HIPAA Compliance Checklist for Parish Nurse Ministries

This HIPAA Compliance Checklist for Parish Nurse Ministries helps you decide whether HIPAA applies, map how protected health information (PHI) flows through your services, and implement practical safeguards. Use it to formalize policies, train your team, and document evidence of compliance.

HIPAA Applicability Assessment

Conduct a covered entity determination

• Identify whether the ministry is a health care provider that transmits health information electronically in connection with standard transactions (e.g., claims, eligibility checks). If yes, you are a covered entity and the HIPAA Rules apply.
• If the ministry performs services for a hospital, clinic, or other covered entity that involve PHI, you are likely a business associate and must meet applicable requirements through business associate agreements.
• If neither applies, HIPAA may not govern you directly; still adopt privacy and security practices to protect congregants and reduce liability.

Define organizational scope

• Document whether the ministry is independent, part of a larger church organization, or a unit of a health system (hybrid entity considerations).
• List all standard electronic transactions, if any, and the systems or vendors used to send or receive them.
• Record decisions and rationale; retain determinations and any legal reviews in your compliance file.

Service Inventory and PHI Mapping

Build a complete service inventory

• Catalog services that may involve PHI: home visits, care coordination, prayer requests, health education events, blood pressure screenings, referrals, and telephonic follow-ups.
• Note who provides each service (nurses, clergy, volunteers) and where it occurs (parish office, congregant homes, community sites, virtual).

Create a PHI data map

• For each service, list PHI elements collected (e.g., name, diagnoses, medications), how they are used, where they are stored (paper, email, cloud apps, EHRs), and who can access them.
• Diagram disclosures to external parties (e.g., referrals to local clinics) and identify required authorizations.
• Mark ePHI repositories and data flows to prepare for ePHI access controls, encryption, and audit logging.
• Apply the minimum necessary standard and remove or de-identify details from public communications (e.g., prayer lists).

Privacy Policies and Procedures

Establish core privacy rules

• Write policies for permitted uses and disclosures, authorizations, minimum necessary, and individual rights (access, amendment, accounting of disclosures).
• If you are a covered entity, prepare and distribute a Notice of Privacy Practices; if a business associate, follow contract terms and limit uses to those allowed.
• Require confidentiality agreements from workforce members (employees and volunteers) before they handle PHI.

Operationalize privacy

• Define intake scripts for home visits and prayer requests that avoid unnecessary PHI collection.
• Set procedures for responding to requests for access or amendments within required timeframes.
• Create a sanctions policy for violations and a complaint intake process with non-retaliation assurances.
• Maintain current business associate agreements with all vendors or partners that create, receive, maintain, or transmit PHI on your behalf.

Security Risk Assessment

Analyze risks to ePHI

• Inventory information assets (devices, systems, cloud services) that store or transmit ePHI.
• Identify threats and vulnerabilities (loss/theft, phishing, misdirected email, misconfigured cloud storage, paper handling).
• Evaluate likelihood and impact, rate risks, and document findings.

Create a risk management plan

• Select safeguards to reduce high and moderate risks to reasonable and appropriate levels.
• Assign owners, due dates, and success metrics; track completion and residual risk.
• Reassess annually and upon major changes (new services, systems, or vendors).

Administrative Safeguards

Governance and workforce

• Appoint a Privacy Officer and a Security Officer with clear responsibilities.
• Implement workforce security: role-based access, authorization processes, onboarding and termination checklists.
• Provide security awareness and privacy training at hire and at least annually; include phishing simulations and handling of prayer-related PHI.

Policies, contingency planning, and oversight

• Adopt a security management process with documented risk analysis, risk management, and sanctions.
• Implement contingency planning: data backup, disaster recovery, emergency mode operations, testing, and contact trees.
• Manage third parties: execute and maintain business associate agreements; monitor vendor security and performance.
• Perform periodic evaluations and tabletop exercises for incident response.

