HIPAA Compliance Checklist for Polycystic Kidney Disease Clinics

A practical HIPAA compliance checklist helps a polycystic kidney disease (PKD) clinic protect patient information across in-person care, electronic health records (EHRs), and remote monitoring. HIPAA requirements depend on the clinic’s role and activities: a provider that conducts certain health care transactions electronically is generally a covered entity, while vendors handling PHI on its behalf may be business associates.

Use the steps below to review your clinic’s privacy practices, security safeguards, vendor relationships, and response procedures. The checklist is a planning aid—not a certification or a substitute for advice about your organization’s specific obligations.

What PHI do polycystic kidney disease clinics handle?

PHI is protected health information (PHI) that is individually identifiable health information created, received, maintained, or transmitted by a covered entity or business associate. For a PKD clinic, records may include a patient’s diagnosis, symptoms, family history, genetic testing, kidney imaging, laboratory results, blood pressure, treatment plan, medications, referrals, and billing information.

Electronic protected health information (ePHI) can also appear in portal messages, appointment reminders, telehealth records, care-management notes, and data from connected devices. Examples include home blood-pressure readings, weight measurements, symptom reports, and other remote monitoring data linked to an identifiable patient.

Remote monitoring data is subject to HIPAA when a covered clinic or its business associate creates, receives, maintains, or transmits it as part of a covered relationship. Data entered directly by a patient into an independent consumer app may be outside HIPAA’s scope if the app is not provided by or on behalf of a covered entity or business associate. Review the data flow and the parties’ roles rather than assuming every health app is covered. See HHS guidance on business associates and health apps.

How should clinics conduct and document an ePHI risk analysis?

The HIPAA Security Rule risk analysis is a foundation for deciding what safeguards your clinic needs. Identify where ePHI is created, received, stored, accessed, and transmitted—including the EHR, patient portal, imaging systems, email, backups, mobile devices, remote-monitoring platforms, and vendor systems. HHS describes risk analysis as an assessment of risks and vulnerabilities that could affect the confidentiality, integrity, or availability of ePHI, including the likelihood of occurrence. See HHS guidance on risk analysis and risk management.

• Map ePHI flows: Document the systems, devices, locations, users, and outside organizations that handle patient information.
• Identify threats and vulnerabilities: Consider inappropriate access, lost devices, phishing, misdirected messages, system outages, ransomware, and insecure vendor connections.
• Assess likelihood and impact: Consider how a threat could affect patients and clinic operations if a safeguard failed.
• Record decisions: Document identified risks, existing safeguards, gaps, planned actions, responsible owners, and target dates.
• Revisit the analysis: Review whether safeguards remain effective and reassess when changes—such as a new remote-monitoring system or vendor—alter the security environment.

The Security Rule requires a risk analysis and ongoing risk management, but it does not set a universal annual schedule for every clinic. The frequency and scope of reviews should reflect the clinic’s circumstances, risks, and changes. HHS provides Security Rule guidance and risk-analysis resources.

Which administrative safeguards and workforce training are required?

Administrative safeguards include the policies and management processes your clinic uses to protect ePHI. Assign security responsibilities, maintain written procedures, authorize workforce access according to job duties, and establish a process to review and remove access when roles change or employment ends.

Prepare for security incidents and service interruptions. Your procedures should explain how staff report suspected incidents, who investigates them, how the clinic preserves relevant records, and how it maintains or restores access to essential information during an emergency. Keep documentation of risk-management decisions, security policies, and periodic evaluations.

Train workforce members on the privacy and security practices relevant to their responsibilities, and document training. The Privacy Rule calls for training on privacy policies and procedures as necessary and appropriate for workforce members to perform their duties; the Security Rule also includes security-awareness training. The specific format can suit the clinic, but training should address practical risks such as verifying recipients before sending records, protecting login credentials, handling suspicious messages, and reporting lost devices. See HHS guidance on provider privacy responsibilities and training.

How can clinics secure facilities, workstations, and devices?

Physical safeguards apply to systems that access ePHI whether they are located at the clinic or elsewhere. Control access to areas containing records and equipment, and position screens and printers to reduce exposure to patients, visitors, and unauthorized staff. Set expectations for using workstations in exam rooms, reception areas, and shared workspaces.

For laptops, tablets, phones, and removable media, maintain an inventory and establish rules for approved use, secure storage, remote access, and reporting loss or theft. Apply appropriate protections to devices that access ePHI, including those used by staff working off-site. When equipment or media is reused or disposed of, remove ePHI securely or destroy the media as appropriate. See HHS guidance on physical safeguards and HHS guidance on reuse and disposal of devices containing ePHI.

