HIPAA Compliance Checklist for Dementia Diagnostic Clinics

Dementia diagnostic clinics handle sensitive information across referrals, cognitive assessments, imaging, care planning, and family communications. Use this checklist to strengthen privacy and security practices while supporting patients and the people they choose to involve in care.

HIPAA compliance depends on your clinic’s operations, systems, and applicable state law. Treat this checklist as a practical starting point, not a substitute for a clinic-specific compliance review.

Conduct a Security Risk Analysis

Complete a thorough HIPAA Security Rule risk analysis to identify where electronic protected health information (ePHI) is created, received, stored, or transmitted—and what could threaten its confidentiality, integrity, or availability.

• Inventory electronic health record systems, diagnostic tools, referral platforms, email, mobile devices, backups, and other systems that handle ePHI.
• Map how patient information moves among clinicians, administrative staff, caregivers, laboratories, imaging providers, and vendors.
• Assess likely threats, vulnerabilities, and potential impacts, including misdirected test results, lost devices, phishing, and inappropriate access.
• Document identified risks, assigned responsibilities, mitigation steps, and follow-up dates.
• Review and update the analysis when systems, workflows, staffing, locations, or threats change. A regular review schedule, such as an annual review, can help keep it current.

Use the findings to prioritize electronic protected health information safeguards. Address risks with appropriate administrative, physical, and technical measures, then document decisions and track remediation through completion.

Establish Workforce Policies and Training

Give employees, clinicians, temporary staff, and other workforce members clear written procedures for handling patient information. Define what they may access, use, disclose, and share, including during phone calls, appointments, referrals, and family discussions.

• Train workforce members on privacy and security expectations, incident reporting, phishing, secure messaging, and protecting information in shared spaces.
• Provide role-specific guidance for staff who coordinate dementia assessments, manage records, communicate results, or handle caregiver questions.
• Train staff to avoid assumptions about a patient’s decision-making capacity based only on a dementia diagnosis.
• Keep records of training, policy acknowledgments, and appropriate responses to policy violations.
• Reinforce training when workflows change or reviews identify recurring errors.

Make it easy for staff to raise concerns promptly. A clear reporting route helps the clinic assess potential problems before they grow.

Control and Monitor Access to Patient Records

Use role-based access controls so workforce members can view only the records and functions needed for their job duties. For example, scheduling staff may need appointment details, while clinicians need access to information relevant to diagnosis and treatment.

• Assign each user a unique account and remove or change access promptly when duties change or a person leaves.
• Use multifactor authentication where appropriate, especially for remote access, administrative accounts, and systems containing sensitive patient information.
• Set automatic screen locks and require secure sign-in on workstations and mobile devices.
• Review access permissions and system activity regularly, investigating unusual access patterns and inappropriate record viewing.
• Use secure channels for sending assessment results, referrals, and other patient information.

Document your access procedures and how your clinic reviews system activity. Staff should understand that curiosity is not a work-related reason to open a patient’s chart.

Verify Caregiver and Representative Authority

A caregiver’s involvement in a patient’s life does not automatically make that person the patient’s personal representative or authorize access to all protected health information. Verify the person’s identity, the patient’s preferences, and the scope of any legal authority before disclosing information.

• Ask whether the patient has authorized the caregiver to receive information or participate in relevant conversations.
• When someone claims to be a personal representative, review appropriate documentation, such as a valid health care power of attorney or guardianship paperwork, and confirm its scope under applicable law.
• Record what was verified, the authority or permission relied on, and any limits on information sharing.
• When a patient’s capacity to make a specific decision is unclear, follow clinic procedures and applicable law rather than making assumptions from the diagnosis alone.
• Share only information relevant to the person’s authority or the patient’s permission.

HIPAA may allow limited communication with family members or others involved in care in certain circumstances, but the appropriate disclosure depends on the patient’s situation and applicable rules. Escalate uncertain cases to the privacy officer or qualified counsel.

