HIPAA Compliance Checklist for Sexually Transmitted Infection Clinics

A strong HIPAA compliance checklist for sexually transmitted infection (STI) clinics should address more than electronic records. You also need clear rules for sensitive conversations, record requests, staff access, physical files, vendors, and suspected breaches. Use this checklist to assess your clinic’s practices, then confirm how applicable state and local laws affect them.

Determine whether the STI clinic is a HIPAA covered entity

An STI clinic is not automatically a HIPAA covered entity solely because it provides health care. A health care provider is generally covered if it transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as certain electronic billing transactions. Review the clinic’s billing and other applicable electronic transactions, including those conducted through a billing service or other agent, against the HHS explanation of covered entities.

• Document whether the clinic is a health care provider that meets the covered-entity definition, or whether another HIPAA role applies.
• Identify which clinic locations, programs, and systems handle protected health information (PHI), including information about STI testing, diagnosis, and treatment.
• Determine whether any vendors or outside organizations that handle PHI for the clinic are business associates.
• Check applicable state and local privacy, record-retention, minor consent, and public-health reporting laws. State law may provide greater privacy protections or individual rights than HIPAA, as explained in HHS guidance on more stringent state laws.

If the clinic is not a covered entity, it may still have obligations under state law, contracts, or another applicable federal law. Do not assume that information is unrestricted simply because HIPAA does not apply.

Establish patient confidentiality and record-release policies

Write practical policies for how the clinic uses, shares, and safeguards PHI. STI-related information can be especially sensitive for patients, so account for confidentiality in routine interactions as well as formal record disclosures.

• Set procedures for verifying identity and authority before discussing a patient’s care or releasing records. Explain how staff should respond to requests from family members, partners, employers, insurers, law enforcement, and other third parties.
• Define approved ways to contact patients about appointments, results, billing, and follow-up. Record communication preferences and use them consistently where practicable.
• Explain when authorization is needed and when HIPAA permits a disclosure without it. Depending on the circumstances, permitted disclosures may include treatment, payment, health care operations, disclosures to the patient, and certain disclosures for public-health activities or as required by law. Confirm applicable STI reporting duties under state and local law; HHS guidance on public-health disclosures describes relevant HIPAA permissions.
• Apply the minimum necessary standard when it applies: limit relevant uses, requests, and disclosures to what is reasonably needed for the purpose. The standard has exceptions, including disclosures to a health care provider for treatment and disclosures made under an individual’s authorization.
• Review state-specific rules on STI records, minor consent, confidential communications, and record access before responding to a request. Do not assume HIPAA alone resolves every release question.

If the clinic is a covered health care provider, create and maintain a Notice of Privacy Practices (NPP) that explains permitted uses and disclosures, patient rights, and how to ask questions or make a complaint. Provide it as required, make it available on request, and post it on the clinic’s website if the site provides information about the clinic’s services. See HHS guidance on the Notice of Privacy Practices.

Document a security risk analysis and risk-management plan

Conduct and document an accurate, thorough security risk analysis of the electronic protected health information (ePHI) the clinic creates, receives, maintains, or transmits. Include systems and applications, devices, locations, workflows, and relevant vendors. HHS explains that the analysis should identify risks and vulnerabilities affecting ePHI’s confidentiality, integrity, and availability, and that the Security Rule does not prescribe one single method or a fixed frequency. See HHS guidance on risk analysis.

• Inventory where ePHI resides and how it moves, including the electronic health record, patient portal, email, billing systems, mobile devices, backups, and vendor platforms.
• Assess reasonably anticipated threats, vulnerabilities, likelihood, and potential impact, including misdirected communications, inappropriate access, device loss, system failure, and cyberattacks.
• Document identified risks, the clinic’s decisions, assigned responsibilities, remediation steps, and target dates.
• Use the findings to create and maintain a risk-management plan that reduces identified risks to a reasonable and appropriate level.
• Revisit the analysis when the clinic makes material operational or technology changes, or when incidents or new information indicate that safeguards need review.

Keep the analysis and risk-management plan in a form staff can retrieve and update. A risk analysis is not a one-time checklist exercise; it should inform the clinic’s ongoing security decisions.

Train staff and control access to patient information

Train workforce members on the privacy and security policies relevant to their duties. HIPAA requires privacy training as necessary and appropriate for staff functions, and a security awareness and training program for the workforce. Document training and provide it to new workforce members within a reasonable period and when material policy changes affect their work. See the HHS HIPAA audit protocol for these requirements.

• Train staff on confidential conversations, identity verification, record requests, secure handling of results, and the clinic’s reporting process for suspected privacy or security incidents.
• Use role-based permissions so staff can access the information needed for their assigned duties, and promptly revise access when roles change or employment ends.
• Assign unique user IDs to workforce members who access systems containing ePHI; do not use shared accounts that prevent the clinic from identifying individual system activity. See HHS guidance on unique user IDs.
• Set expectations for passwords, phishing, secure messaging, remote access, and reporting lost devices or suspicious activity.
• Apply appropriate sanctions when workforce members violate clinic privacy or security policies.

There is no universal federal requirement for every employee to renew a HIPAA training certificate annually. The clinic must provide and document the training required for staff roles and applicable policy changes, and should follow any additional employer-specific, state, contractual, or accreditation requirements.

