HIPAA Compliance Checklist for Neonatal Follow-Up and Developmental Clinics

Which privacy policies and notices must neonatal clinics maintain?

First determine whether the clinic is a HIPAA covered entity. A health care provider generally falls under HIPAA when it conducts certain standard transactions electronically, such as electronic claims. If the clinic is covered, its written privacy policies should explain how staff handle infant records, parent and guardian requests, disclosures to other providers, complaints, and suspected privacy violations. Policies should reflect the clinic’s actual services and workflows.

Maintain a current Notice of Privacy Practices (NPP) that explains permitted uses and disclosures, family and patient rights, how to submit a complaint, and whom to contact with questions. A covered provider with a direct treatment relationship generally must provide the notice by the first service, make a good-faith effort to obtain an acknowledgment, and post it prominently at the clinic. If the clinic maintains a website about its services, it must also make the notice available there. The NPP is a notice of privacy practices—not a substitute for a separate authorization when one is required. See HHS guidance on Notices of Privacy Practices.

• Designate a privacy official and a contact for privacy complaints and questions.
• Document procedures for access requests, identity and authority checks, permitted disclosures, complaint handling, and sanctions for workforce violations.
• Review the NPP and related policies when privacy practices or applicable requirements change; promptly revise and distribute the notice when a material change requires it.
• Keep required HIPAA policies and documentation for six years from creation or the date they were last in effect, whichever is later. This is a HIPAA documentation period, not a universal medical-record retention period. See 45 C.F.R. § 164.530.

How should clinics train and oversee their workforce?

Train every workforce member on the clinic’s HIPAA Privacy Rule policies as needed for that person’s duties. Provide Security Rule awareness and training to all workforce members, including management. Tailor instruction to the work: clinicians and developmental specialists need guidance on records and care coordination, while front-desk staff need practical direction for verifying identity, handling calls, and protecting sign-in information.

• Explain how to recognize and report misdirected messages, lost devices, inappropriate chart access, and other suspected incidents.
• Teach staff to use approved communication channels, protect screens and paper records, and avoid discussing identifiable infant information where others can overhear.
• Train staff on parent and guardian requests, custody documentation, and when to refer a difficult authority question to the privacy official.
• Document who was trained, when, and on which policies or materials; provide additional training when job duties, systems, or policies change.
• Review access logs and apply appropriate sanctions when staff violate policy.

HIPAA does not establish a universal annual training or certificate-renewal schedule. Follow employer-specific policies and provide training when required for the workforce’s functions. A course-completion certificate may document one person’s course; it does not establish that the clinic as an organization is HIPAA compliant. HHS describes how training and procedures can be tailored to the size and needs of a practice in its overview of Privacy Rule responsibilities.

How can clinics assess risks to electronic protected health information?

The HIPAA Security Rule requires an accurate and thorough risk analysis of potential threats and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). Include ePHI the clinic creates, receives, maintains, or transmits—not only records stored in the electronic health record. HHS emphasizes that risk analysis is required and should inform the clinic’s safeguards and risk management. See HHS guidance on Security Rule risk analysis.

• Inventory where infant and family ePHI resides or travels, including the EHR, referral systems, email, mobile devices, backups, telehealth tools, and vendor systems.
• Identify who can access each system and assess risks such as unauthorized access, phishing, device loss, system failure, and improper disposal.
• Evaluate how likely each threat is and the potential impact on confidentiality, integrity, and availability.
• Record identified risks, existing safeguards, gaps, and corrective actions with responsible owners and target dates.
• Use the results to implement and review reasonable safeguards, such as role-based access, secure authentication, physical protections, backups, and monitoring.

The Security Rule does not prescribe one risk-analysis method or a fixed annual schedule. Review and update the analysis when changes in systems, vendors, clinic operations, or known threats could affect ePHI, and document the process and resulting decisions.

Who may access or receive infant health information?

Give workforce members access to infant records according to their job responsibilities and need to perform assigned duties. For internal uses, apply role-based access and the minimum necessary standard where it applies: limit access to what is reasonably needed for the purpose. Keep access credentials individual, remove access when a person changes roles or leaves, and review access periodically.

HIPAA generally permits disclosures for treatment, payment, and health care operations when the Privacy Rule’s conditions are met. The minimum necessary standard does not apply to disclosures to, or requests by, health care providers for treatment purposes. That means a clinic may share relevant records with another provider coordinating an infant’s treatment without applying that standard to the provider-to-provider treatment disclosure. It does not remove the need to use appropriate security safeguards or follow other applicable privacy requirements. See HHS guidance on the minimum necessary standard.

