HIPAA Compliance Checklist for Eye and Ear Specialty Hospitals

Use this checklist to review how your eye and ear specialty hospital identifies, protects, uses, and responds to incidents involving electronic protected health information (ePHI). HIPAA requirements apply based on your organization’s role and activities, so confirm whether each relevant unit or service is a covered entity, business associate, or part of a covered entity.

How to conduct and manage an ePHI risk analysis

A HIPAA Security Rule risk analysis should assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI your organization holds. Risk management is the follow-up work: selecting and implementing measures to reduce identified risks to a reasonable and appropriate level. HHS guidance on risk analysis explains these requirements.

• Inventory where ePHI lives and moves. Identify systems, applications, devices, storage locations, interfaces, users, and vendors that create, receive, maintain, or transmit ePHI. Include clinical, administrative, billing, backup, and remote-access environments.
• Map data flows. Document how patient information moves between departments, systems, external providers, cloud services, and vendor support teams. Note where it is stored, copied, exported, or accessed remotely.
• Identify threats and vulnerabilities. Consider risks such as misdirected referrals, unauthorized access, phishing, ransomware, lost devices, insecure connections, unpatched systems, failed backups, and excessive access privileges.
• Assess likelihood and potential impact. Record the information involved, affected systems and workflows, existing safeguards, possible harm to confidentiality, integrity, or availability, and the likelihood of each risk.
• Prioritize and manage risks. Assign owners, select reasonable safeguards, set completion dates, and track unresolved risks or documented decisions to use alternative measures.
• Revisit the analysis. Review it when material changes occur, such as a new system, merger, workflow change, incident, or newly recognized threat. The Security Rule requires ongoing protection rather than a one-time assessment. 45 CFR § 164.308
• Keep evidence. Retain the analysis, supporting inventories, risk decisions, remediation plans, approvals, and follow-up reviews under your documentation-retention policies.

HHS describes a thorough analysis as one that may include an inventory of systems and applications used to access or house ePHI, along with an assessment of risks and vulnerabilities. HHS risk analysis and risk management FAQ

Which ophthalmic and audiology systems may handle ePHI

Include a system in your assessment when it creates, receives, maintains, or transmits identifiable health information electronically. The specific technology depends on your hospital’s services and configuration; a device or system is not automatically handling ePHI merely because it is used in a clinical setting.

• Ophthalmic imaging systems: fundus cameras, optical coherence tomography (OCT) systems, retinal imaging platforms, visual-field analyzers, corneal imaging devices, image viewers, and picture archiving and communication systems (PACS) when images or related records can be linked to an individual.
• Audiology systems: audiometers, hearing-assessment platforms, audiogram databases, hearing-device fitting and programming systems, cochlear implant programming systems, and related patient-management software when identifiable patient information is stored or transmitted.
• Shared clinical platforms: electronic health records, scheduling and referral tools, patient portals, telehealth platforms, e-prescribing services, laboratory interfaces, and secure messaging.
• Supporting systems: billing and claims applications, workstations, mobile devices, email, identity and access tools, networked storage, backups, cloud platforms, and audit-log systems if they contain or can expose ePHI.
• Vendor access and data transfers: remote-support tools, service accounts, device maintenance connections, data exports, removable media, and interfaces used to send images, test results, or records to other providers.

For each system, record what information it contains, who can access it, where it is stored, how it connects to other systems, whether a vendor can access it, and how data are backed up and disposed of. HHS notes that the Security Rule applies to all ePHI created, received, maintained, or transmitted by a regulated organization. HHS guidance on risk analysis

What administrative, physical, and technical safeguards should protect ePHI

The HIPAA Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards to protect ePHI. Use your risk analysis to determine which measures fit your hospital’s systems, workflows, size, and risks. An addressable implementation specification is not simply optional: assess whether it is reasonable and appropriate, implement it when it is, or document why it is not and adopt an appropriate alternative when required. 45 CFR § 164.306

Administrative safeguards

• Assign security and privacy responsibilities, including a security official and privacy contact.
• Maintain written policies for risk analysis, risk management, workforce access, security incidents, contingency planning, and business associates.
• Review system activity, such as audit logs and access reports, and investigate suspicious access.
• Use role-based access and promptly approve, change, and remove access when workforce roles change or employment ends.
• Plan for emergencies with retrievable data backups, disaster recovery procedures, and tested continuity arrangements for clinical operations.

Physical safeguards

• Control access to rooms, work areas, server spaces, and storage locations where ePHI or systems that access it are present.
• Position and secure workstations to reduce unauthorized viewing or use, including in exam rooms, imaging areas, audiology booths, and reception spaces.
• Track device and media movement, and establish secure disposal or reuse procedures for equipment that may contain ePHI.

Technical safeguards

• Use unique user identification and access controls that restrict systems to authorized users and software.
• Configure authentication, automatic logoff where appropriate, and audit controls that record and support review of system activity.
• Use measures to protect ePHI from improper alteration or destruction, and protect it while transmitted over electronic networks.
• Review encryption and other technical protections against the risks identified in your assessment, including for portable devices, backups, and data exchanges.

The Security Rule’s administrative, physical, and technical safeguard standards are set out in 45 CFR § 164.308, 45 CFR § 164.310, and 45 CFR § 164.312.

How to manage business associate agreements and subcontractors

A vendor may be a business associate when it creates, receives, maintains, or transmits PHI on your organization’s behalf in performing a service or function. Assess the relationship and the vendor’s actual role; do not assume that a product label or general assurance replaces a required written agreement.

