HIPAA Compliance Checklist for Lyme Disease Integrative Practices

Use this checklist to review how your Lyme disease integrative practice handles patient information—from intake forms and lab reports to symptom logs, treatment notes, and referrals. HIPAA obligations depend on your role and activities, so first confirm whether the rules apply to your practice.

Determine whether your practice is a covered entity or business associate

A health care provider is generally a HIPAA covered entity if it conducts certain standard electronic transactions, such as submitting claims electronically. A practice’s integrative focus or Lyme disease specialty does not by itself determine HIPAA status. Review how your organization bills, receives payment, and handles electronic health care transactions against HHS guidance on covered entities and business associates.

• Identify the legal entity or individual operating the practice and the health care services it provides.
• Determine whether the practice conducts covered transactions electronically, directly or through a billing service.
• Check whether your practice performs services involving protected health information (PHI) on behalf of another covered entity. In that role, you may be a business associate.
• Document the determination and revisit it if your billing, services, or contractual relationships change.

If HIPAA applies, identify the specific covered entity and business associate responsibilities involved. If you are unsure how your transaction arrangements affect your status, seek qualified compliance or legal advice.

Map where patient health information is created and stored

List the locations and systems where your practice creates, receives, maintains, or transmits patient information. A HIPAA Security Rule risk analysis must address the potential risks and vulnerabilities to the confidentiality, integrity, and availability of all electronic protected health information (ePHI) in scope—not just information in the main electronic health record. See HHS guidance on risk analysis.

• Include EHRs, practice-management and billing platforms, laboratory portals, imaging systems, email, patient messaging, telehealth tools, and cloud storage.
• Account for paper intake forms, signed releases, printed lab results, practitioner notes, and records stored off-site.
• Track data on laptops, phones, tablets, removable drives, backups, and devices used for remote work.
• Record which staff members and vendors can access each system, what information it holds, and how information moves between systems.
• Assess threats such as misdirected communications, stolen devices, phishing, unauthorized access, system outages, and loss of backup data.

Keep the inventory and risk analysis current as you add services, software, devices, or vendors. Document identified risks, planned corrective actions, responsible owners, and follow-up dates.

Review privacy notices and minimum necessary access

If your practice is a covered health care provider, review its Notice of Privacy Practices (NPP) to ensure it accurately explains permitted uses and disclosures, patient rights, the practice’s privacy duties, and how patients can make complaints. Provide the notice as required, make it available to patients, and post it on your practice website if you maintain one. HHS explains these requirements in its Notice of Privacy Practices guidance.

• Keep the NPP consistent with your actual practices, including how you handle treatment coordination, billing, patient communications, and records requests.
• Ask patients to acknowledge receipt of the notice and keep the acknowledgment or document the circumstances if the patient does not provide one.
• Set role-based permissions so staff can access the information needed for their assigned duties.
• Use the minimum necessary standard when it applies: limit uses, disclosures, and requests for PHI to what is reasonably needed for the purpose. The standard generally does not apply to provider disclosures or requests for treatment. See HHS guidance on the minimum necessary requirement.
• Review access when staff roles change and promptly remove access when a workforce member leaves.

For an integrative practice, access controls may be especially important when records contain detailed treatment histories, specialty lab results, patient-reported symptoms, or information shared with other practitioners.

Apply administrative physical and technical safeguards

The HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards to protect ePHI. Its requirements are flexible and should be applied in light of your practice’s size, systems, and documented risks. Start with the HHS overview of the Security Rule.

• Administrative: Assign security responsibility, maintain written policies and procedures, conduct the risk analysis, manage identified risks, review system activity, and establish procedures for security incidents and emergencies.
• Physical: Control access to rooms and devices containing ePHI, secure workstations, protect paper files from casual viewing, and securely dispose of records and media.
• Technical: Use unique user accounts, appropriate authentication, access controls, audit capabilities, and protections for information sent over electronic networks.
• Encryption: Assess electronic protected health information encryption for stored and transmitted ePHI. HHS describes encryption as an addressable implementation specification: assess whether it is reasonable and appropriate; document the decision and, where applicable, implement an equivalent alternative measure. See HHS guidance on Security Rule encryption.
• Availability: Maintain a contingency plan that addresses data backup, disaster recovery, and emergency-mode operations, and test recovery procedures as appropriate.