What technical safeguards protect EHRs and remote monitoring data?

Configure EHRs and monitoring platforms so users can access only the information needed for their assigned work. Use unique user identification, appropriate authentication, access controls, and audit controls that help the clinic review activity in systems containing ePHI. Maintain procedures for emergency access and for protecting information from improper alteration or destruction.

Protect ePHI sent between the clinic, patients, and service providers. Assess transmission risks, use secure configurations, and consider encryption for stored and transmitted information. HIPAA’s Security Rule is technology-neutral; it requires appropriate safeguards based on the clinic’s circumstances rather than prescribing one product or security method for every organization.

Multifactor authentication (MFA) can reduce the risk that a stolen password will expose an EHR, portal, or remote-monitoring account. Include MFA in the clinic’s risk assessment and security plan, especially for remote access and accounts with broad permissions. HIPAA does not name MFA as a universally required implementation specification, so document how the safeguards selected address identified risks. See HHS’s summary of the HIPAA Security Rule and HHS Security Rule guidance.

How should clinics manage vendors and business associate agreements?

List vendors that create, receive, maintain, or transmit PHI on the clinic’s behalf. Depending on the services and access involved, these may include EHR and cloud providers, remote-monitoring platforms, billing services, and other technology or administrative vendors. Determine each party’s role before sharing patient information; not every service provider is automatically a business associate.

When a vendor is a business associate, put a written business associate agreement (BAA) in place before allowing the vendor to handle PHI on the clinic’s behalf. The agreement should define permitted uses and disclosures, require appropriate safeguards, address incident reporting, cover subcontractors, and specify how the vendor will assist with patient-rights obligations when applicable. Review the agreement and the vendor’s security practices as part of ongoing risk management. See HHS business associate guidance and HHS sample BAA provisions.

How should clinics handle patient rights requests and report breaches?

Give patients a current notice of privacy practices (NPP) that explains how the clinic may use and disclose PHI and describes their privacy rights and how to exercise them. Make sure staff know where to route requests for access, amendment, restrictions, and complaints. For access requests, the general HIPAA deadline is 30 calendar days, with a limited extension available when the clinic provides the required written explanation and completion date. See HHS guidance on the NPP and HHS guidance on access-request deadlines.

Maintain a process for responding to requests for an accounting of disclosures. The right generally covers certain disclosures during the six years before the request, with exceptions such as disclosures for treatment, payment, or health care operations. Coordinate with business associates so the clinic can obtain information needed to respond. See HHS guidance on the accounting of disclosures.

After discovering a possible breach, promptly contain the incident, preserve relevant evidence, assess what happened, and determine whether unsecured PHI was involved and whether an exception applies. Document the determination and follow the breach notification rule when notification is required. Covered entities generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting 500 or more individuals, notice to HHS is also due without unreasonable delay and within 60 days; for breaches affecting fewer than 500 individuals, the clinic may report to HHS annually, no later than 60 days after the end of the calendar year in which the breach was discovered. Additional media notice is required when a breach affects more than 500 residents of a state or jurisdiction. See HHS’s Breach Notification Rule guidance.

In practice, a strong HIPAA program connects the clinic’s ePHI inventory and risk analysis to workforce procedures, physical and technical safeguards, vendor oversight, patient-rights workflows, and breach-response plans. Review those elements together as the clinic’s systems, services, and risks change.

FAQs.

Does HIPAA apply to remote monitoring data from kidney patients?

It applies when the data is PHI created, received, maintained, or transmitted by a covered clinic or its business associate. Information stored only in an independent consumer app that is not provided by or on behalf of a covered entity or business associate may fall outside HIPAA’s scope. Assess who provides the service and handles the data.

What should a clinic include in its ePHI risk analysis?

Include an inventory of systems, devices, locations, users, and vendors that handle ePHI; the ways information flows between them; relevant threats and vulnerabilities; the likelihood and potential impact of those risks; existing safeguards; and documented actions to address gaps. Reassess when material changes affect the clinic’s security environment.

When does a kidney clinic need a business associate agreement?

A clinic generally needs a BAA when a vendor qualifies as a business associate by performing certain functions or services on the clinic’s behalf that involve PHI. The agreement should be in place before the vendor handles PHI and should set out permitted uses, required safeguards, incident reporting, and other required terms.

What must a clinic do after discovering a breach of unsecured PHI?

Contain and investigate the incident, determine whether it is a reportable breach, document the assessment, and provide required notices without unreasonable delay. Individual notices are due no later than 60 calendar days after discovery. HHS reporting and, where applicable, media notice depend on how many people were affected and where they reside.