HIPAA Compliance Checklist for Recuperative Care Programs Serving Homeless Adults

Recuperative care programs—also called medical respite programs—support people experiencing homelessness as they recover from illness or injury. Because these programs may involve health care providers, housing partners, social-service agencies, and sensitive records, a clear privacy process helps protect residents while enabling appropriate care coordination.

Determine Whether the Program Is a Covered Entity or Business Associate

• Assess covered entity status. A health care provider generally qualifies as a HIPAA covered entity if it conducts, or has another party conduct on its behalf, certain standard health care transactions electronically. The program’s name or mission alone does not determine its status; assess the legal entity’s activities and arrangements.
• Assess business associate status. A program may be a business associate if it performs services for a covered entity that involve creating, receiving, maintaining, or transmitting protected health information (PHI). A contract or partnership does not automatically make an organization a business associate; the services and information flows matter.
• Document the decision. Record which entity provides health care, who bills or submits standard transactions, which organizations handle PHI on another organization’s behalf, and what written agreements apply. Reassess when services or partnerships change.

Conduct a Protected Health Information Risk Analysis

If HIPAA’s Security Rule applies, conduct and document an accurate, thorough risk analysis covering all electronic protected health information (ePHI) the organization creates, receives, maintains, or transmits. Map ePHI in electronic records, email, mobile devices, shared systems, backups, and vendor platforms, then identify potential threats, vulnerabilities, and the likelihood and impact of harm.

Use the findings to prioritize risk-reduction steps, assign owners and deadlines, and track completion. Revisit the analysis when the program changes its technology, services, staffing, or information-sharing arrangements. The analysis should inform the program’s electronic protected health information safeguards rather than sit unused as a one-time document.

Implement Administrative Physical and Technical Safeguards

• Administrative safeguards: Assign privacy and security responsibilities; train staff and volunteers; use role-based access; establish procedures for incident reporting, termination of access, and secure records handling.
• Physical safeguards: Secure paper files, devices, and work areas; limit access to records rooms; position screens and printers to reduce incidental viewing; and establish procedures for lost or stolen devices.
• Technical safeguards: Use individual accounts, strong authentication, access controls, and audit logs where appropriate. Protect data in transit and on devices with reasonable security measures based on risk, and maintain secure backups and recovery procedures.

HIPAA requires reasonable and appropriate administrative, physical, and technical safeguards for ePHI; it does not prescribe one technology setup for every organization. Choose and document measures suited to the program’s size, resources, systems, and risks.

Protect Privacy During Referrals and Admissions

Design referral and admission workflows to collect only information needed to determine eligibility, coordinate care, and provide services. Explain how health information may be used and shared, identify who can answer privacy questions, and offer a private way to discuss health needs when feasible.

Keep referral forms, admission paperwork, and consent documents distinct. An acknowledgment that someone received a privacy notice is not the same as an authorization to disclose information. Before sending records to a shelter, housing provider, or other social-service partner, identify the applicable HIPAA permission or obtain a valid individual authorization for disclosure when required.

HIPAA generally allows covered providers to share PHI with other providers for treatment without an individual’s authorization. That permission does not automatically cover every social-service partner or every purpose.

Set Rules for Care Coordination and Minimum Necessary Disclosures

Write down who may share information, with whom, for what purpose, and through which channels. For routine disclosures, define what information is appropriate—for example, a care plan or follow-up need rather than an entire record—and verify the recipient before sending it. Use secure communication methods and document disclosures when required by applicable policy or law.

The minimum necessary standard generally requires covered entities to take reasonable steps to limit PHI used, disclosed, or requested to what is needed for the purpose. It does not apply to disclosures to, or requests by, a health care provider for treatment. Even when that exception applies, practical safeguards and clear recipient verification help prevent accidental disclosures.

Execute Business Associate Agreements

When a covered entity engages a business associate to perform services involving PHI, put a compliant business associate agreement (BAA) in place before the arrangement begins. The agreement should define permitted and required uses of PHI, require appropriate safeguards and incident reporting, address subcontractors, and explain what happens to PHI when the services end.

Review vendors that host electronic records, provide IT support, or otherwise handle PHI on the program’s behalf. Determine whether each is a business associate or subcontractor and keep the related agreement and contact information current. A BAA does not replace the program’s own risk analysis, workforce training, or oversight of information-sharing practices.

Safeguard Substance Use Disorder Records

Determine whether the program is a federally assisted substance use disorder program subject to 42 CFR Part 2, and whether records it holds are protected by that rule. Part 2 protections can apply to qualifying programs that provide substance use disorder diagnosis, treatment, or referral services; a program should not assume that all behavioral health information is automatically a Part 2 record or that HIPAA alone answers every disclosure question.

For covered Part 2 records, follow the applicable consent and disclosure rules, including restrictions on disclosures for proceedings against a patient. The 2024 Part 2 final rule permits a single consent for certain future treatment, payment, and health care operations disclosures, subject to the rule’s requirements and protections. Compliance with that final rule was required by February 16, 2026.

In practice, maintain a process to identify Part 2 records, confirm whether a valid consent or a specific exception permits a disclosure, and ensure the disclosure stays within its permitted scope. Train staff not to treat a general HIPAA authorization as automatically sufficient for every Part 2 disclosure.

In summary, determine the program’s HIPAA role, map and assess its PHI, apply appropriate safeguards, control referral and coordination disclosures, put BAAs in place where required, and separately evaluate whether Part 2 protections apply.

FAQs

Does HIPAA apply to every recuperative care program?

No. HIPAA applies to covered entities and business associates as defined by the law, not automatically to every organization that provides recuperative care. A health care provider may be a covered entity when it conducts standard transactions electronically, including through another party on its behalf. A program’s actual activities and relationships determine its status.

Can recuperative care providers share protected health information with social-service partners?

Sometimes, but not automatically. A covered provider may generally disclose PHI to another health care provider for treatment without authorization. Sharing with a social-service partner must have an applicable legal basis, such as a valid individual authorization or another permitted disclosure. Limit the information to what is appropriate for the purpose and use reasonable safeguards.

What privacy practices should referral and admission processes include?

Collect only information needed for the referral or admission decision, explain relevant privacy practices, provide a way to ask questions, and separate privacy-notice acknowledgments from disclosure authorizations. Before sending information outside the care team, confirm the recipient, purpose, and applicable permission, and use a secure communication method.

When is written consent required to disclose substance use disorder records?

It depends on whether the records are subject to 42 CFR Part 2 and whether a permitted exception applies. For covered Part 2 records, obtain consent that meets the rule’s requirements when needed; do not assume that a general release or HIPAA authorization is enough for every disclosure. Part 2 also imposes specific protections for records used in proceedings against a patient.