HIPAA Compliance Checklist for DEXA Bone Density Centers

This checklist is for DEXA bone density centers when they act as a HIPAA covered entity or business associate. Whether a provider is a covered entity depends on its role and whether it conducts certain transactions electronically; the HIPAA Rules apply to covered entities and business associates. Patient records and DEXA images that identify a patient are protected health information, and electronic versions are electronic protected health information (ePHI). See HHS guidance on covered entities and business associates.

How should a DEXA center conduct and document a HIPAA risk analysis?

Conduct and document a thorough risk analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. This is a required part of the HIPAA Security Rule’s security management process. HHS explains that the Rule does not prescribe one methodology or a fixed schedule; the analysis should reflect the center’s systems, operations, and risks. See HHS guidance on risk analysis.

• Inventory where ePHI is created, received, maintained, or transmitted, including DEXA equipment, image archives, workstations, electronic health records, billing systems, backups, portable media, and vendor or remote access.
• Map how images, reports, and patient identifiers move between systems, staff, referring providers, and service vendors.
• Assess foreseeable threats and vulnerabilities, the likelihood and impact of harm, and the safeguards already in place.
• Record identified risks, risk ratings, mitigation decisions, responsible owners, and target dates. Keep the analysis and supporting decisions in writing; HHS says the Security Rule requires documentation but does not prescribe a particular format.
• Review and update the analysis when relevant systems, vendors, facilities, or operations change, and as needed to keep safeguards appropriate to current risks.

Risk analysis is not just a one-time document: use its findings to prioritize and track risk management actions. See HHS’s explanation of the difference between risk analysis and risk management.

Which privacy safeguards protect patient information during DEXA services?

Use administrative, technical, and physical safeguards to protect patient information during scheduling, check-in, scanning, interpretation, reporting, billing, and communication. Limit access and disclosure in a way that protects privacy without impeding care.

• Speak discreetly about patient identity, appointment details, and scan results. Position check-in displays and work areas so other patients cannot casually view information.
• Verify the recipient and use an approved, secure method before sending reports or images to a patient or referring provider.
• Apply the minimum necessary standard to uses, disclosures, and requests where it applies, such as many payment and health care operations activities. It does not apply to disclosures to, or requests by, health care providers for treatment purposes. See HHS guidance on the minimum necessary requirement.
• Give patients a private way to discuss sensitive questions and establish procedures for handling requests for records, corrections, and confidential communications.
• Review vendor relationships and enter into required business associate agreements when a vendor creates, receives, maintains, or transmits PHI on the center’s behalf. See HHS guidance on business associates and business associate agreements.

What HIPAA training and sanctions should apply to the workforce?

Train workforce members on the privacy and security policies that apply to their duties. The Security Rule requires security awareness and training for workforce members, and the Privacy Rule requires training appropriate to their functions. Training should address center-specific workflows, not just general HIPAA concepts.

• Cover appropriate access and disclosure, secure handling of DEXA images and reports, passwords and authentication, phishing and other security threats, incident reporting, and the center’s emergency procedures.
• Provide training when a person joins the workforce and when a material policy or workflow change affects their duties. Document training dates, topics, and completion.
• Explain how to report suspected misdirected reports, lost devices, unauthorized access, or other privacy and security concerns promptly.
• Maintain and apply appropriate sanctions when workforce members fail to follow applicable policies and procedures.

HIPAA does not set a universal annual training or certificate-renewal schedule. Set refresher training according to the center’s policies, workforce needs, and identified risks. HHS summarizes the Security Rule’s requirements for security awareness training and sanctions.

How can role-based access controls secure imaging systems and records?

Use role-based access control (RBAC) to authorize access according to job responsibilities and the systems or information needed for those responsibilities. The HIPAA Security Rule requires technical policies and procedures that allow access to ePHI only by authorized persons; the center should define access rules for its own imaging and record workflows.

• Create individual accounts and assign each user an appropriate role, such as scheduling, scanning, interpreting, billing, or system administration.
• Use unique user identification rather than shared credentials, and remove or change access promptly when a person changes roles or leaves.
• Review access periodically and investigate audit records for unusual or inappropriate activity.
• Configure an automatic logoff where it is reasonable and appropriate for the workstation and workflow. Automatic logoff is an addressable implementation specification, so document the decision and any appropriate alternative measures.
• Establish an emergency access procedure that permits authorized access when needed for patient care while keeping access accountable.

HIPAA requires access controls and audit controls; RBAC and access reviews help a center apply those safeguards to its workforce and systems. See the HHS Security Rule summary for the applicable technical safeguards.

How should DEXA images and records be stored and transmitted securely?