For disclosures to family members or others involved in care, follow the applicable HIPAA permissions and the clinic’s procedures, taking account of the infant’s representative and any relevant state law. For purposes such as research, school or program coordination, or other non-treatment sharing, confirm that a valid authorization or another HIPAA permission applies before disclosing identifiable information.

How should clinics verify a parent or guardian’s authority?

Under HIPAA, a minor child’s personal representative is usually a parent or legal guardian, but the clinic should verify the person’s identity and authority before releasing records or giving account access. Review relevant guardianship or custody documents when needed, and follow the provisions that identify who may make health care decisions for the child.

Do not assume that biological parenthood alone resolves every request. State law can affect guardianship and access; HIPAA also has exceptions, including circumstances in which a minor may obtain particular care without parental consent. A provider may decline to treat a person as the minor’s personal representative if it reasonably believes that doing so could expose the child to abuse, neglect, or endangerment. Escalate uncertain or conflicting claims to the privacy official and, when appropriate, legal counsel. HHS explains the general rule and exceptions in its guidance on personal representatives, including parents of minors.

Record the verification steps and the scope of authority established. Once a parent or guardian is confirmed as the infant’s personal representative, handle the person’s applicable HIPAA rights—including access requests—under the clinic’s usual procedures, subject to any relevant legal limits.

What safeguards apply to business associates and telehealth?

Identify vendors that create, receive, maintain, or transmit PHI on the clinic’s behalf while performing services such as billing, EHR support, data hosting, or telehealth. When a vendor is a business associate, establish a written business associate agreement (BAA) before providing PHI. The agreement should define permitted uses and disclosures, require appropriate safeguards, address incident reporting, and require the business associate to bind relevant subcontractors to applicable protections. HHS summarizes these obligations in its Business Associates guidance.

For telehealth, use technology vendors that comply with HIPAA and will enter into BAAs when they handle PHI on the clinic’s behalf. Confirm the platform’s actual service and data flows rather than relying only on a vendor’s marketing language. Before a visit, staff can also confirm the family’s location and who is present, use a private space, and follow clinic procedures for protecting information during remote consultations. See HHS telehealth technology guidance.

What steps should clinics take after a breach?

Act promptly when the clinic discovers a suspected loss, unauthorized access, or disclosure of PHI. Follow the incident-response plan, secure affected systems or records, preserve relevant logs and evidence, and limit further exposure. Document what happened, when it was discovered, whose information may be involved, and what containment and mitigation steps were taken.

• Assess whether the event involved an impermissible use or disclosure of unsecured PHI, and document the required breach analysis or the reason notification is not required.
• Notify the covered entity promptly if the incident occurred at a business associate; the BAA should set clear reporting procedures and timeframes.
• If notification is required, notify affected individuals without unreasonable delay and no later than 60 days after discovery.
• Notify HHS within 60 days when a breach affects 500 or more individuals. For breaches affecting fewer than 500 individuals, report to HHS no later than 60 days after the end of the calendar year in which the breach was discovered.
• Provide notice to prominent media outlets when the breach affects more than 500 residents of a state or jurisdiction. Check applicable state law and contractual duties for any additional requirements.

Use the investigation to mitigate harm, correct weaknesses, and review whether workforce training or safeguards need to change. Maintain documentation of the assessment and any required notifications. HHS provides the applicable breach notification requirements.

Checklist recap: Keep privacy policies and notices current, train and oversee the workforce, assess ePHI risks, control access, verify representatives, manage vendors and telehealth through appropriate safeguards, and follow a documented breach-response plan.

FAQs

Can a parent access an infant’s medical records under HIPAA?

Usually, if the parent is the infant’s personal representative under applicable law. Verify identity and authority, and check for relevant custody orders, state-law limits, or HIPAA exceptions, including a reasonable belief that access could endanger the child.

Does the minimum necessary standard apply to treatment disclosures between providers?

No. The standard does not apply to disclosures to, or requests by, health care providers for treatment purposes. Other privacy and security obligations still apply.

What should a clinic do after discovering a breach of protected health information?

Contain the incident, preserve evidence, investigate and document the event, assess whether it is a breach of unsecured PHI, mitigate harm, and provide any required notifications. Individual notice is due without unreasonable delay and no later than 60 days after discovery when notification is required.

Do telehealth platforms need business associate agreements?

When a platform vendor handles PHI on behalf of a covered clinic as a business associate, the clinic generally needs a BAA with that vendor. Confirm that the vendor’s actual services and handling of PHI fit the arrangement and that the agreement addresses required safeguards and reporting.