Physical Safeguards

Protect facilities, workstations, and media

• Control facility access; secure offices and file rooms; maintain visitor logs where appropriate.
• Harden workstations: screen privacy filters, auto-lock, secure cable locks for laptops used in outreach.
• Use locked storage for paper records; adopt clean desk and secure transport practices for home visits.
• Establish device and media controls: inventory, secure reuse, and final disposal (shred paper; wipe or destroy drives).

Technical Safeguards

Implement ePHI access controls

• Use unique user IDs, strong passwords, and multi-factor authentication where feasible.
• Apply role-based permissions aligned with minimum necessary; review access quarterly.
• Enable automatic logoff and session timeouts on shared or mobile devices.

Protect data and monitor activity

• Encrypt ePHI in transit and at rest on laptops, mobile devices, and cloud storage.
• Activate audit controls: centralized logging, immutable logs where possible, and regular review of access reports.
• Maintain integrity controls (anti-malware, patching, configuration baselines) and secure transmission protocols.
• Manage email and messaging: verify recipients, disable auto-forwarding of PHI, and use secure messaging for clinical coordination.

Breach Notification Procedures

Prepare, detect, and assess

• Define incidents vs. breaches and establish internal reporting within 24 hours of discovery.
• Conduct a documented risk assessment to determine the probability of compromise (consider the nature of PHI, unauthorized person, whether PHI was actually acquired or viewed, and mitigation).

Meet breach notification requirements

• Notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery to meet breach notification requirements; include required content (what happened, types of information, steps they should take, your actions, and contact information).
• Report to HHS per size thresholds; notify prominent media if 500+ residents of a state or jurisdiction are affected.
• Document all decisions and actions; preserve evidence and improve controls to prevent recurrence.
• Coordinate with partners under business associate agreements to ensure timely, accurate notifications.

Documentation and Record Retention

Maintain complete, current records

• Retain policies, procedures, risk analyses, the risk management plan, training logs, incident and breach files, access logs, and business associate agreements for at least six years from creation or last effective date.
• Use version control and change logs; record approvals and review dates.
• Store records securely (paper or electronic), restrict access, and back them up as part of contingency planning.
• Schedule periodic reviews to ensure documents reflect actual practices and system changes.

Summary

By confirming HIPAA applicability, rigorously mapping PHI, and implementing administrative, physical, and technical safeguards, your parish nurse ministry can protect congregants, reduce risk, and demonstrate compliance. Keep your risk management plan and documentation current, and rehearse breach response so you are ready when it counts.

FAQs

What defines a covered entity under HIPAA for parish nurse ministries?

A parish nurse ministry is a covered entity only if it provides health care and transmits health information electronically in connection with standard transactions (such as billing claims or eligibility checks). Many ministries do not perform those transactions and are not covered entities. If the ministry handles PHI on behalf of a covered entity, it likely functions as a business associate and must follow contract terms and applicable HIPAA requirements.

How should PHI be mapped in ministry services?

List each service, the PHI it collects, where the information is stored or transmitted, who can access it, and any disclosures to third parties. Include paper records, laptops, mobile devices, and cloud tools. Mark ePHI repositories, apply minimum necessary, and align controls such as ePHI access controls, encryption, and audit controls with the risks you identified.

What are the key administrative safeguards required by HIPAA?

Core administrative safeguards include a documented risk analysis and risk management plan, designated privacy and security officers, role-based access and workforce training, sanctions for violations, vendor oversight through business associate agreements, contingency planning (backups, disaster recovery, emergency mode operations), and periodic evaluations of your security program.

How is a breach notification procedure implemented?

Create a written procedure that defines incidents, establishes rapid internal reporting, and requires a documented risk assessment for each event. If a breach occurs, provide individual notices without unreasonable delay and within 60 days, meet HHS and media reporting thresholds, capture required notice content, track deadlines, and retain all documentation. Afterward, remediate root causes and update policies, training, and technical controls.