HIPAA Compliance Checklist for Health Care Sharing Ministries (HCSMs)

Assess HIPAA Applicability to HCSMs

Start by determining whether HIPAA legally applies to your organization. Many Health Care Sharing Ministries do not function as health plans, but you may handle protected health information (PHI) or perform services that trigger HIPAA obligations.

Determine your role

• Covered entity check: Confirm whether you operate as a health plan, a health care provider that transmits standard electronic transactions, or a health care clearinghouse.
• Business associate check: Identify services you provide for covered entities (for example, claims administration, billing support, utilization review) that involve creating, receiving, maintaining, or transmitting PHI.
• Transaction review: Note any standard electronic health care transactions you exchange (eligibility, claims, remittance) that could indicate covered activities.

Map data flows and document the decision

• Inventory systems, vendors, volunteers, and programs that touch PHI, including intake forms, portals, email, and file shares.
• Classify data by sensitivity and identify where PHI is collected, used, disclosed, stored, and destroyed.
• Record your applicability analysis, decision rationale, and evidence. Revisit at least annually or upon major operational changes.

Even if you determine HIPAA does not directly apply, adopt the framework as a privacy-by-design baseline and align with state privacy laws and contractual obligations.

Develop Written Policies and Procedures

Written privacy policies and security procedures are the backbone of compliance. They guide day-to-day decisions, set expectations, and prove due diligence.

Core privacy policies

• Uses and disclosures: Define permissible sharing of PHI, the minimum necessary standard, and authorization requirements.
• Individual rights: Describe how you handle access, amendments, and accounting of disclosures when applicable.
• Complaint handling and sanctions: Explain how individuals can raise concerns and how you enforce policy violations.
• Notice of Privacy Practices (if applicable): Prepare and maintain an accurate notice when you operate as a covered entity.

Security procedures

• Access management: Role-based access, joining/leaving processes, and periodic access reviews.
• Information lifecycle: Data classification, retention schedules, secure disposal, and media sanitization.
• System standards: Encryption expectations, endpoint hardening, secure configuration baselines, and logging requirements.
• Remote/third-party work: Rules for personal devices, secure file transfer, and volunteer access to systems containing PHI.

Documentation control

• Designate policy owners, version and approval history, and formal review cadences.
• Map training requirements to each policy and require workforce acknowledgments.

Implement Workforce Training

Your workforce—staff, volunteers, and contractors—must know how to handle PHI responsibly. Effective training turns policies into consistent behavior.

• Onboarding and annual refreshers: Provide baseline privacy and security instruction to everyone with PHI access.
• Role-based modules: Tailor scenarios for member services, IT, finance, and leadership.
• Practical focus: Recognize PHI, apply minimum necessary, verify identity before disclosure, and follow secure communication channels.
• Security awareness: Phishing simulations, password hygiene, multi-factor authentication (MFA), and incident reporting.
• Tracking and accountability: Keep attendance logs, test scores, acknowledgments, and documented sanctions for noncompliance.

Establish Risk Management Practices

HIPAA expects a formal risk analysis and ongoing risk management. This disciplines how you find, prioritize, and mitigate threats to PHI.

Perform a risk analysis

• Asset inventory: Catalog systems, devices, applications, data stores, and vendors that create, receive, maintain, or transmit PHI.
• Threats and vulnerabilities: Evaluate technical, administrative, and human risks (misdelivery, misconfiguration, social engineering, loss/theft).
• Likelihood and impact: Score scenarios to surface material risks to confidentiality, integrity, and availability.
• Control evaluation: Identify existing safeguards and residual risk; document assumptions and evidence.

Run a living risk management program

• Mitigation plans: Define owners, timelines, budgets, and success metrics for prioritized risks.
• Continuous monitoring: Patch management, vulnerability scanning, log review, and configuration baselines.
• Vendor oversight: Conduct pre-contract and periodic risk reviews, especially for services handling PHI.
• Change management: Reassess risk during system upgrades, new integrations, or process changes.

Keep your risk analysis and risk register current; update them at least annually or after significant incidents or changes.

Enforce Administrative and Technical Safeguards

Translate policy into action with administrative safeguards and technical safeguards that protect PHI throughout its lifecycle.