• Identify vendors that may handle PHI, such as EHR or imaging hosts, cloud providers, billing services, data-storage providers, and service companies with access to patient systems.
• Before allowing a business associate to handle PHI, put a compliant business associate agreement (BAA) or other required written arrangement in place.
• Specify permitted and required uses and disclosures, safeguards, reporting of impermissible uses and security incidents, and cooperation with individual rights requests where applicable.
• Require the business associate to ensure that subcontractors handling PHI accept the applicable restrictions and safeguards in writing.
• Set practical incident-reporting timelines, contact methods, cooperation duties, and procedures for returning or destroying PHI when the relationship ends, as applicable.
• Maintain an inventory of agreements and review them when services, data flows, subcontractors, or legal requirements change.

HIPAA requires BAAs to establish permitted uses and disclosures, require appropriate safeguards, address breach and security-incident reporting, and extend relevant protections to subcontractors. HHS sample business associate agreement provisions and HHS business associate guidance describe these requirements.

How to protect patient privacy and provide access to PHI

Use and disclose PHI only as permitted by the Privacy Rule, applicable law, and your organization’s policies. Apply the minimum necessary standard to most uses, disclosures, and requests by taking reasonable steps to limit information to what is needed for the intended purpose. The standard does not apply to disclosures to, or requests by, a health care provider for treatment purposes, among other exceptions. HHS minimum necessary guidance

• Define role-based access for clinical, scheduling, billing, imaging, audiology, and administrative tasks.
• Use procedures for non-routine disclosures and requests that help staff determine what information is reasonably necessary.
• Confirm recipient identity and authority before sending records, images, test results, or referrals.
• Offer individuals a process to request access to PHI in a designated record set, including records maintained on the hospital’s behalf by a business associate.
• Track access-request deadlines and coordinate promptly with business associates that hold relevant records.
• Document permitted denials and follow applicable review and notice procedures.

Generally, a covered entity must act on an individual’s access request within 30 calendar days. If it cannot, it may take one additional 30-day extension by providing the individual, within the initial period, a written explanation and expected response date. These deadlines also apply when a business associate maintains the requested PHI. HHS guidance on access-request timing

What workforce training and sanctions are required

Train workforce members on the privacy and security policies relevant to their job responsibilities. For an eye and ear specialty hospital, tailor examples to situations such as viewing images outside a care need, sending audiograms to the wrong recipient, leaving a workstation open in an exam area, or sharing credentials for a diagnostic device.

• Provide required privacy training to new workforce members within a reasonable period after they join.
• Provide additional training within a reasonable period when a material policy or procedure change affects a person’s duties.
• Maintain a security awareness and training program for the workforce, including management, and address security risks relevant to your environment.
• Document training and keep policies and procedures current.
• Establish and apply appropriate sanctions when workforce members fail to follow applicable privacy or security policies.

HIPAA does not set a universal annual certificate-renewal requirement for every workforce member. Training timing must follow the applicable requirements and your organization’s policies; additional or recurring training may be appropriate based on risk, job duties, incidents, and policy changes. The Privacy Rule specifies training for new workforce members and after material changes, while the Security Rule requires a security awareness and training program. 45 CFR § 164.530 and 45 CFR § 164.308

How to assess, document, and report breaches

Maintain procedures for promptly reporting, containing, investigating, and documenting suspected privacy or security incidents. An impermissible use or disclosure of PHI is generally presumed to be a breach unless an exception applies or the covered entity or business associate demonstrates a low probability that the PHI was compromised through a risk assessment.

• Contain and preserve evidence. Secure affected accounts and systems, preserve relevant logs and communications, and take reasonable steps to stop further access or disclosure.
• Assess the incident. Document the types of PHI and identifiers involved, who received or used the information, whether it was actually acquired or viewed, and what mitigation steps were taken.
• Decide and record whether notification is required. Document the breach analysis, any applicable exception, and the basis for a conclusion that notification is not required.
• Coordinate with business associates. Ensure agreements identify how incidents and breaches are reported, how affected individuals are identified, and how the parties will support investigation and notification.
• Notify on time when required. Covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. Additional notices to HHS and, in certain cases, the media may also be required.
• Keep complete records. Retain incident reports, investigation findings, risk assessments, mitigation steps, decisions, notices, and proof of notification under applicable documentation policies.

A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery; the BAA may require faster reporting. HHS Breach Notification Rule guidance explains notification duties and the assessment used to determine whether PHI was compromised.

In summary, a practical HIPAA compliance checklist connects a complete ePHI inventory and risk analysis to safeguards, vendor agreements, patient privacy procedures, workforce training, and a documented incident-response process. Review these controls regularly and update them when your systems, services, or risks change.

FAQs

Which specialty clinical systems should be included in an ePHI risk analysis?

Include every system that creates, receives, maintains, or transmits identifiable electronic health information. Depending on your hospital’s configuration, this may include ophthalmic imaging systems such as OCT, fundus photography, visual-field testing, PACS, audiology systems such as audiometers and hearing-device programming systems, EHRs, patient portals, billing tools, interfaces, backups, workstations, mobile devices, cloud services, and vendor remote-support access.

What must a business associate agreement require?

A BAA must establish permitted and required uses and disclosures of PHI, require appropriate safeguards, address reporting of impermissible uses and breaches, require relevant subcontractors to accept equivalent restrictions, and address other required duties such as supporting individual rights requests and return or destruction of PHI when feasible at termination. HHS sample BAA provisions

How soon must a hospital notify affected individuals after discovering a breach?

For a breach of unsecured PHI, the hospital must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Other notices may also be required, depending on the number and location of affected individuals. HHS Breach Notification Rule guidance

When must business associates report a breach to the covered entity?

A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI. The BAA may set a shorter reporting period, so check the contract and follow its applicable deadlines. HHS guidance on business associate breach notification