HIPAA Compliance Checklist for GI Breath Testing Services

Use this HIPAA compliance checklist for GI breath testing services to identify patient information, assess whether HIPAA applies, and strengthen safeguards for test orders, results, and related records. HIPAA obligations depend on your organization’s role and how it handles protected health information (PHI); this checklist is a practical starting point, not a legal determination.

Which GI breath testing records qualify as PHI or ePHI?

A breath test result is PHI when it identifies a patient—or could reasonably be used to identify them—and relates to their health, care, or payment for care. Records may include hydrogen or methane results, test orders, preparation instructions linked to a patient, appointment details, provider referrals, billing records, and communications about the test. HHS guidance on individually identifiable health information explains that medical records and laboratory reports linked to a patient are PHI.

When PHI is created, received, maintained, or transmitted electronically, it is electronic protected health information (ePHI). This can include information in an electronic health record, scheduling or billing system, test device, email, cloud storage, or backup. Paper and spoken information can still be PHI, even though they are not ePHI.

• Identify where patient identifiers appear alongside test results, orders, or payment details.
• Track copies and exports, including spreadsheets, device downloads, scanned forms, and vendor-hosted records.
• Do not treat information as de-identified merely because a name has been removed; assess whether the person could still be identified under HIPAA’s de-identification rules.

How can a GI breath testing service assess HIPAA applicability?

Determine whether your organization is a covered entity, a business associate, both, or neither. A health care provider is generally a HIPAA covered entity if it conducts—or has another party conduct on its behalf—certain standard health care transactions electronically, such as electronic claims. HHS’s covered-entity guidance describes the categories of organizations subject to HIPAA.

A testing service may also be a business associate if it handles PHI on behalf of a covered clinic, laboratory, or other covered entity. The arrangement depends on what each party does; providing care or sending a claim does not by itself make every provider a business associate of a payer. Review who determines the purpose of the work, who bills, whose patients are served, and which party creates, receives, maintains, or transmits the records. HHS business associate guidance explains the relationship and its contractual requirements.

• Map your clinical, laboratory, billing, and technology workflows, including services performed by outside vendors.
• Document the basis for your HIPAA status and revisit it when your services, transaction practices, or contractual relationships change.
• Remember that an organization that is not a covered entity may still have HIPAA obligations as a business associate.

What should an ePHI risk assessment cover?

A Security risk analysis should identify the ePHI your service creates, receives, maintains, or transmits; the systems and locations involved; and threats or vulnerabilities that could affect its confidentiality, integrity, or availability. Consider test analyzers and connected workstations, scheduling and results systems, mobile devices, email, remote access, cloud services, paper-to-electronic workflows, and backups. HHS risk analysis guidance describes the assessment as a foundation for selecting safeguards.

For each risk, document existing controls, likelihood and potential impact, and the steps your service will take to manage it. Assign owners and track remediation through completion. HIPAA requires an ongoing process, but it does not set one universal calendar interval for every service to repeat its assessment; reassess when material changes or newly recognized risks warrant it. HHS guidance on Security Rule evaluations describes periodic evaluation and attention to environmental or operational changes.

• Inventory ePHI, systems, users, vendors, locations, and data flows.
• Evaluate access, misdirected results, device loss, unauthorized changes, outages, malware, and failures to restore data.
• Record risk decisions, selected safeguards, responsible owners, and follow-up actions.

How should staff access, use, and disclose patient information?

Set written rules for who may access each category of information and for which job duties. Use role-based access control so, for example, staff responsible for scheduling can perform their tasks without automatically receiving access to every clinical detail or billing record. Review permissions when someone changes roles or leaves, and use individual accounts rather than shared logins.

Apply the minimum necessary standard where it applies: make reasonable efforts to limit PHI used, disclosed, or requested to what is needed for the purpose. The standard does not apply to disclosures to, or requests by, a health care provider for treatment, but role-based workforce access policies still matter. HHS minimum necessary guidance explains the standard and its exceptions.

• Verify identity and authority before releasing results, discussing a patient by phone, or responding to a record request.
• Use approved communication channels and check recipients before sending test results or reports.
• Train staff on service-specific policies, patient privacy, security incidents, and escalation procedures; document completion and address policy violations consistently.

