HIPAA Compliance Checklist for Sickle Cell Disease Day Hospitals

A sickle cell disease day hospital handles protected health information (PHI) across registration, clinical care, infusion services, billing, and follow-up. Use this checklist to review privacy practices, safeguards, workforce procedures, vendor agreements, and breach response. It describes general federal HIPAA requirements; confirm how they apply to your organization and any stricter state laws with qualified compliance counsel.

HIPAA obligations apply to organizations that meet the definition of a covered entity or business associate. A health care provider is generally a covered entity when it conducts specified electronic transactions. See HHS guidance on covered entities and business associates.

How should day hospitals limit and disclose protected health information?

Build day-to-day procedures around the Privacy Rule’s permitted uses and disclosures, patient rights, and the minimum necessary standard. The standard generally calls for reasonable limits on PHI used, disclosed, or requested for payment and health care operations. It does not apply to disclosures to, or requests by, a health care provider for treatment purposes. See HHS guidance on Privacy Rule standards.

• Define access by role. Establish which staff roles need access to which records to perform their work, and review access when responsibilities change. Treatment teams need appropriate clinical information, while other tasks may require less.
• Protect conversations and displays. Train staff to avoid discussing patient details where visitors or other patients can overhear, and position screens, printed schedules, and sign-in materials to reduce unintended viewing.
• Use approved communication methods. Verify identity before discussing a patient’s care, follow the patient’s documented communication preferences, and use approved channels for messages, referrals, and records.
• Check the authority for each disclosure. Treatment, payment, and health care operations generally do not require patient authorization, subject to Privacy Rule limits. Disclosures for other purposes may require a valid protected health information authorization or another specific permission under the Rule.
• Document patient choices and requests. Maintain applicable authorizations, restrictions, and requests for confidential communications, and make them available to staff who need to follow them.

HIPAA generally requires written authorization for uses or disclosures that are not otherwise permitted or required by the Privacy Rule. Certain disclosures—such as many marketing uses and most uses or disclosures of psychotherapy notes—have specific authorization rules and exceptions. See the HHS summary of the Privacy Rule.

Which administrative, physical, and technical safeguards should the checklist cover?

The Security Rule requires appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI). Safeguards should fit the day hospital’s systems, workflows, and identified risks; there is no one-size-fits-all technology checklist. See the HHS Security Rule overview.

• Administrative safeguards: Assign security responsibility; conduct and document an electronic protected health information risk assessment; manage identified risks; set workforce access procedures; review system activity; prepare for security incidents; and maintain contingency plans for emergencies that affect access to ePHI.
• Physical safeguards: Control facility and room access; establish safe workstation-use practices; secure devices and screens; and define how staff inventory, move, reuse, and dispose of devices and media containing ePHI.
• Technical safeguards: Use individualized access controls and authentication; maintain audit controls; protect ePHI from improper alteration or destruction; and secure electronic transmission in ways appropriate to the organization’s systems and risks.
• Review and update: Reassess safeguards as systems, vendors, sites, workflows, or identified risks change. Track remediation tasks, responsible owners, and completion evidence.

HHS describes risk analysis as assessing threats and vulnerabilities that could affect ePHI and the likelihood of their occurrence; risk management is implementing measures to reduce identified risks. See HHS guidance on risk analysis and risk management. A documented assessment should cover ePHI wherever the day hospital creates, receives, maintains, or transmits it—not only information stored in the main electronic health record.

What workforce policies, training, and sanctions are required?

Written procedures should explain how staff and other workforce members protect PHI, report concerns, and respond to suspected incidents. HIPAA requires workforce training on the organization’s privacy policies and procedures, security awareness and training, and appropriate sanctions for workforce members who fail to comply.

• Train for the actual workplace. Cover the day hospital’s own policies and workflows, including identity verification, record access, patient communications, device security, and incident reporting. A generic course or completion certificate does not establish that the organization as a whole is HIPAA-compliant.
• Meet applicable training triggers. Privacy Rule training is required for new workforce members within a reasonable period after they join and for affected members when relevant policies materially change. HIPAA does not set a universal annual certificate-renewal deadline; an employer may set periodic refreshers under its own policies and risk-management program.
• Limit and review access. Follow documented processes for granting, changing, and ending access, including when staff change roles or leave.
• Apply sanctions consistently. Define how violations are assessed and addressed, and document the actions taken. Sanctions should reflect the organization’s policies and the circumstances of the violation.
• Make reporting practical. Give staff a clear way to report misdirected messages, lost devices, snooping, inappropriate disclosures, and other possible privacy or security incidents promptly.

The Security Rule identifies security management, assigned responsibility, workforce security, information access management, security awareness and training, incident procedures, contingency planning, evaluation, and business associate arrangements among its administrative safeguards. See the HHS Security Series guidance on administrative safeguards and 45 CFR § 164.530. HIPAA also requires workforce training on relevant organizational policies and procedures.

How should business associate agreements protect patient information?

Identify vendors and contractors that create, receive, maintain, or transmit PHI on the day hospital’s behalf, then determine whether the relationship makes them business associates under HIPAA. Examples may include certain billing, records-hosting, or technology services; a vendor’s role and activities matter, so do not assume every supplier is a business associate.

