HIPAA Compliance Checklist for Osteopathic Manipulative Medicine Clinics

Use this checklist to review how your osteopathic manipulative medicine (OMM) clinic handles patient information, treatment records, workforce access, vendors, and potential security incidents. HIPAA requirements depend on your clinic’s role and activities; this checklist is a practical starting point, not a substitute for assessing applicable federal and state requirements.

What patient information is protected health information in an osteopathic clinic?

Protected health information (PHI) is individually identifiable information about a person’s health, health care, or payment for care that is held or transmitted by a covered entity or its business associate. The HIPAA Privacy Rule protects PHI in electronic, paper, and oral form. HHS’s Summary of the HIPAA Privacy Rule explains the definition and scope.

In an OMM clinic, PHI may include patient names linked to appointment details, billing records, medical histories, examination findings, treatment plans, and clinical notes. For example, a record of an osteopathic structural examination or a treatment response can be PHI when it identifies a patient or could reasonably be used to identify one.

• Identify where patient information is created, received, stored, discussed, or transmitted, including in the EHR, billing system, email, paper charts, and staff conversations.
• Use safeguards for PHI whether it appears in a treatment note, a printed schedule, a phone message, or an electronic communication.
• Check whether your clinic is a HIPAA covered entity. A health care provider is generally covered if it conducts certain standard health care transactions electronically, such as electronic claims or payment transactions. The type of care— including OMM—does not by itself determine coverage. See HHS’s guidance on who must comply.

How should staff manage patient consent and authorization?

Separate consent to treatment, acknowledgment of your Notice of Privacy Practices, and a HIPAA authorization. These serve different purposes. HIPAA generally allows covered providers to use or disclose PHI for treatment, payment, and health care operations without obtaining a separate authorization, subject to the Rule’s requirements and any applicable state law. HHS explains the difference between consent and authorization.

• Provide your Notice of Privacy Practices as required and document the patient’s acknowledgment or, if the patient declines to sign, the attempt and refusal. Acknowledging receipt is not permission for a special use or disclosure. See HHS’s Notice of Privacy Practices guidance.
• Obtain a valid written authorization before a use or disclosure that HIPAA does not otherwise permit or require. Examples may include certain disclosures to an employer or uses for marketing. An authorization should identify the information, purpose, recipient, expiration, and the patient’s right to revoke, as applicable. See HHS’s authorization guidance.
• Route requests to share records with family members, insurers, employers, or other third parties through a consistent process. Check whether an authorization, another Privacy Rule permission, or an opportunity for the patient to agree or object applies before disclosing information.
• Train staff not to treat a Notice of Privacy Practices acknowledgment as a substitute for an authorization when one is required.

What safeguards protect electronic and paper health records?

The HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic PHI (ePHI). The Privacy Rule also requires reasonable safeguards for PHI more broadly. Choose and document measures that fit your clinic’s size, systems, workflow, and assessed risks. See HHS’s Summary of the HIPAA Security Rule.

• Electronic records: Use individual user accounts, secure authentication, role-appropriate access, automatic screen locking where appropriate, backups, and safeguards for transmitting ePHI. Review available access logs and revoke access when a staff member’s role changes or employment ends.
• Devices and systems: Keep an inventory of computers, phones, tablets, removable media, and systems that access ePHI. Set procedures for securing, remotely accessing, reusing, and disposing of devices and media.
• Paper records: Store charts and printed schedules in controlled areas; keep them out of public view; retrieve documents promptly from shared printers; and use secure disposal methods when records may be destroyed.
• Clinic conversations: Discuss patient care where others are less likely to overhear. Take reasonable steps to avoid exposing names or treatment details at reception or in shared areas.
• Risk analysis: Conduct and document an accurate assessment of risks to the confidentiality, integrity, and availability of all ePHI, then address identified risks. HHS’s risk analysis guidance describes the requirement and explains that the process should be ongoing.

HIPAA does not prescribe one universal security setup for every clinic. Document why your safeguards are reasonable for your environment and revisit them when systems, vendors, workflows, or identified risks change.

How should access to records and treatment documentation be controlled?

Assign access according to job responsibilities, and give each workforce member a unique account rather than sharing logins. Review permissions when duties change and promptly remove access when a person no longer needs it. Use logs and periodic reviews to help identify access that appears inappropriate.

Apply the minimum necessary standard to uses, disclosures, and requests for PHI when it applies. This standard generally does not apply to disclosures to or requests by a health care provider for treatment, or to disclosures made under a valid authorization. For other applicable situations, establish policies that limit access or disclosures to what is reasonably needed for the purpose. See HHS’s minimum necessary guidance.

• Document OMM care clearly and objectively, including relevant examination findings, the treatment provided, and the patient’s response, in line with clinical and organizational policies.
• Set a process for reviewing, correcting, and amending documentation that preserves an appropriate record of changes.
• Direct patient access requests to the staff member responsible for handling them. HIPAA generally requires action on an access request within 30 calendar days, with a possible one-time extension of up to 30 additional days if the patient is notified in writing within the initial period. See HHS’s access-request timeline guidance.