Administrative safeguards

• Governance: Appoint privacy and security officials; empower a cross-functional committee to track compliance.
• Workforce controls: Background checks where appropriate, role-based access, sanction policy, and periodic access reviews.
• Contingency planning: Data backup, disaster recovery, emergency mode operations, and plan testing.
• Third-party management: Due diligence, contract terms, and oversight for vendors with PHI.
• Evaluation: Regular internal audits and management reviews of your HIPAA program.

Technical safeguards

• Access control: Unique user IDs, MFA, least-privilege permissions, and session timeouts.
• Encryption: Protect PHI in transit and at rest across servers, databases, backups, and mobile devices.
• Audit controls: Centralized logging, immutable logs, alerting for anomalous activity, and periodic log review.
• Integrity protections: Checksums, secure backups, versioning, and change monitoring to prevent unauthorized alteration.
• Transmission security: TLS for web apps and APIs, secure email gateways, and vetted file transfer solutions.
• Endpoint and network security: EDR/antimalware, patching, device encryption, network segmentation, and secure configurations.

Complement these with practical physical safeguards—secured facilities and device protections—to complete your control set.

Manage Business Associate Agreements

Whenever a vendor or partner handles PHI on your behalf, you must have appropriate business associate agreements (BAAs) and documented oversight.

Decide when a BAA is required

• Identify services that create, receive, maintain, or transmit PHI (cloud hosting, email, billing, analytics, support).
• Confirm subcontractors also sign downstream BAAs before they access PHI.

Build strong BAAs

• Permitted uses/disclosures and minimum necessary requirements.
• Security obligations: administrative safeguards and technical safeguards expected of the vendor.
• Incident and breach notification duties, including timelines and required details.
• Subcontractor flow-down, right to audit or obtain attestations, and cooperation in investigations.
• Termination rights and the return or secure destruction of PHI at contract end.

Operationalize vendor oversight

• Maintain a vendor inventory with BAA status, purpose, data types, and renewal dates.
• Collect security documentation, track remediation commitments, and review performance periodically.
• Prohibit PHI sharing until a fully executed BAA is in place.

Conduct Incident and Breach Response

Prepare for security incidents so you can act quickly, reduce harm, and meet breach notification requirements when applicable.

Build and test your plan

• Define an incident, roles, escalation paths, and decision criteria for declaring a breach.
• Establish intake channels for reports, 24/7 response expectations, and evidence preservation steps.
• Run tabletop exercises and simulations to validate the plan and train responders.

Assess and notify

• Contain and investigate: Is PHI involved? What systems and individuals are affected?
• Risk assessment: Evaluate the nature of PHI, unauthorized person, whether PHI was actually acquired or viewed, and mitigation.
• Breach notification: When required, issue timely notifications to affected individuals and other parties as applicable, with clear facts and protective steps.
• Documentation: Keep detailed records of decisions, timelines, and communications.

Improve after the incident

• Root cause analysis and corrective actions to close control gaps.
• Update privacy policies, procedures, and training content based on lessons learned.
• Refresh your risk analysis and risk register to reflect new realities.

Summary

To build a defensible HIPAA program for an HCSM, confirm applicability, publish clear privacy policies, train your workforce, conduct a rigorous risk analysis, enforce administrative safeguards and technical safeguards, execute strong business associate agreements, and maintain a tested incident and breach response plan. Treat compliance as an ongoing practice, not a one-time project.

FAQs.

Are Health Care Sharing Ministries subject to HIPAA compliance?

Often, HCSMs are not HIPAA-covered entities because they typically are not health plans. However, HIPAA can still apply if you perform covered functions or act as a business associate for a covered entity. Regardless, you should handle protected health information under HIPAA-aligned controls and comply with relevant state privacy laws and contracts.

What are the key safeguards needed for HIPAA compliance?

Focus on administrative safeguards (governance, policies, training, vendor oversight, contingency planning) and technical safeguards (access control, MFA, encryption, logging, integrity controls, secure transmission, endpoint and network security). Round out the program with practical physical protections for facilities and devices that store or process PHI.

How to handle PHI in HCSMs?

Collect only the minimum necessary PHI, store it securely with encryption, and restrict access based on roles. Use approved channels for sharing, de-identify data when possible, and monitor for unauthorized disclosures. Execute business associate agreements before any vendor receives PHI, honor applicable individual rights requests, retain only as long as needed, and securely dispose of records when no longer required.