Secure paper records and clinic spaces

Protect paper PHI and the spaces where staff discuss or access patient information. The HIPAA Security Rule’s physical safeguards address facility access, workstation use and security, and devices and media. HHS summarizes these requirements in its guidance on physical safeguards.

• Store charts, printed schedules, test results, and intake forms in secured areas when staff are not actively using them.
• Use practical safeguards at reception and in waiting areas to reduce the risk that patients or visitors can see another patient’s name, visit reason, or paperwork.
• Position screens and printers to limit casual viewing, and secure workstations and equipment when not in use.
• Use physical safeguards to limit access to records rooms, file cabinets, and other areas where PHI is stored to authorized personnel.
• Set procedures for transporting, copying, scanning, and disposing of paper records so information cannot be read or recovered by unauthorized people.

Protect electronic records and maintain backups

Use administrative, physical, and technical safeguards to protect ePHI from unauthorized access, improper alteration, and loss. Select safeguards based on the clinic’s environment and documented risk analysis rather than relying on a single product or technology.

• Use individual accounts and access controls, and review system access and activity as appropriate.
• Secure devices and remote access, and use encryption where reasonable and appropriate to the clinic’s circumstances and risks.
• Maintain retrievable backup copies of ePHI and document procedures for restoring data and continuing critical operations during an emergency. The Security Rule’s contingency-plan requirements include a data backup plan and disaster-recovery procedures; see HHS guidance on ransomware and HIPAA.
• Test restoration procedures periodically and ensure backup copies are protected from the same incidents that could affect the primary system.
• Document how staff report, investigate, contain, and respond to security incidents, including suspected unauthorized access or loss of ePHI.

A cloud or hosted system does not remove the clinic’s responsibility to assess risk and safeguard ePHI. HHS notes that covered entities and business associates using cloud service providers remain responsible for applicable HIPAA requirements; see HHS guidance on cloud computing.

Manage vendor agreements, privacy notices, and breach response

Identify vendors that create, receive, maintain, or transmit PHI on the clinic’s behalf, such as billing companies, hosted record providers, and certain IT or communications vendors. When a vendor is a business associate, generally obtain a written business associate agreement (BAA) that addresses permitted uses and disclosures, safeguards, incident reporting, and other required terms. Review HHS guidance on business associate contract provisions.

• Keep an up-to-date list of business associates, the services they provide, and the PHI they handle.
• Confirm that BAAs are signed and current, and that they address subcontractors where applicable.
• Review vendor access and security responsibilities when services change or an agreement ends.
• Keep the clinic’s Notice of Privacy Practices consistent with actual practices, and revise it when required after material changes. See HHS NPP guidance.
• Maintain written procedures for suspected breaches, including escalation contacts, evidence preservation, investigation, mitigation, and decisions about required notifications.

Under the breach notification rule, a covered entity must notify affected individuals of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery. Reporting to HHS and, for certain breaches, the media also applies; the applicable requirements depend in part on how many people are affected. A business associate must notify the covered entity as required. Follow the details in HHS breach notification guidance.

Retain HIPAA-required policies, procedures, and documentation for at least six years from creation or the date they were last in effect, whichever is later. This is not a universal HIPAA medical-record retention period: check state law and other applicable requirements for patient charts. See the HHS audit protocol.

In summary, an effective clinic checklist confirms HIPAA status, protects confidential interactions and records, documents risk and safeguards, limits workforce access, oversees vendors, and prepares the clinic to respond promptly to incidents. Review the checklist regularly and adapt it to the clinic’s services and applicable state and local requirements.

FAQs

Are all sexually transmitted infection clinics covered by HIPAA?

No. Providing health care alone does not automatically make a clinic a HIPAA covered entity. A health care provider is generally covered when it conducts certain transactions electronically, such as standardized electronic billing. Review the clinic’s operations and any applicable business associate role using HHS covered-entity guidance. State privacy laws or other obligations may still apply if HIPAA does not.

When can an STI clinic release patient records without written permission?

Depending on the circumstances, HIPAA may permit disclosure without an individual’s written authorization for treatment, payment, and health care operations; to the individual; for certain public-health activities; or when required by law. Other permissions and conditions may apply. The minimum necessary standard generally applies when relevant, but has exceptions, including disclosures for treatment and disclosures made under an individual’s authorization. Check state STI confidentiality, reporting, and minor-consent laws before releasing records. See HHS’s Summary of the HIPAA Privacy Rule and its public-health disclosure guidance.

How long must an STI clinic retain HIPAA compliance documentation?

HIPAA-required documentation generally must be retained for six years from its creation or the date it was last in effect, whichever is later. That rule applies to required compliance documentation; it does not set a universal retention period for patient medical records. Check applicable state law and other requirements for clinical records. See the HHS HIPAA audit protocol.

What should an STI clinic do after a suspected data breach?

Promptly follow the clinic’s incident-response procedures: contain the incident where possible, preserve relevant evidence, document what is known, assess the PHI involved, and mitigate potential harm. Determine whether the event is a breach of unsecured PHI and whether notifications are required. The breach notification rule generally requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery; additional HHS and, in some cases, media notices may apply. See HHS breach notification guidance.