Manage Business Associate Agreements

Identify vendors and service providers that create, receive, maintain, or transmit protected health information on the clinic’s behalf. When a vendor qualifies as a business associate, put a business associate agreement in place before allowing access to the information.

• Review vendors such as cloud-hosted record systems, billing services, transcription providers, data-storage companies, and IT support providers based on the services they perform and their access to information.
• Confirm the agreement describes permitted uses and disclosures, safeguards, incident and breach reporting, and other required responsibilities.
• Check whether subcontractors handle patient information and whether required agreements and safeguards extend through the vendor relationship.
• Maintain an up-to-date vendor inventory and review agreements when services or data access change.
• Plan for secure return or destruction of patient information when a service ends, where feasible and consistent with applicable requirements.

A vendor contract alone does not eliminate the clinic’s responsibility to assess risks. Include vendor access and safeguards in your risk analysis and follow-up reviews.

Secure Facilities and Devices

Protect paper records, workstations, diagnostic equipment, and mobile devices from unauthorized access, loss, or damage. Dementia diagnostic clinics may discuss sensitive information in waiting areas and conduct assessments in rooms shared by patients, caregivers, and staff, so privacy protections should reflect the actual environment.

• Position monitors to limit viewing by visitors and use privacy practices when discussing patient information.
• Store paper files securely and return them to protected storage after use.
• Use approved, secured devices for work and protect them with strong authentication and encryption where appropriate.
• Keep an inventory of devices that may contain ePHI and establish procedures for reporting a missing device.
• Restrict physical access to areas that contain records, servers, or equipment used to manage ePHI.

Prepare for Incidents and Data Recovery

Maintain written procedures for identifying, reporting, containing, investigating, and responding to suspected or known security incidents. Staff should know whom to contact and what information to preserve, even when they are not sure whether an event is a reportable breach.

• Promptly secure affected accounts or devices and take steps to limit further unauthorized access or disclosure.
• Keep breach investigation documentation describing what happened, when it was discovered, the information and individuals involved, actions taken, and the outcome of the assessment.
• Document the reasoning and relevant facts used to determine whether notifications are required, and follow applicable notification obligations and timelines.
• Maintain a contingency plan that covers data backup, contingency plan data restoration, emergency operations, and continuity of essential clinical work.
• Test backup and restoration procedures periodically, and update response plans based on test results and actual incidents.

Regular risk analysis, workforce training, carefully limited access, verified authority for caregiver communications, appropriate vendor agreements, and tested recovery procedures work together to protect patient information and support continuity of care.

FAQs

How often should a dementia diagnostic clinic conduct a HIPAA security risk analysis?

HIPAA requires an accurate and thorough risk analysis, but it does not set one universal schedule, such as a specific annual deadline, for every clinic. Review and update the analysis when changes to your technology, workflows, staff, locations, or risks could affect ePHI. A scheduled periodic review, such as annually, can help ensure important changes are not missed.

How can staff verify a caregiver’s authority to receive protected health information?

Staff should verify the caregiver’s identity, check the patient’s permission, and review documentation of any claimed legal authority, such as a health care power of attorney or guardianship paperwork. Confirm the scope of that authority under applicable law, document what was reviewed, and limit disclosures to what the authority or permission covers. Do not assume that a dementia diagnosis alone removes a patient’s ability to make decisions or control disclosures.

Which vendors need a business associate agreement?

A business associate agreement is generally needed when an outside person or organization performs a service for the clinic that involves creating, receiving, maintaining, or transmitting protected health information on the clinic’s behalf. Depending on their services and access, this may include cloud, billing, transcription, data-storage, or IT providers. Assess each vendor’s role and the information involved before granting access.

What should a clinic document after a suspected HIPAA incident?

Document when the incident occurred and was discovered, what systems or information may be involved, who may have accessed or received the information, steps taken to contain and investigate it, and the assessment and outcome. Keep records of the decision about whether notifications are required, including the basis for that decision, and document any notifications made. Also record corrective actions intended to reduce the chance of a similar incident.