HIPAA Compliance Checklist for Shelter-Based Health Clinics

A shelter-based clinic may need to comply with HIPAA if it is a covered health care provider or a business associate handling protected health information (PHI) for a covered entity. The shelter setting does not, by itself, determine whether HIPAA applies. Start by confirming the clinic’s status, then use this checklist to protect patient information in shared, busy, and sometimes temporary care environments.

Establish Privacy Procedures and Staff Training

Write down how staff and volunteers may use, disclose, discuss, and safeguard PHI. Procedures should reflect the realities of shelter-based care, including shared reception areas, private conversations, outreach visits, interpreters, and coordination with shelter staff.

• Use private spaces for clinical conversations when possible, and avoid discussing patient details where others can overhear.
• At check-in, collect only the information needed for care and direct visitors away from sign-in sheets that reveal other patients’ names or appointments.
• Set rules for handling paper charts, messages, referrals, photographs, and requests for information from family, shelter staff, law enforcement, or other service providers.
• Train workforce members when they join and periodically afterward. Cover confidentiality, approved disclosures, secure communication, incident reporting, and consequences for inappropriate access or disclosure.
• Document training, acknowledgments, policy updates, and any corrective actions.

Safeguard Electronic Protected Health Information

Identify where electronic protected health information (ePHI) is created, received, maintained, or transmitted. Include electronic health records, laptops, phones, email, cloud services, backup systems, and any devices used during mobile or outreach care.

• Complete and document a HIPAA Security Rule risk analysis that identifies ePHI, relevant systems, potential threats and vulnerabilities, and the likelihood and impact of possible harm.
• Use the findings to select and implement safeguards, assign responsibility for addressing risks, and track unresolved issues. Revisit the analysis when systems, services, or clinic operations change.
• Protect devices and accounts with appropriate authentication, screen locks, secure configurations, and encryption where reasonable and appropriate. Document decisions about safeguards, including alternatives where a safeguard is not implemented.
• Maintain secure backups and a plan for restoring access to ePHI and continuing essential care during outages or emergencies.
• Use audit controls and activity review to record and check access to information systems. Review suspicious activity and document how incidents are investigated and resolved.

Restrict Access to Patient Records

Give each workforce member access to the records and functions needed for their job, not unrestricted access to the clinic’s full patient database. Role-based access control (RBAC) can help align permissions with clinical, administrative, and support responsibilities.

• Assign unique user accounts; do not share passwords or use a common account for multiple staff members.
• Set procedures for approving access, changing permissions when duties change, and promptly disabling accounts when someone leaves.
• Review access permissions periodically, including access for temporary staff, volunteers, students, and staff who work across clinic and shelter operations.
• Explain how emergency access is authorized and documented, and review emergency access afterward.
• Use audit logs to investigate unusual access, such as viewing records without a work-related reason.

Manage Business Associate Agreements

Determine which vendors and service providers create, receive, maintain, or transmit PHI on the clinic’s behalf and meet HIPAA’s definition of a business associate. Depending on the services involved, this may include technology, billing, records storage, or other support providers.

• Complete a business associate agreement (BAA) before allowing a business associate to handle PHI, unless an applicable HIPAA exception applies.
• Specify permitted uses and disclosures of PHI, required safeguards, and the business associate’s responsibility to report security incidents and breaches.
• Set a clear contract deadline and process for reporting suspected or confirmed breaches to the clinic. A BAA can require notice sooner than the legal outside limit.
• Require the business associate to ensure applicable subcontractors agree to protect PHI as required.
• Keep executed BAAs, track renewal or service changes, and address material failures to meet contractual requirements.

Assess and Document Suspected Breaches

Have a clear process for reporting and responding to suspected loss, theft, unauthorized access, or disclosure of PHI. Staff should know how to report a concern promptly, even when they are unsure whether it qualifies as a breach.

• Contain the incident where possible, preserve relevant records and system logs, and identify the PHI and people potentially affected.
• Document when the clinic discovered the incident, what happened, which systems or records were involved, and the steps taken to investigate and reduce harm.
• Assess whether the event falls within a HIPAA breach exception or whether a documented risk assessment supports a low probability that PHI was compromised.
• Record the reasoning and supporting facts, the decision about notification, and any remediation or changes made to prevent recurrence.
• Coordinate with the privacy or security lead and, when appropriate, legal counsel and affected business associates.

Meet HIPAA Breach Notification Deadlines

For a breach of unsecured PHI, breach notification under 45 CFR 164.404 requires a covered entity to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Prepare a response process in advance so investigation and drafting do not cause avoidable delay.

• Provide affected individuals with the required notice, including a description of the breach, the types of information involved, steps they can take to protect themselves, the clinic’s response, and contact information.
• For a breach affecting 500 or more individuals, notify the Secretary of Health and Human Services without unreasonable delay and within 60 calendar days of discovery. For a breach affecting fewer than 500 individuals, maintain the required records and report it no later than 60 days after the end of the calendar year in which it was discovered.
• If a breach affects more than 500 residents of a state or jurisdiction, determine and provide any required notice to prominent media outlets serving that area.
• If a business associate discovers a breach, it must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The clinic’s BAA should set a workable, preferably shorter, reporting deadline so there is time to assess and meet notification obligations.

Effective compliance depends on consistent privacy practices, a documented assessment of ePHI risks, carefully limited access, clear business associate terms, and a practiced incident-response process. Assign owners to each task and keep records showing how the clinic follows through.

FAQs

What privacy procedures should a shelter-based health clinic maintain?

Maintain written procedures for using and disclosing PHI, patient communications, access to records, handling paper and electronic information, responding to information requests, reporting incidents, and notifying affected people when required. Address shared spaces, shelter coordination, outreach work, and staff or volunteer training.

How should a clinic assess risks to electronic protected health information?

Inventory the systems and locations where ePHI is stored or accessed, identify potential threats and vulnerabilities, and assess the likelihood and impact of harm to its confidentiality, integrity, and availability. Document findings, select safeguards to address the risks, assign follow-up actions, and update the assessment when the clinic’s systems or operations change.

What must a business associate agreement require about breach notification?

A BAA must require the business associate to report breaches of unsecured PHI as required by HIPAA and address its reporting of security incidents. Specify how and how quickly the business associate must notify the clinic, what information it must provide to support the clinic’s response, and how applicable subcontractors must handle PHI and report incidents.

When must a clinic notify patients and report a breach to the federal government?

For a breach of unsecured PHI, notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Report a breach affecting 500 or more individuals to the Secretary of Health and Human Services without unreasonable delay and within 60 calendar days. For breaches affecting fewer than 500 individuals, report to the Secretary within 60 days after the end of the calendar year in which the breach was discovered.