HIPAA Compliance Checklist for Life Care Planning Firms

HIPAA compliance for a life care planning firm depends on the firm’s role and the information it handles. A firm is not automatically covered by HIPAA merely because it prepares life care plans or receives medical records. Determine whether the firm is a covered entity or a business associate, then use this checklist to guide how you identify, use, protect, and respond to issues involving protected health information (PHI).

Identify Protected Health Information

Start by identifying what PHI the firm creates, receives, maintains, or transmits—and in what capacity. PHI generally means individually identifiable health information handled by a covered entity or business associate. A life care plan may include diagnoses, treatment histories, medications, functional limitations, provider details, and projected care needs; when linked to an identifiable person in a HIPAA-regulated context, those details may be PHI.

• Inventory records and systems that may contain PHI, including case files, assessments, emails, shared drives, mobile devices, and paper documents.
• Identify where the information comes from, who can access it, how it is shared, and how long it is retained.
• Separate PHI from information that has been properly de-identified, and avoid assuming that removing a name alone makes a record de-identified.
• Document whether the firm acts as a covered entity, business associate, subcontractor, or neither for each relevant relationship.

Keep the distinction clear: HIPAA duties depend on the firm’s legal role and the circumstances in which it handles the information, not simply on the fact that health-related information appears in a life care plan.

Establish Permitted Uses and Disclosures

Set written rules for when staff may use or disclose PHI and who may receive it. Confirm that each use or disclosure is permitted by the firm’s role, applicable HIPAA requirements, and any relevant authorization or agreement. When HIPAA’s minimum necessary standard applies, limit access, use, and disclosure to what is reasonably needed for the intended purpose; this standard does not apply to every type of disclosure, so staff should follow the rules for the specific situation.

• Define approved purposes for accessing and using records, such as preparing an assigned life care plan.
• Verify recipients and use secure, approved methods when sharing plan materials or source records.
• Limit routine access by role, and use a review process for unusual or broad requests.
• Document authorizations, disclosure decisions, and any restrictions the firm must honor.
• Establish procedures for responding to requests from clients, attorneys, insurers, providers, or other parties.

Make sure staff know that a client’s involvement in a legal matter does not, by itself, authorize every use or disclosure of the client’s PHI.

Implement Administrative Safeguards

If the firm is subject to HIPAA’s Security Rule, establish administrative safeguards for electronic protected health information (ePHI). Begin with a documented risk analysis that identifies potential threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Use the findings to select and manage appropriate safeguards, and revisit risks as the firm’s systems, work practices, and vendors change.

• Assign responsibility for privacy and security oversight, including who receives reports and coordinates follow-up.
• Maintain written policies for access, record handling, remote work, retention, disposal, and security incidents.
• Use workforce procedures to approve access, change permissions when duties change, and promptly remove access when a worker leaves.
• Keep a contingency plan for restoring access to essential ePHI after an outage or other disruption.
• Review whether safeguards remain effective and document risk-management decisions and updates.

Administrative safeguards are part of the broader HIPAA Security Rule framework, which also includes physical and technical safeguards. Choose measures that fit the firm’s risks and document how they are implemented.

Secure Electronic Protected Health Information

Protect ePHI wherever it is stored, accessed, or transmitted. The HIPAA Security Rule calls for appropriate administrative, physical, and technical safeguards; technical safeguards include technology and the policies and procedures governing its use to protect ePHI and control access.

• Use unique user accounts and access controls so staff can reach only the information needed for their work.
• Use encryption where appropriate for stored files, portable devices, and electronic transmissions.
• Use secure, approved platforms for document storage, collaboration, and file transfer.
• Set procedures for device security, backups, system updates, and secure disposal or reuse of equipment.
• Review access records and security alerts for unexpected activity, and maintain a process for investigating security incidents.
• Address risks from remote access, personal devices, email, and cloud services in policies and safeguards.

Do not treat a vendor’s security claims or a software purchase as proof of compliance. Assess the firm’s actual use of the system, its access settings, and the risks to ePHI.

Manage Business Associate Agreements

A life care planning firm may be a business associate when it performs services for a covered entity that involve creating, receiving, maintaining, or transmitting PHI. Whether a business associate agreement (BAA) is needed depends on the relationship and the service—not merely on whether the firm handles health information. A covered entity generally must obtain satisfactory written assurances from a business associate that it will safeguard PHI and meet applicable obligations.