Which administrative, physical, and technical safeguards should be in place?

Choose safeguards based on your documented risks and the HIPAA Security Rule. Administrative measures include assigning security responsibility, workforce procedures, security training, incident handling, risk management, and periodic evaluation. Physical measures include controlling facility and workstation access and securely managing devices and media.

Technical measures should allow only authorized access, protect information from improper alteration or destruction, verify user identity, and safeguard ePHI transmitted over networks. Implement audit controls that record and help you examine activity in systems containing ePHI. Encryption is an addressable implementation specification, so assess whether it is reasonable and appropriate for your circumstances and document your decision and any alternative measure. HHS’s Security Rule summary describes the safeguard standards and their implementation specifications.

• Use unique user identification, strong authentication, and timely access changes.
• Review audit logs for unusual access, exports, failed logins, or changes to test records.
• Secure work areas and screens, protect devices from loss, and dispose of media safely.
• Document policies, risk decisions, training, evaluations, and corrective actions.

How should services manage business associates and incident response?

Identify vendors and subcontractors that create, receive, maintain, or transmit PHI on your behalf, such as cloud storage, IT support, billing, or results-management providers. When a business associate relationship exists, put a written business associate agreement in place before the relevant PHI is shared. The agreement should address permitted uses, safeguards, incident reporting, and the business associate’s responsibilities. HHS business associate guidance describes these contract requirements.

Maintain a response process for suspected or known security incidents. Staff should promptly report a lost device, misdirected result, unauthorized access, ransomware event, or unexpected system activity to the designated response lead. Preserve relevant records, contain the incident where feasible, investigate what happened, and document the outcome and corrective steps.

For a suspected impermissible use or disclosure, perform and document a breach notification assessment. An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised, based on the required factors. If notification is required, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery; a business associate must notify the covered entity without unreasonable delay and no later than 60 days. HHS breach notification guidance explains the assessment and notice obligations.

How can services test backups and recovery procedures?

Maintain a contingency plan that covers retrievable copies of ePHI, disaster recovery, and continued protection of ePHI during emergency operations. Identify which records and systems are essential to patient care and service continuity, including test results, orders, scheduling, and billing data. The Security Rule also includes an addressable implementation specification for periodic testing and revision of contingency plans. HHS ransomware guidance discusses backup, recovery, emergency operations, and contingency-plan testing.

• Periodically restore test data in a controlled environment and confirm it is complete, readable, and usable.
• Exercise recovery steps for a system outage or unavailable vendor, and confirm staff know how to access the information needed to continue critical work.
• Record test results, gaps, corrective actions, and updates to the contingency plan.

A practical HIPAA compliance checklist brings together accurate PHI inventories, a documented Security risk analysis, appropriate access and disclosure rules, administrative, physical, and technical safeguards, business associate agreements, incident response, and tested recovery procedures. Revisit those controls as your service and its risks change.

FAQs

Do GI breath test results qualify as PHI under HIPAA?

They qualify as PHI when they identify a patient, or could reasonably be used to identify one, and relate to the person’s health, care, or payment for care in the hands of a covered entity or business associate. Electronic versions are ePHI.

When does a GI breath testing provider need a business associate agreement?

A business associate agreement is generally needed when the provider is acting as a business associate and creates, receives, maintains, or transmits PHI on behalf of a covered entity or another business associate. Whether that relationship exists depends on the parties’ actual roles and services.

How often should a service reassess ePHI risks?

HIPAA calls for an ongoing security process and periodic evaluation, but does not prescribe one universal reassessment schedule for every service. Revisit risks when systems, workflows, vendors, or operations change, and when new threats or vulnerabilities are identified.

What should a GI breath testing service do after a suspected breach?

Promptly report and investigate the incident, contain it where feasible, preserve relevant evidence, and document what happened and what information may be involved. Complete a breach notification assessment and coordinate required notices with the covered entity or business associate, as applicable. Required notices must be made without unreasonable delay and within the applicable HIPAA deadlines.