Before allowing a business associate to handle PHI, have a written HIPAA business associate agreement that meets the Rule’s requirements. Review each agreement to confirm that it:

• Defines permitted and required uses and disclosures of PHI and restricts other uses or disclosures.
• Requires appropriate safeguards for PHI, including applicable ePHI protections.
• Requires the business associate to report impermissible uses or disclosures and security incidents, and to notify the hospital of breaches as required.
• Addresses subcontractors that handle PHI and requires appropriate written protections for them.
• Sets procedures for access to or amendment of records, accounting of disclosures, and other Privacy Rule duties the business associate performs for the hospital.
• Provides for return or destruction of PHI when the relationship ends, when feasible, and addresses continued protection if return or destruction is not feasible.

HHS explains that the agreement must describe permitted and required uses and disclosures, prohibit unauthorized uses and disclosures, and include other required terms. A vendor’s self-certification or third-party certificate is not a substitute for a required agreement. See HHS guidance on business associates.

How should hospitals assess and document a suspected breach?

Use a written incident-response process that staff can follow immediately. A suspected incident is not automatically a reportable breach, but an impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an exception applies or the covered entity or business associate demonstrates a low probability that the PHI was compromised.

• Contain and preserve evidence. Take reasonable steps to stop ongoing unauthorized access or disclosure, preserve relevant records and system logs, and record when the incident was discovered and by whom.
• Identify the information and people involved. Determine what PHI may have been exposed, whose information was involved, and whether the information was secured in a manner recognized by HHS guidance.
• Perform and record the HIPAA breach risk assessment. Consider the nature and extent of the PHI, the unauthorized recipient or user, whether the PHI was actually acquired or viewed, and how much the risk has been mitigated.
• Take mitigation steps. For example, seek return or secure deletion of misdirected information where appropriate, address compromised credentials, and reduce the risk of further exposure.
• Make and document the decision. Record the evidence, the assessment of each relevant factor, the conclusion about notification, and the reasons for it. If notification is required, document whom you notified and when.
• Coordinate with the business associate. Follow the agreement’s reporting process and gather the information needed to assess the incident and meet any notification duties.

The covered entity or business associate has the burden of demonstrating that required notifications were made or that notification was not required. HHS’s Breach Notification Rule guidance explains the presumption of breach, risk-assessment factors, documentation, and notification obligations. The HHS ransomware guidance also explains how a security incident involving ePHI may require breach analysis. These steps support compliance with the HITECH breach notification requirements incorporated into the HIPAA rules.

What notification deadlines apply based on the number of people affected?

For a breach of unsecured PHI, the affected-person count determines certain notice deadlines and recipients. The individual notice deadline remains important regardless of whether the incident affects fewer than 500 people.

• Affected individuals: Notify them without unreasonable delay and no later than 60 calendar days after discovery of the breach. The notice must include required information about the incident, the types of information involved, steps people can take, the hospital’s response, and contact details.
• 500 or more affected individuals: Notify the HHS Secretary without unreasonable delay and no later than 60 calendar days after discovery, contemporaneously with individual notice.
• Fewer than 500 affected individuals: The hospital may report the breach to the HHS Secretary annually, but must do so no later than 60 days after the end of the calendar year in which the breach was discovered. It may report sooner.
• More than 500 residents of a state or jurisdiction: In addition to individual notice, notify prominent media outlets serving that state or jurisdiction without unreasonable delay and no later than 60 calendar days after discovery.
• Business associate incident: The business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The agreement may set a shorter reporting period so the hospital has time to investigate and meet its own obligations.

These are outer limits, not targets for delay: notification must also be made without unreasonable delay. See the HHS explanation of breach notification deadlines. In summary, a reliable checklist connects privacy practices, risk-based safeguards, workforce accountability, vendor agreements, documented incident assessment, and a response calendar that tracks each applicable notice deadline.

FAQs

When is written authorization required to use or disclose patient information?

Written authorization is generally required when a use or disclosure is not otherwise permitted or required by the Privacy Rule. Examples include many marketing uses and most uses or disclosures of psychotherapy notes, subject to specific exceptions. Authorization is generally not required for treatment, payment, or health care operations, although other Privacy Rule conditions may apply. See HHS guidance on authorized uses and disclosures.

How quickly must affected individuals be notified of a HIPAA breach?

For a breach of unsecured PHI, affected individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. The 60-day limit is an outer deadline, not permission to wait when notice can reasonably be provided sooner. See the HHS Breach Notification Rule guidance.

When must a breach affecting fewer than 500 people be reported to the authorities?

The covered entity may report a breach affecting fewer than 500 individuals to the HHS Secretary annually. The report is due no later than 60 days after the end of the calendar year in which the breach was discovered. The entity may report sooner and must still meet the separate deadline for notifying affected individuals. See HHS guidance on reporting breaches to the Secretary.

When is media notification required for a breach?

A covered entity must notify prominent media outlets serving a state or jurisdiction when a breach of unsecured PHI affects more than 500 residents of that state or jurisdiction. The notice must be made without unreasonable delay and no later than 60 calendar days after discovery. See HHS media-notification requirements.