HIPAA Compliance Checklist for Myeloproliferative Neoplasm Clinics

Use this checklist to review how your MPN clinic protects patient information, including electronic health records, laboratory and pathology reports, and communications with patients and care partners. HIPAA applies to health care providers that meet the definition of a covered entity, including providers that conduct certain standard electronic transactions. Confirm your clinic’s status and account for any other applicable federal and state requirements. HHS’s Summary of the HIPAA Privacy Rule

How should an MPN clinic conduct and update its HIPAA risk analysis?

Start with an accurate inventory of where electronic protected health information (ePHI) is created, received, maintained, or transmitted. For an MPN clinic, that may include the electronic health record, patient portal, scheduling and billing systems, laboratory interfaces, marrow and pathology reports, telehealth tools, mobile devices, backups, and vendor-hosted platforms.

Assess reasonably anticipated threats and vulnerabilities that could affect the confidentiality, integrity, or availability of ePHI. Consider both the likelihood of an event and its potential impact—for example, unauthorized access to a patient account, a lost device, ransomware that disrupts access to treatment records, or an interface error that sends information to the wrong destination. Record the risks, existing safeguards, gaps, planned actions, responsible owners, and how you will track remediation. Risk analysis. HHS guidance on Security Rule risk analysis

HIPAA does not set a universal annual schedule for the risk analysis. Treat it as an ongoing process: revisit it when your clinic adopts technology, changes workflows or vendors, experiences a security incident, or identifies a material change in its environment. Document updates and revise safeguards as needed. HHS guidance on review frequency and updates

Which privacy and security roles, policies, and workforce training are required?

Designate a Privacy Official to develop and implement privacy policies and procedures, and a contact person or office to receive privacy complaints and answer questions about the Notice of Privacy Practices. The Security Rule also requires a designated security official responsible for security policies and procedures. Document these assignments and make clear who handles routine questions, incidents, and escalations. HHS Privacy Rule guidance; HHS Security Rule summary

Maintain written policies that fit your clinic’s operations. Address appropriate use and disclosure of PHI, access authorization, workforce clearance and termination, sanctions for policy violations, security incident response, contingency planning, backups, and the review of system activity. Ensure staff can find current policies and know how to report suspected privacy or security concerns.

Train workforce members—including employees, trainees, volunteers, and relevant contractors—on the policies and procedures needed for their roles. Provide training to new workforce members within a reasonable period and when a material policy change affects their duties; document that training occurred. HIPAA does not impose a universal annual training or certificate-renewal requirement. Employer-specific policies, state law, contracts, or other requirements may call for additional training. HHS guidance on workforce training

How can clinics safeguard ePHI with access controls, audit logs, and physical security?

• Limit and review access. Assign unique user IDs and role-appropriate access; promptly adjust access when staff change roles or leave. Establish a process for authorized emergency access. Use safeguards such as multifactor authentication where appropriate to the clinic’s risk assessment.
• Review system activity. Use audit controls to record and examine activity in systems containing or using ePHI. Review audit logs, access reports, and incident records on a regular, documented schedule, and investigate unusual access or repeated failed logins. HHS Security Rule summary of audit controls
• Protect information in transit and at rest. Assess whether encryption is a reasonable and appropriate safeguard for your environment. Encryption is an addressable implementation specification—not an automatic, stand-alone requirement in every circumstance. If you do not implement it, document the decision and implement an equivalent alternative when reasonable and appropriate. HHS guidance on encryption
• Secure the clinic’s spaces and devices. Control physical access to areas and equipment that contain or access ePHI. Set workstation-use rules, position screens to limit casual viewing, secure paper records, manage visitors, and control the movement, reuse, and disposal of devices and media. HHS explanation of physical safeguards

Make safeguards workable in day-to-day care, including check-in, infusion visits, telephone calls, telehealth, and conversations with family members or other care partners. Use reasonable practices to avoid exposing patient information to people who do not need it.

How should MPN clinics manage business associates and vendor risk?

Identify vendors that create, receive, maintain, or transmit PHI for the clinic while performing a business associate function. Before allowing access, determine whether the relationship requires a written business associate agreement (BAA). A BAA should define permitted and required uses and disclosures, require appropriate safeguards, address reporting of impermissible uses and breaches, flow relevant restrictions to subcontractors, support the clinic’s patient-rights obligations, and provide for return or destruction of PHI when feasible at termination. HHS sample BAA provisions

Review vendor arrangements for the services actually provided, such as EHR hosting, cloud storage, billing, laboratory interfaces, telehealth, patient communications, and data backup. As a risk-management practice, assess the vendor’s access, security measures, subcontractors, incident communication process, and ability to support continuity and patient requests. Set a clear contractual incident-reporting deadline that gives the clinic time to investigate and meet its own obligations. A vendor’s general assurance or certification does not replace a required BAA. HHS guidance on business associates

If the clinic learns of a material breach or violation of a business associate’s obligations, take reasonable steps to address it; if those steps fail, termination may be required when feasible. HHS guidance on responding to business associate violations

What patient privacy practices support notice, minimum-necessary use, and access rights?