• Review each client, referral, and vendor relationship to determine whether the firm acts on behalf of a covered entity or business associate.
• Execute a BAA before a business associate relationship involving PHI begins, where required.
• Check that the agreement describes permitted uses and disclosures, safeguarding duties, incident reporting, and applicable subcontractor obligations.
• Review vendor access to PHI and determine whether vendors or subcontractors need their own agreements.
• Keep signed agreements, track renewal or termination, and remove access when a relationship ends.

Not every exchange of PHI requires a BAA. For example, HHS describes exceptions and other situations where a party is not acting on behalf of a covered entity or business associate. Assess the facts of each arrangement rather than relying on a blanket rule.

Train Staff on HIPAA Requirements

Train employees and other workforce members on the firm’s policies before they handle PHI and whenever their responsibilities or procedures change. Make the training practical: staff should understand how to access records, share information appropriately, protect devices, and report suspected mistakes or security incidents.

• Explain what PHI is and how the firm’s HIPAA role affects the workforce member’s duties.
• Use examples involving life care plans, source medical records, email, case discussions, and document delivery.
• Teach staff to apply the minimum necessary standard where it applies and to follow approved disclosure procedures.
• Provide clear instructions for reporting lost devices, misdirected files, unauthorized access, or other suspected incidents.
• Document training completion and address recurring errors with follow-up instruction or appropriate corrective action.

Include contractors and temporary personnel in the firm’s procedures when they are part of the workforce or otherwise have permitted access to PHI. Reinforce that uncertainty should prompt staff to pause and ask the designated privacy or security contact.

Prepare for Breach Response

Maintain a written process for investigating suspected breaches and other security incidents. A breach generally involves an impermissible use or disclosure that compromises the privacy or security of PHI. HIPAA’s breach notification requirements apply to breaches of unsecured PHI, subject to the applicable assessment and exceptions.

• Direct staff to report a suspected incident promptly and preserve relevant records and evidence.
• Contain the incident where possible, such as by securing an account, recovering a misdirected file, or restricting access.
• Document what happened, what information was involved, who may have received or accessed it, and what mitigation occurred.
• Assess the incident under the applicable rules and agreements, and determine which party is responsible for required notices.
• If the firm is a business associate, notify the covered entity as required by the BAA and applicable HIPAA rules.
• Maintain records showing that required notifications were made or documenting why notification was not required.

For a breach of unsecured PHI, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery; business associates must notify the covered entity under applicable requirements. The required notices and recipients depend on the circumstances, so involve qualified privacy or legal personnel promptly.

In summary, a practical HIPAA checklist for a life care planning firm starts by determining its role, identifying PHI, and controlling permitted uses and disclosures. It then connects administrative safeguards, technical safeguards, vendor agreements, staff training, and a documented breach response into an ongoing compliance process.

FAQs.

Does HIPAA apply to life care planning firms?

Not automatically. HIPAA applies to covered entities and business associates as defined by the law. A life care planning firm should assess whether it performs services on behalf of a covered entity or business associate that involve PHI, and whether it independently meets the definition of a covered entity. Handling health information alone does not automatically make a firm subject to HIPAA.

What counts as protected health information in a life care plan?

Health information that identifies an individual—or could reasonably be used to identify them—may be PHI when it is created, received, maintained, or transmitted by a covered entity or business associate. In a life care plan, this may include diagnoses, treatment history, medications, medical records, provider information, and care needs when linked to an identifiable person.

When does a life care planning firm need a business associate agreement?

A firm generally needs a BAA when it is acting as a business associate for a covered entity or another business associate and the relationship involves PHI. The agreement should be in place where required before the firm handles PHI in that role. Whether a BAA is necessary depends on the specific relationship and service; not every party that receives health information is a business associate.

What should a firm do after discovering a breach of protected health information?

Promptly report and investigate the incident, contain ongoing exposure where possible, preserve relevant evidence, and document the information involved and steps taken. Determine the firm’s role and notification duties under HIPAA and any applicable BAA. A business associate must notify the covered entity as required, while covered entities must assess and provide any required notifications for a breach of unsecured PHI.