Protect ePHI wherever it is stored or transmitted, including on imaging systems, local workstations, network storage, portable media, and vendor-hosted services. Assess risks to confidentiality, integrity, and availability, and use safeguards suited to the center’s systems and data flows.

• Restrict access to image archives and records, use authentication, and maintain audit mechanisms that can record and help examine activity in systems containing ePHI.
• Use secure, approved methods to transmit DEXA images and reports. Confirm recipients and destinations before sending, and avoid unapproved personal accounts or consumer file-sharing services.
• Evaluate encryption for ePHI at rest and in transit. Under the current Security Rule, encryption is an addressable implementation specification—not an automatic, stand-alone requirement in every circumstance. If it is not reasonable and appropriate, document the decision and implement an equivalent alternative measure when reasonable and appropriate. See HHS guidance on encryption under the Security Rule.
• Maintain retrievable backups of ePHI, including diagnostic images and reports, and define how data will be restored after loss or system failure.
• If a cloud or other vendor stores or processes ePHI on the center’s behalf, assess the service’s risks and establish the required business associate agreement. See HHS guidance on cloud services and ePHI.

What physical safeguards protect workstations, devices, and records?

Protect the facilities, workstations, equipment, and media that can access or contain ePHI. HIPAA’s standards for physical safeguards address facility access, workstation use and security, and device and media controls. See HHS guidance on physical safeguards.

• Limit access to imaging rooms, equipment areas, and locations where records or systems are maintained; manage visitor access appropriately.
• Position workstations and displays to reduce viewing by unauthorized people, secure devices when unattended, and use automatic logoff where appropriate.
• Set procedures for taking laptops, removable media, and other devices containing ePHI off-site or moving them within the facility.
• Track device receipt, use, return, and disposition. Remove ePHI from electronic media before reuse or disposal, using procedures appropriate to the media and risk.
• Protect paper records and printed reports from unauthorized viewing, loss, or access, and dispose of them securely.

How should a center respond to incidents and maintain continuity of care?

Maintain written procedures for identifying, reporting, responding to, and documenting suspected or known security incidents. Staff should promptly alert the designated privacy or security contact rather than investigating or deciding on their own whether an event is reportable.

• Contain the incident where safe to do so, preserve relevant logs and evidence, and document what happened, when it was discovered, the systems and information involved, and the response.
• Assess whether PHI was involved and whether the event is a breach of unsecured PHI. Follow the breach notification rule when notification is required; covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more individuals also require notification to HHS within that period; breaches affecting fewer than 500 individuals may be reported to HHS annually. See the HHS Breach Notification Rule.
• Coordinate with affected business associates and follow the applicable agreement and reporting procedures.
• Maintain a contingency plan that addresses data backup, recovery of lost data, and continued protection of ePHI during emergency operations. Include DEXA images and reports among the data considered for backup and recovery.
• Periodically test and revise the contingency plan, document the results, and correct problems identified. HIPAA does not prescribe one universal testing interval; choose a schedule based on the center’s risks, systems, and operations. HHS recommends periodic test restorations to check that backups can be recovered. See HHS guidance on ransomware response and contingency planning.

A reliable DEXA privacy and security program connects documented risk analysis to practical safeguards: trained staff, appropriate access, secure images and records, protected equipment, and tested incident and recovery procedures.

FAQs.

Does a DEXA bone density center need a documented HIPAA risk analysis?

If the center is a HIPAA covered entity or business associate and creates, receives, maintains, or transmits ePHI, the Security Rule requires an accurate and thorough risk analysis and documentation of its security policies and procedures. The analysis should cover the center’s systems and relevant risks; HIPAA does not prescribe a single format or fixed schedule. See HHS risk analysis guidance.

How should DEXA centers restrict access to patient images and records?

Assign individual accounts and role-based permissions, limit access to what workforce members need for their responsibilities, promptly change access when roles change, and review system activity. Apply the minimum necessary standard where it applies, while recognizing its treatment-related exceptions. See HHS guidance on the minimum necessary requirement.

What should staff do if they suspect an ePHI breach?

Staff should promptly report the concern through the center’s incident procedure, preserve relevant information, and avoid sending or discussing affected records through unapproved channels. The designated privacy or security contact should investigate, document the event, assess whether breach notification is required, and coordinate any required notices under the Breach Notification Rule.

How often should a DEXA center test its data backup and recovery plan?

HIPAA requires a contingency plan and periodic testing and revision, but it does not set one universal testing interval. Choose and document a schedule appropriate to the center’s risk, and periodically test whether backed-up ePHI—including images and reports—can be restored. HHS recommends periodic test restorations in its ransomware and contingency planning guidance.