privacy Rule describes these obligations.

Know the distinction between ordinary clinical documentation and psychotherapy notes. Under HIPAA, psychotherapy notes are a specific category of notes maintained separately from the rest of the medical record that document or analyze counseling conversations. They receive special protections; other mental health information, such as diagnoses and treatment plans, generally remains part of the medical record. See HHS guidance on mental health information and psychotherapy notes.

Document an ePHI risk analysis and mitigation plan

If the center is subject to the Security Rule as a covered entity or business associate, document an accurate and thorough ePHI risk analysis. Map where electronic PHI is created, received, maintained, or transmitted, including devices, applications, email, backups, and vendor systems. Identify reasonably anticipated threats and vulnerabilities that could affect its confidentiality, integrity, or availability.

For each risk, record its potential impact, existing safeguards, and the additional steps needed to reduce it to a reasonable and appropriate level. Assign an owner and target date to mitigation actions, track completion, and document any remaining risk and the center’s response. HHS explains that the Security Rule requires a documented risk analysis but does not prescribe a specific format in its Guidance on Risk Analysis.

Review the analysis when operations, systems, or risks change, such as after a security incident, a new technology deployment, or a significant organizational change. Reassess whether current safeguards remain appropriate and update the mitigation plan as needed.

Implement administrative physical and technical safeguards

Build safeguards around your actual systems, staff, and locations. Administrative safeguards can include assigning privacy and security responsibilities, managing workforce access, responding to incidents, and regularly reviewing information-system activity. Physical safeguards can include securing offices and file rooms, protecting devices, and controlling access to work areas where ePHI may be available.

Technical safeguards may include unique user accounts, role-based access, access controls, audit logs, authentication, and protections for data sent over networks. Consider measures such as multifactor authentication, encryption, and secure backups based on your risk analysis. HIPAA requires appropriate safeguards but does not make every particular technology a universal solution; document how your choices address identified risks. The HHS summary of the Security Rule outlines the administrative, physical, and technical safeguard standards.

Review access when staff join, change roles, or leave. Make sure access and audit-log procedures are not only written down but used in practice, with reviews and follow-up documented.

Train staff and maintain written privacy and security policies

Maintain written policies that explain how your center protects PHI, authorizes access, responds to privacy complaints, reports suspected incidents, and applies appropriate sanctions for violations. Name the people responsible for privacy and security duties, and make current procedures available to staff who need them.

HIPAA requires covered entities to provide Privacy Rule workforce training appropriate to each person’s functions, including training for new workforce members within a reasonable period and training when a material policy change affects their work. The Security Rule also requires a security-awareness and training program. Keep records showing who received training, when it occurred, and what policies or topics it covered. HIPAA does not set a universal annual training-certificate renewal requirement; training should follow the applicable rules and your organization’s policies. See HHS Privacy Rule workforce-training guidance.

Tailor training to the work people do. For example, counselors, intake staff, volunteers, administrators, and technology personnel may need different instructions about discussing cases, handling records, using devices, and escalating concerns.

Review business associate agreements and subcontractors

List vendors and partners that create, receive, maintain, or transmit PHI for your center or provide a service on behalf of a covered entity involving PHI. Depending on the relationship, they may be business associates or subcontractors. Examples to assess include billing services, cloud hosting, electronic record platforms, and information-technology support.

When a business associate agreement is required, make sure it is in place before the relevant PHI is shared. Review whether the written agreement addresses permitted uses and disclosures, safeguards, reporting of breaches or security incidents, subcontractors, and the return or destruction of PHI when the relationship ends. HHS explains the business associate agreement requirements.

Do not assume that a vendor’s general privacy statement or security claims replace a required agreement. Keep a current vendor inventory, track agreement dates, and reassess vendor access when services change or end.

Prepare compliance records for audits and breach response

Keep organized records that show how the center evaluates and carries out its obligations. Depending on HIPAA’s applicability and the records involved, these may include written policies, training documentation, risk analyses and mitigation actions, business associate agreements, access-control decisions, audit-log review records, security incident investigations, and breach assessments and notices.

HIPAA documentation-retention rules generally require covered entities and business associates to retain required documentation for six years from its creation or the date it was last in effect, whichever is later. This is not a general HIPAA medical-record retention period: state law or other requirements may govern how long clinical records must be kept. For the applicable documentation provisions, consult the HHS Security Rule summary and HHS audit protocol.

Document breach notification procedures before an incident occurs. Staff should know whom to contact, how to contain a suspected exposure, and how to preserve relevant information. Covered entities and business associates have duties after a breach of unsecured PHI; required notices depend on the circumstances and must be provided without unreasonable delay. Individual notices generally may not be delayed beyond 60 days after discovery. See the HHS Breach Notification Rule guidance.

In short, confirm whether HIPAA applies to your center, identify and protect PHI, assess ePHI risks, implement safeguards, train the workforce, manage vendor relationships, and retain evidence of required compliance activities.

FAQs

Does receiving grants make a victim recovery center subject to HIPAA?

No. Grant funding alone does not determine HIPAA status. Assess whether the center is a covered entity or business associate based on its health care activities, covered electronic transactions, and relationships involving PHI. Separately review grant terms and other applicable confidentiality requirements.

When do counseling records qualify as PHI?

Identifiable information relating to a person’s health or health care may qualify as PHI when handled by a HIPAA covered entity or business associate. Counseling records are not automatically subject to HIPAA merely because they contain sensitive information. Separately maintained psychotherapy notes are a specially protected category under the Privacy Rule; other clinical mental health information is generally treated like other PHI.

What should an ePHI risk analysis document?

Document where ePHI is stored or transmitted, the systems and people that can access it, relevant threats and vulnerabilities, potential impacts, current safeguards, and steps to reduce identified risks. Track mitigation owners and progress, record remaining risks, and update the analysis when operations or risks change. HIPAA requires a documented analysis but does not prescribe a specific template.

What records should a center maintain for a HIPAA audit?

Maintain the policies and documentation required for the center’s HIPAA role, such as risk analyses, mitigation records, workforce training documentation, business associate agreements, access and audit-review procedures, incident records, and breach assessments or notices. Retain required HIPAA documentation for the applicable six-year period, while checking state or other rules for clinical-record retention.