HIPAA Compliance Checklist for Huntington Disease Centers of Excellence

A Huntington Disease Center of Excellence should build its HIPAA program around the information it handles, the systems it uses, and the people and vendors who can access patient information. The “Center of Excellence” designation does not, by itself, determine whether an organization is a HIPAA covered entity; that depends on whether it meets HIPAA’s definition, including whether it is a health care provider that conducts certain standard electronic transactions. See HHS guidance on covered entities and business associates.

Use this checklist to organize your compliance work. Adapt it to the center’s actual services, workforce, research activities, systems, and applicable state requirements; it is not a substitute for legal advice.

How to conduct and document a security risk analysis

The HIPAA Security Rule requires an accurate and thorough assessment of risks and vulnerabilities to the confidentiality, integrity, and availability of all electronic protected health information (ePHI) the center creates, receives, maintains, or transmits. The rule does not prescribe a single method or schedule. HHS explains the requirement in its Guidance on Risk Analysis.

• Define the scope. Inventory systems and workflows that contain or transmit ePHI. Depending on the center’s services, these may include the electronic health record, scheduling and billing systems, genetic testing workflows, patient portals, telehealth platforms, research systems, mobile devices, email, backups, and vendor-hosted services.
• Identify threats and vulnerabilities. Consider risks such as inappropriate access, lost or stolen devices, phishing, system outages, vendor incidents, and improper disposal. Record the systems and information affected.
• Assess and prioritize risk. Document the likelihood and potential impact of each risk, the safeguards already in place, and the remaining risk. HHS recommends recording risk levels and corrective actions as outputs of the analysis.
• Create a risk management plan. For each priority item, identify the planned safeguard or other response, a responsible owner, a target date, and how the center will track completion. Risk analysis identifies and evaluates risks; risk management implements measures to address them.
• Keep the analysis current. Review it when relevant systems, services, vendors, or workflows change and after security incidents. HHS says the Security Rule does not set a fixed risk-analysis interval; the process should be ongoing and adjusted to the organization’s circumstances. See HHS risk analysis guidance.

Keep the assessment, supporting inventory, risk decisions, and risk management plan together so the center can show how it identified risks and responded to them. The Security Rule requires documentation but does not mandate a particular format; see HHS’s Security Rule summary.

Which HIPAA policies and procedures should the center maintain?

Maintain written or electronic policies and procedures that reflect the center’s operations and explain how staff protect PHI and ePHI. A useful policy set generally covers:

• Privacy and security responsibilities, including the designated privacy official and security official.
• Permitted uses and disclosures of PHI, role-based access, and the minimum necessary standard when it applies.
• The Notice of Privacy Practices (NPP), including how the center provides, posts, and updates it when applicable.
• Patient requests, including requests for access, amendment, confidential communications, restrictions, or an accounting of disclosures.
• Workforce authorization, access changes, security awareness, sanctions, and reporting suspected privacy or security problems.
• Security safeguards, incident response, contingency planning, backups, and the handling and disposal of devices and media.
• Business associate selection, agreements, incident reporting, and oversight.
• Documentation, record retention, and secure disposal procedures.

Apply the minimum necessary standard to uses, disclosures, and requests for PHI when required, using policies that define which workforce roles need access and what information they need. The standard has exceptions, including disclosures to or requests by a health care provider for treatment. See HHS guidance on the minimum necessary requirement.

If the center is a covered provider, its NPP should explain applicable privacy practices and individual rights. HHS describes NPP content and availability in its Notice of Privacy Practices guidance. Review policies when the center’s operations or applicable requirements change, and make current procedures available to the staff responsible for following them.

How should staff HIPAA training be documented?

Train workforce members on the HIPAA policies and procedures relevant to their duties. The Privacy Rule requires training for workforce members as necessary and appropriate for their functions, including new workforce members within a reasonable period and affected staff after a material policy change. It also requires the center to document that training was provided. See the HHS HIPAA Audit Protocol.

For each training, keep records that identify the attendee, training date, topics covered, and the materials or policy version used. Retain attendance records, completion acknowledgments or test results, and records of follow-up for missed training. Tailor examples to staff responsibilities—for example, front-desk disclosures, clinician access, genetic testing workflows, telehealth, research, and vendor coordination where applicable.

A completion certificate or signed acknowledgment is evidence that a person completed a training activity; it is not a certification that the organization is HIPAA compliant. HIPAA does not set a universal annual certificate-renewal requirement. The center may set an annual schedule as its own policy or to meet other applicable requirements, but it should distinguish that internal schedule from HIPAA’s specific training and documentation requirements.

How to identify business associates and manage agreements

Review vendors and other outside parties based on what they do with PHI, not just the service name or the contract label. A business associate generally performs a function or service for a covered entity involving the creation, receipt, maintenance, or transmission of PHI. Depending on their role, the center’s vendors may include billing or practice-management services, cloud hosting, IT support, telehealth platforms, and records-disposal providers. HHS provides examples in its Business Associates guidance.