Give patients a current Notice of Privacy Practices (NPP) that explains how the clinic may use and disclose PHI, describes privacy rights, and explains how to submit a complaint or ask questions. A provider with a direct treatment relationship generally must provide the notice by the first service date, make a good-faith effort to obtain written acknowledgment, post it at the clinic, and post it on the clinic’s website if it has one. The acknowledgment records receipt; it is not patient consent to uses or disclosures otherwise permitted by HIPAA. HHS guidance on providing the notice; HHS overview of the NPP

Apply the minimum necessary standard to uses, disclosures, and requests for PHI when it applies. Set role-based access and routine disclosure procedures, and review non-routine requests individually. The standard does not apply to disclosures to or requests by a health care provider for treatment purposes, among other exceptions; do not let minimum-necessary procedures delay appropriate provider-to-provider treatment disclosures. HHS minimum-necessary guidance

Give patients a clear process to request access to PHI in a designated record set, including records held by a business associate on the clinic’s behalf. In general, act on an access request within 30 calendar days. One extension of up to 30 additional days is permitted if the clinic provides a written explanation and expected completion date within the initial period. Train staff to route access, amendment, restriction, and complaint requests promptly to the person responsible for handling them. HHS access-request timing guidance

What steps should clinics take to assess and report a breach?

Maintain a response process for suspected or known security incidents. Staff should know how to report an event quickly; the response team should contain the incident, preserve relevant evidence, assess the information and systems involved, and document investigative and mitigation steps.

An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an exception applies or the clinic documents a low probability that the PHI was compromised. The required risk assessment considers the nature and extent of the PHI, who received or used it, whether it was actually acquired or viewed, and how effectively the risk was mitigated. Keep the assessment and the basis for any notification decision. HHS Breach Notification Rule guidance

For a breach of unsecured PHI, notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Notify HHS within that timeframe for a breach affecting 500 or more individuals; for a breach affecting fewer than 500, the clinic may report annually, no later than 60 days after the end of the calendar year in which it was discovered. A breach affecting more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area. A business associate must notify the clinic of a breach at or by the business associate without unreasonable delay and no later than 60 days after discovery; the BAA should set a faster operational deadline where needed. HHS notification requirements

Which HIPAA compliance records should clinics maintain?

Keep written or electronic evidence that shows how the clinic implemented and reviewed its HIPAA safeguards. Depending on the requirements that apply, this can include:

• Risk analyses, risk-management plans, and documented decisions about safeguards.
• Current privacy and security policies, procedures, and records of updates.
• Privacy and security official designations, workforce training records, and documented sanctions where applicable.
• Access approvals and changes, system-activity review records, security evaluations, and incident and breach assessments.
• Current NPPs, records of required notices and acknowledgments, and complaint documentation.
• Executed BAAs and amendments, plus evidence supporting vendor and subcontractor arrangements.

HIPAA-required documentation generally must be retained for six years from its creation or the date it was last in effect, whichever is later. This is not a blanket HIPAA requirement to retain every medical record for six years: HIPAA does not set medical-record retention periods, so check applicable state and other laws for those records. Keep the documentation needed to show required actions and assessments, and set a separate, risk-informed schedule for detailed audit logs and other operational records. HHS audit protocol on documentation retention; HHS explanation of medical-record retention

Checklist summary: Keep risk analysis ongoing, assign responsible privacy and security officials, train the workforce, control and review access, manage vendors through appropriate agreements, support patient privacy rights, prepare to respond to breaches, and retain required compliance documentation.

FAQs

How often should an MPN clinic review its HIPAA risk analysis?

HIPAA does not specify a fixed review interval. The clinic should treat risk analysis as an ongoing process and update it when changes in technology, operations, vendors, or security incidents could affect ePHI. A yearly review may be useful, but it is not a universal HIPAA deadline. HHS risk-analysis guidance

What must a business associate agreement cover?

A BAA must describe permitted and required uses and disclosures of PHI, require appropriate safeguards, address reporting of impermissible uses and breaches, apply relevant restrictions to subcontractors, support applicable patient-rights obligations, and address return or destruction of PHI at termination when feasible. HHS sample BAA provisions

When must a clinic notify patients of a breach?

For a breach of unsecured PHI requiring notification, the clinic must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The clinic should first assess the event under the Breach Notification Rule and document the decision; additional HHS and media reporting may apply depending on the number and location of affected individuals. HHS Breach Notification Rule guidance

What HIPAA records should an MPN clinic retain?

Retain required HIPAA policies, procedures, assessments, designations, training documentation, and records of required actions. HIPAA-required documentation generally has a six-year retention period measured from creation or the date it was last in effect, whichever is later. This does not establish a six-year retention period for every patient medical record; check state and other applicable rules for clinical records. HHS audit protocol on documentation; HHS guidance on medical-record retention