HIPAA Compliance Checklist for PI Chiropractic and Imaging Networks

Personal injury (PI) chiropractic and imaging networks often handle patient records across multiple practices, clinics, imaging sites, and vendors. Use this checklist to identify where HIPAA responsibilities apply, protect protected health information (PHI), and prepare for a breach response.

Determine HIPAA Covered Entity and Business Associate Status

Assess each legal entity and its actual activities; shared branding, ownership, or a common network does not by itself establish one HIPAA status for every organization. A chiropractor or imaging provider is generally a covered entity when it furnishes health care and electronically conducts a transaction for which HHS has adopted a standard, such as an eligible health care claim. The transaction may be conducted through a billing service or other intermediary. Sending ordinary email alone does not make a provider a covered entity.

Document whether each organization is a covered entity, a business associate, both in different relationships, or neither under HIPAA. A business associate performs certain services or functions for a covered entity that involve PHI—for example, hosting or managing records on the provider’s behalf. A network’s role depends on its actual arrangement and services, not simply on its name or connection to a PI claim.

• Identify the legal entity that provides chiropractic care, diagnostic imaging, billing, and related services.
• Determine whether each provider conducts standard electronic transactions directly or through a third party.
• Identify services performed on behalf of another covered entity that involve PHI.
• Record each entity’s HIPAA role and the reasoning behind the determination.

PI-related payment arrangements do not, by themselves, settle HIPAA status. Evaluate the provider’s transactions and business relationships rather than assuming that every PI practice or network is automatically covered—or exempt.

Inventory PHI Across Clinical and Imaging Systems

List where PHI and electronic protected health information (ePHI) are created, received, stored, accessed, and transmitted. Include records held by vendors as well as those kept at clinics. HIPAA’s Privacy Rule applies to PHI in different forms, while the Security Rule safeguards ePHI.

For a chiropractic and imaging network, check systems such as:

• Electronic health records, practice-management, scheduling, and billing platforms.
• Radiology information systems (RIS), picture archiving and communication systems (PACS), image-viewing workstations, and imaging equipment that stores or transmits patient data.
• Patient portals, referral platforms, dictation tools, telehealth systems, and secure messaging.
• Email, file-sharing services, fax services, mobile devices, removable media, and printed records.
• Cloud hosting, backups, disaster-recovery systems, audit logs, and vendor support or maintenance environments.

For each system, record the information involved, its location, who can access it, how it moves between sites, and which organization or vendor operates it. Include data flows between treating providers, imaging locations, billing teams, and outside service providers. A complete inventory supports the ePHI risk analysis and helps uncover overlooked copies, interfaces, and access points.

Conduct and Document an ePHI Risk Analysis

Conduct and document an accurate, thorough ePHI risk analysis covering potential threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Identify where ePHI is held or transmitted, assess relevant risks, review existing safeguards, and document the results. A risk analysis is not just a technology checklist; it should reflect the network’s actual systems, workflows, facilities, and vendors.

Use the findings to set priorities and implement risk-management measures. The HIPAA Security Rule safeguards include administrative, physical, and technical measures. Depending on your environment and risk assessment, these may include workforce training, incident response procedures, physical controls for work areas and devices, access controls, activity review, authentication, and transmission security. Document the decisions made, the safeguards selected, and follow-up actions.

Review the analysis when meaningful changes occur, such as adopting a new imaging platform, adding a clinic, changing a vendor, or altering how records move between systems. Keep risk-analysis documentation and evidence that identified risks were addressed.

Apply Minimum Necessary Access Controls

Apply the minimum necessary standard by taking reasonable steps to limit many uses, disclosures, and requests for PHI to what is needed for the purpose. Establish role-based access so that workforce members can use the records needed for their duties, and periodically review accounts, permissions, and access logs. For example, a billing employee may need claim and payment details without needing the same system access as a treating clinician.

The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment purposes. Still, organizations must manage workforce access appropriately, and the treatment exception does not justify giving every employee unrestricted access to every record.

• Assign unique user accounts and grant access based on job responsibilities.
• Update or remove access promptly when roles change or employment ends.
• Review access periodically and investigate unusual or inappropriate activity.
• Use approved procedures for emergency access and document its use.

Execute Business Associate Agreements

Before a business associate handles PHI for a covered entity, put a written business associate agreement (BAA) or qualifying written arrangement in place. Review relationships with services such as cloud hosting, IT support, billing, records storage, and imaging-system maintenance to determine whether the provider is acting as a business associate. A vendor’s description of its service does not replace an assessment of what it actually does and what information it handles.

The agreement should establish permitted and required uses of PHI, require appropriate safeguards, address reporting of impermissible uses and breaches, and cover applicable subcontractors. It should also address access to records needed for individual rights and HHS compliance, and require the return or destruction of PHI at termination when feasible. Keep executed agreements and track renewals, service changes, and subcontractor arrangements.

Assess and Report Breaches of Unsecured PHI

Maintain a documented process for promptly escalating suspected incidents, preserving relevant evidence, and assessing whether an impermissible use or disclosure of unsecured protected health information is a reportable breach. A breach is generally presumed after an impermissible use or disclosure unless the covered entity or business associate establishes a low probability that the PHI was compromised through the required risk assessment or an applicable exception. Document the assessment and its outcome.

For a reportable breach, affected individuals generally must be notified without unreasonable delay and no later than 60 calendar days after discovery. The notice should describe the incident and information involved, explain steps individuals can take, summarize the organization’s response, and provide contact information. A covered entity must also notify the HHS Secretary; for a breach affecting 500 or more individuals, that notice is due without unreasonable delay and no later than 60 calendar days after discovery. If more than 500 residents of a state or jurisdiction are affected, media notice is also generally required.

For breaches affecting fewer than 500 individuals, report each incident to HHS no later than 60 days after the end of the calendar year in which it was discovered. You may report sooner, but you do not have to wait until year-end. A business associate must notify the covered entity of a breach at or by the business associate without unreasonable delay and no later than 60 calendar days after discovery; the BAA should support prompt coordination so the covered entity can meet its obligations.

In short, an effective checklist connects each organization’s HIPAA role to a complete PHI inventory, documented risk management, appropriate access, written vendor arrangements, and a practiced breach-response process.

FAQs

When is a chiropractor considered a HIPAA covered entity?

A chiropractor is generally a HIPAA covered entity when they furnish health care and electronically conduct a transaction for which HHS has adopted a standard, such as an eligible electronic health care claim. This can be true when a billing service or another intermediary conducts the transaction on the chiropractor’s behalf. Sending ordinary email alone does not establish covered-entity status.

Which systems in a PI chiropractic and imaging network may contain PHI?

PHI may be in electronic health records, practice-management and billing systems, scheduling tools, RIS and PACS platforms, imaging equipment, patient portals, referral and messaging systems, email, mobile devices, file-sharing services, cloud storage, backups, and vendor support environments. Include paper records and any other places where patient information is received, stored, accessed, or transmitted.

When must affected individuals be notified of a breach?

For a reportable breach of unsecured PHI, affected individuals must generally be notified without unreasonable delay and no later than 60 calendar days after discovery.

When must breaches affecting fewer than 500 individuals be reported to HHS?

Each breach affecting fewer than 500 individuals must be reported to the HHS Secretary no later than 60 days after the end of the calendar year in which the breach was discovered. The covered entity may report earlier and should keep the required incident documentation.