When a business associate relationship exists, obtain a written business associate agreement (BAA) or other compliant written arrangement before permitting the business associate to handle ePHI on the center’s behalf. The agreement should establish permitted uses and disclosures, require appropriate safeguards, address incident and breach reporting, and cover relevant subcontractors. See HHS’s sample business associate agreement provisions.

• Maintain an inventory of vendors that may handle PHI and document whether each is a business associate.
• Keep signed agreements, renewal or amendment records, and any related security assessments in a retrievable location.
• Review vendor access and services when the relationship changes or ends, and address return, destruction, or continued protection of PHI as applicable.

What safeguards protect Huntington disease patient information?

The HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards for ePHI. For a Huntington disease center, tailor safeguards to the systems and workflows actually in use, including clinical records, genetic testing information, family history, counseling, and research information where applicable. HHS summarizes the safeguard requirements in The Security Rule.

• Administrative safeguards: Assign security responsibilities, train staff, manage workforce access, review security events, maintain a risk management process, and prepare for emergencies and system outages.
• Physical safeguards: Control access to areas and equipment, protect workstations from unauthorized viewing or use, and manage devices and media that contain ePHI.
• Technical safeguards: Use appropriate access controls, user authentication, audit controls, integrity protections, and transmission security for systems containing ePHI.
• Operational safeguards: Use role-based permissions, promptly remove access when a staff member changes roles or leaves, monitor access where appropriate, and securely dispose of PHI and media.

Encryption is an addressable implementation specification under the Security Rule—not a blanket requirement that applies identically to every system. The center must assess whether encryption is reasonable and appropriate in its circumstances; if it does not implement it, it must document the decision and follow the rule’s requirements for alternatives or rationale. See HHS guidance on encryption.

How should the center handle patient privacy requests and incidents?

Give staff a clear process for routing patient requests to the person responsible for privacy. Under applicable Privacy Rule requirements, covered entities must address individual rights that include access to PHI in designated record sets, requests to amend records, and requests for an accounting of certain disclosures. Patients may also request confidential communications. The center should log requests, document its responses, and coordinate with any business associate holding relevant information. See HHS guidance on individual access to medical records.

Provide and maintain the NPP when required, and make it available in the ways applicable to the center. A current NPP helps patients understand the center’s privacy practices and how to raise concerns; see HHS NPP guidance.

Document suspected privacy or security incidents, including the date discovered, information and systems involved, investigation steps, corrective action, and the decision about whether notification is required. For a breach of unsecured PHI, the Breach Notification Rule generally requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery. Other notifications may apply depending on the number of people affected and the circumstances. Keep records supporting either the notifications made or the determination that notification was not required. See the HHS Breach Notification Rule guidance.

Which HIPAA records must be retained and for how long?

HIPAA generally requires covered entities to retain documentation required by the Privacy Rule and Security Rule for six years from the date it was created or the date it was last in effect, whichever is later. That can include policies and procedures, required assessments and activities, training documentation, written communications, and records of required designations. See 45 CFR Part 164.

To support compliance, organize records such as risk analyses and risk management plans, policy versions, training logs, BAAs, patient-request logs, incident investigations, breach assessments and notifications, and applicable NPP versions. Apply the six-year rule to documentation that HIPAA requires you to retain, and check whether other laws or obligations require longer retention.

Do not confuse HIPAA compliance-documentation retention with medical-record retention. HHS states that the HIPAA Privacy Rule does not set a general retention period for medical records; state law and other applicable requirements may govern how long the center must keep them. The center must protect PHI for as long as it maintains the information, including during disposal. See HHS guidance on medical record retention.

In practice, a center should keep its risk assessment current, maintain clear policies and training records, manage vendor agreements, protect information through appropriate safeguards, document privacy requests and incidents, and apply the correct retention rule to each record type.

FAQs

How often should a Huntington Disease Center of Excellence review its HIPAA risk analysis?

HIPAA does not prescribe a fixed review interval. HHS describes risk analysis as an ongoing process; review its HIPAA risk analysis when changes in systems, services, vendors, or workflows could affect ePHI security, and after relevant incidents. An annual review may be a useful internal schedule, but it is not a universal HIPAA deadline. See HHS risk analysis guidance.

What records should the center keep to document HIPAA staff training?

Keep records showing who was trained, when training occurred, what topics and materials were covered, and whether the person completed or acknowledged it. Also document follow-up training when needed. The Privacy Rule requires documentation that training was provided but does not require a universal annual training certificate. See the HHS HIPAA Audit Protocol.

When is a business associate agreement required?

A BAA or other compliant written arrangement is generally required when a business associate creates, receives, maintains, or transmits PHI on behalf of the covered entity. Assess the party’s actual function and access to PHI; a vendor relationship alone does not determine business associate status. See HHS Business Associates guidance.

How long must HIPAA compliance documentation be retained?

Retain documentation required by HIPAA for six years from its creation or the date it was last in effect, whichever is later. This does not create a general six-year medical-record retention rule; medical-record retention is generally governed by state law and other applicable requirements. See 45 CFR Part 164 and HHS medical record retention guidance.