What should business associate agreements cover?

If a vendor creates, receives, maintains, or transmits PHI on your clinic’s behalf to perform a service or function, the vendor may be a business associate. Examples can include certain billing, IT, or record-hosting services, depending on the actual relationship and service. When a business associate relationship exists, establish the required written agreement before sharing PHI. See HHS’s Business Associate guidance.

Check that the business associate agreement (BAA) addresses the required terms, including:

• Permitted and required uses and disclosures of PHI, and a prohibition on other uses or disclosures except as allowed by the agreement or required by law.
• Appropriate safeguards for PHI, including Security Rule requirements for ePHI.
• Reporting of impermissible uses or disclosures, security incidents, and breaches of unsecured PHI.
• Support for the clinic’s obligations involving patient access, amendments, and accounting of disclosures, as applicable.
• Similar privacy and security restrictions for subcontractors that handle PHI.
• Return or destruction of PHI at the end of the relationship when feasible, and a process for addressing violations or termination.

Use HHS’s sample business associate agreement provisions as a reference, and tailor the agreement to the services and information involved. A vendor’s general privacy statement should not be assumed to replace a required BAA.

How should clinics respond to suspected breaches?

Make sure staff know how to report a lost device, misdirected message, unauthorized chart access, stolen paper record, or other suspected security incident promptly. Contain the issue where possible, preserve relevant records and logs, and refer the matter to the person responsible for privacy or security. Investigate and document what happened, what information was involved, who may have received or accessed it, and what steps reduced the risk.

An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an exception applies or the clinic can demonstrate a low probability that the PHI was compromised using the required risk assessment. The assessment considers the nature and extent of the PHI, the recipient, whether the information was actually acquired or viewed, and the extent of mitigation. See HHS’s Breach Notification Rule guidance.

• Follow written incident and breach-response procedures, including escalation, investigation, mitigation, and documentation.
• If breach notification is required, provide notices without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting 500 or more individuals have additional reporting requirements; breaches affecting fewer than 500 individuals are reported to HHS on an annual basis, within the applicable deadline.
• If a business associate discovers a breach involving the clinic’s PHI, follow the BAA’s reporting process and coordinate the investigation and any required notices.
• Check applicable state law and other obligations, which may impose additional requirements.

What training and documentation should be maintained?

Train workforce members on the privacy and security policies relevant to their duties. Provide training to new workforce members within a reasonable period and address material policy changes with affected staff. HIPAA does not set a universal annual certificate-renewal requirement; keep training practical, role-appropriate, and responsive to changes in clinic operations. See HHS’s guidance on Privacy Rule responsibilities.

Maintain written or electronic documentation for required policies, activities, and decisions. The HIPAA rules generally require covered entities to retain required compliance documentation for six years from its creation or the date it was last in effect, whichever is later. This is not a HIPAA medical-record retention period; check applicable state law and other requirements for clinical record retention. See HHS’s HIPAA Audit Protocol and its guidance on medical-record retention.

• Keep current privacy and security policies, workforce training records, risk analyses, and records of follow-up risk management.
• Maintain BAAs, incident reports, breach assessments, notices, and documentation of actions taken.
• Review policies when clinic operations, technology, staff responsibilities, or identified risks change.

A workable HIPAA checklist ties together the information your clinic handles, the people and vendors who can access it, safeguards matched to identified risks, and clear procedures for patient requests and security incidents. Keep the process documented and revisit it as your clinic changes.

FAQs

Does HIPAA apply to osteopathic manipulative medicine clinics?

It can. OMM clinics are not exempt based on their specialty. A health care provider generally qualifies as a HIPAA covered entity when it conducts certain standard health care transactions electronically, such as electronic claims transactions. Whether a particular clinic is covered depends on its activities. See HHS’s guidance on who must comply with HIPAA.

When is patient authorization required to disclose health information?

Generally, a covered entity needs a valid written authorization for a use or disclosure that HIPAA does not otherwise permit or require. Many disclosures for treatment, payment, and health care operations do not require authorization, and the Privacy Rule also permits certain disclosures under specified conditions. Check the purpose and applicable permission before sharing PHI. See HHS’s Summary of the HIPAA Privacy Rule.

What should a clinic do after discovering a potential breach?

Promptly report and investigate the incident, limit further exposure where possible, preserve relevant evidence, and document the facts and mitigation steps. Assess whether the event meets the breach definition and whether notification is required. If notification is required, HIPAA sets an outside deadline of 60 calendar days after discovery, but clinics must not unreasonably delay notices. See HHS’s Breach Notification Rule guidance.

How often should HIPAA risk assessments be performed?

The Security Rule requires an accurate and thorough risk analysis, but does not specify a fixed schedule. HHS describes risk analysis as an ongoing process: review it as needed when technology, operations, or risks change, and after relevant incidents. A clinic may choose a regular review schedule as a practical measure, but an annual assessment is not a universal HIPAA deadline. See HHS’s risk analysis guidance.