HIPAA Compliance Checklist for Scleral Lens Fitting Practices

Determine whether your optometry practice is a HIPAA covered entity

Start by checking how your practice handles health information—not simply whether you provide eye care. An optometry practice generally qualifies as a HIPAA covered entity if it is a health care provider that electronically transmits health information in connection with a transaction for which HHS has adopted a standard, such as certain electronic claims or payment transactions. The rule can apply when a billing service or other organization conducts the transaction on the practice’s behalf. See HHS guidance on covered entities.

Document which transactions you conduct electronically, who conducts them, and whether a clearinghouse or business associate is involved. If you do not meet the covered-entity definition, other privacy, security, contractual, or state-law duties may still apply; assess those separately.

Map electronic protected health information and document a security risk analysis

Inventory where electronic protected health information ePHI is created, received, stored, or transmitted. For a scleral lens fitting practice, that may include patient demographics, examination notes, corneal images and measurements, lens specifications, prescriptions, follow-up records, billing data, patient messages, and backups. Include every system and device that holds or handles this information, including practice-management and electronic health record systems, imaging equipment, email, cloud storage, and portable devices.

The HIPAA Security Rule requires a security risk analysis that covers potential risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI in the practice’s environment. Record the information systems and data locations reviewed, reasonably anticipated threats, existing safeguards, identified risks, and planned corrective steps. Revisit the analysis when systems, workflows, locations, or risks change; HHS describes risk analysis as foundational to selecting appropriate safeguards in its Security Rule risk analysis guidance.

Protect patient privacy and support access and amendment requests

Maintain a current Notice of Privacy Practices NPP that explains how your practice may use and disclose PHI, patients’ rights, and how to submit questions or complaints. Provide it as required, keep it available at the practice, and post it on a website that provides information about your services. For a patient with a direct treatment relationship, the practice generally provides the notice by the first service and makes a good-faith effort to obtain an acknowledgment of receipt. See HHS guidance on Notices of Privacy Practices.

Set up a clear process to receive, verify, track, and respond to requests to access or amend records. In general, respond to an access request within 30 calendar days; one extension of up to 30 additional days is available if you give the patient a timely written explanation. Act on an amendment request within 60 days, with one extension of up to 30 days when the required notice is provided. Coordinate promptly with vendors that hold records for you, because their involvement does not pause your response deadlines. See HHS access-request timing guidance and the HIPAA Privacy Rule provisions on amendments.

Establish workforce policies training and role-based access

Assign responsibility for privacy and security, and maintain written policies for handling PHI, responding to suspected incidents, using devices, disposing of records, and applying appropriate sanctions for violations. Tailor procedures to your actual work: for example, define how staff may discuss fittings at the front desk, access imaging, send lens orders, or handle patient communications.

Train workforce members on the policies relevant to their duties, document the training, and provide further training when a material policy change affects their work. A course-completion certificate can document one training activity, but it does not establish that the practice as a whole meets HIPAA requirements. HIPAA does not make annual certificate renewal a universal federal requirement; follow applicable training duties and your practice’s policies. HHS describes training, documentation, and sanctions in its HIPAA audit protocol.

Use role-based access controls so each workforce member can reach the ePHI needed for their job, and remove or adjust access promptly when roles change or employment ends. Review user accounts periodically and avoid shared logins where individual accounts are available. HHS explains that access policies should reflect workforce roles and functions in its HIPAA Security Rule summary.

Assess vendors and execute business associate agreements

List vendors that create, receive, maintain, or transmit PHI on your practice’s behalf, then determine whether each is a business associate. Potential examples include billing and practice-management services, transcription providers, and cloud services that store or process ePHI. A cloud provider may be a business associate even if it cannot view encrypted information it maintains for the practice. Whether a vendor qualifies depends on its role and the information it handles, not just its product label.

Before a business associate handles PHI, put a written business associate agreement BAA in place. The BAA should address permitted uses and disclosures, safeguards, incident reporting, subcontractors, and the vendor’s support for patient rights and record access, as applicable. Review the agreement when services or data flows change. See HHS guidance on business associates and BAAs and HHS guidance on cloud computing.

Secure electronic and physical records devices and communications

Choose safeguards that are reasonable and appropriate for your practice’s size, systems, and risks. For electronic records, consider unique user accounts, authentication, access controls, audit logs, secure backups, and protections for remote access and mobile devices. Evaluate encryption for stored and transmitted ePHI as part of your risk analysis; the Security Rule’s implementation specifications allow flexibility in how appropriate safeguards are selected.

Protect paper records, printed prescriptions, lens orders, and patient labels from casual viewing or unauthorized access. Secure record rooms and workstations, position screens away from public areas, verify recipients before sending information, and use secure disposal methods. Establish rules for discussing patient information where others may overhear and for transporting records or devices outside the office. HHS describes physical safeguards for electronic systems and related equipment in its physical safeguards guidance.

Document breach response and retain compliance records

Maintain a written response plan that tells staff how to report a lost device, misdirected message, unauthorized access, or other suspected incident. The plan should identify who investigates, how the practice preserves relevant records, how it evaluates whether unsecured PHI was breached, and how it documents mitigation and notifications. Not every incident is a reportable breach, so record the assessment and its basis.

When a breach of unsecured PHI is reportable, affected individuals must generally be notified without unreasonable delay and no later than 60 calendar days after discovery. Separate reporting duties may apply to HHS and, for certain larger breaches, the media. A business associate must notify the covered entity under the applicable rule and BAA. See the HHS Breach Notification Rule guidance.

Keep required HIPAA policies, procedures, risk-analysis materials, and other required compliance documentation for six years from creation or the date it was last in effect, whichever is later. This HIPAA documentation retention period is not a general federal requirement to keep medical records for six years; medical-record retention is generally governed by state law. See HHS documentation-retention guidance and its medical-record retention FAQ.

In practice, a useful checklist connects the practice’s HIPAA status to a current ePHI inventory, documented risk analysis, patient-rights process, trained workforce, reviewed vendor agreements, safeguards, and a tested incident-response plan.

FAQs

When is a scleral lens fitting practice subject to HIPAA?

A practice is generally subject to HIPAA as a covered entity when it provides health care and electronically transmits health information in connection with a HIPAA-standard transaction, such as certain electronic claims or payment transactions. The transaction may be conducted by the practice or on its behalf. See HHS guidance on covered entities.

What should a HIPAA security risk analysis cover?

It should cover all ePHI the practice creates, receives, maintains, or transmits, including where it is stored and how it moves between systems and people. Identify threats and vulnerabilities, assess current safeguards and risks, and document steps to address risks. Update the analysis when relevant operational or technology changes occur. See HHS risk analysis guidance.

Which vendors need a business associate agreement?

A vendor generally needs a BAA when it is a business associate—that is, when it handles PHI on the practice’s behalf through services that involve creating, receiving, maintaining, or transmitting PHI. This can include billing, practice-management, transcription, or cloud services, depending on the service and data involved. See HHS guidance on business associates.

How soon must a practice notify affected individuals after a reportable breach?

Notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a reportable breach of unsecured PHI. Additional HHS and, in some cases, media notifications may also be required. See the HHS Breach Notification Rule guidance.