Do not treat encryption alone as a complete security program. HHS notes that encryption does not replace risk analysis, physical protections, access controls, or measures that help maintain ePHI integrity and availability.

Train staff and document HIPAA compliance

Train workforce members on the privacy and security policies that apply to their roles. Make the training specific to how your practice handles patient information—for example, intake forms, lab reports, referrals, shared workstations, patient messaging, and discussions in clinical spaces.

• Explain when staff may access or disclose PHI and how to verify the intended recipient before sending information.
• Teach staff how to recognize and report suspected phishing, lost devices, misdirected messages, and inappropriate access.
• Document training dates, participants, topics, policy acknowledgments, and any follow-up instruction.
• Retain written policies, risk-analysis records, incident records, and other required Security Rule documentation.
• Review training and policies when systems, workflows, staff responsibilities, or identified risks change.

Training completion records show that staff completed a training activity; they do not, by themselves, establish that the practice is HIPAA compliant. Apply your employer-specific policies and maintain evidence of the safeguards and procedures your organization actually uses.

Manage vendors and secure patient communications

Determine whether each vendor creates, receives, maintains, or transmits PHI on behalf of your practice. A vendor that meets the business associate definition generally requires a written business associate agreement (BAA) before it handles PHI for the practice. HHS provides examples and explains these obligations in its business associate guidance.

• Review EHR, cloud storage, billing, telehealth, patient-messaging, and record-management vendors.
• Confirm that BAAs address permitted uses and disclosures, safeguards, incident reporting, subcontractors, and return or destruction of PHI when appropriate.
• Check that vendor practices match the services and data involved; a product’s general security claims do not replace your review of its HIPAA role and contractual terms.
• Use communication methods suited to the information and the risks. Verify patient contact details, confirm recipients before sending records, and follow documented procedures for email, texting, and portal messages.
• Do not assume every supplier needs a BAA. HHS describes an exception for certain entities that act merely as conduits for PHI, and the facts of the service matter.

HHS states that a cloud service provider that creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate is generally a business associate—even if the provider stores only encrypted data and cannot decrypt it. See HHS guidance on HIPAA and cloud computing.

Prepare for incidents and breach notification

Maintain a written process for reporting, assessing, containing, and documenting suspected security incidents. Train staff to report an incident promptly, even when they are uncertain whether it involves a breach. Preserve relevant records and investigate what information was involved, who may have accessed it, and what steps can reduce potential harm.

• Set clear internal reporting routes and identify who coordinates investigation, legal or compliance review, and communications.
• Document the incident, investigation, risk assessment, mitigation, and decision about whether notification is required.
• Review relevant BAAs and vendor procedures so the practice receives timely notice of incidents involving its PHI.
• Keep a breach notification plan that identifies required notices, responsible staff, and the information needed to prepare them.

Under the Breach Notification Rule, notices to affected individuals must be provided without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. Additional reporting requirements may apply depending on the number of people affected. Review HHS’s Breach Notification Rule guidance and consult qualified counsel when assessing a specific incident.

In summary, a practical HIPAA checklist starts with confirming your practice’s role, mapping PHI, assessing risks, limiting access, applying appropriate safeguards, training staff, managing business associates, and maintaining a tested incident-response process.

FAQs

Does HIPAA apply to a Lyme disease integrative practice?

It may. A health care provider is generally a covered entity if it conducts certain standard electronic health care transactions, such as electronic claims transactions. A practice may also have HIPAA obligations when it acts as a business associate for another covered entity. The type of care—such as Lyme disease or integrative care—does not by itself determine whether HIPAA applies. See HHS guidance on covered entities.

What should a HIPAA risk assessment cover?

It should cover potential risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI the organization creates, receives, maintains, or transmits. Include relevant systems, devices, locations, vendors, people with access, likely threats, and the impact of potential loss or compromise. Document findings and risk-management actions, then update the analysis as your environment changes. See HHS guidance on risk analysis.

Do vendors that handle patient information need business associate agreements?

Generally, a vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity to perform a service involving PHI is a business associate and needs a written BAA. Whether a particular vendor qualifies depends on the service and the vendor’s role; some entities that merely act as conduits may not require a BAA. See HHS business associate guidance.

How quickly must a practice notify patients after a breach?

For a breach of unsecured PHI requiring individual notice, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Other reporting requirements may apply, and a business associate must notify the covered entity under the applicable rule and its BAA. See HHS’s Breach Notification Rule guidance.