HIPAA Compliance Checklist for Stuttering and Fluency Disorders Clinics

A practical HIPAA checklist helps your clinic protect protected health information (PHI) across speech-language pathology records, therapy sessions, billing, and telepractice. HIPAA applies to health care providers that conduct certain standard electronic transactions, such as electronic claims, and to business associates handling PHI for covered entities; using email alone does not make a clinic a covered entity. Check your clinic’s status and obligations rather than assuming that every practice has the same HIPAA requirements. HHS guidance on covered entities and business associates

How should a clinic assess risks to protected health information?

If your clinic is subject to the HIPAA Security Rule, conduct and document a HIPAA Security Risk Analysis covering the electronic PHI (ePHI) your clinic creates, receives, maintains, or transmits. This includes records in your practice-management and clinical systems, billing platforms, staff devices, backups, and telepractice tools. A risk analysis should identify where ePHI is handled, likely threats and vulnerabilities, existing protections, and the potential impact if information is exposed, changed, lost, or unavailable. HHS Guidance on Risk Analysis

• Map how intake forms, assessments, therapy notes, appointment information, recordings, billing data, and referrals move through your clinic.
• Consider clinic-specific risks, such as a session being overheard, a therapy video being recorded or stored, a shared workstation being left open, or a report being sent to the wrong recipient.
• Document identified risks and decide which reasonable and appropriate safeguards will reduce them, who is responsible, and how the clinic will check that the safeguards work.
• Review the analysis when operations, systems, vendors, or identified risks change; HIPAA requires an ongoing security process, not a one-time assessment.

The Security Rule does not prescribe one risk-analysis method for every clinic. The scope should account for all ePHI, including information handled by vendors on the clinic’s behalf. HHS explanation of risk analysis and risk management

Which privacy policies and patient notices are required?

A covered clinic must maintain policies and procedures that address how it uses and discloses PHI, safeguards it, handles patient rights, and responds to privacy concerns. Designate the officials and contacts required for your organization’s role under HIPAA, including a privacy official and a contact for privacy complaints. Policies should reflect the clinic’s actual workflows, including how staff handle parents’ or guardians’ requests, communications with referring providers, and telepractice.

A covered health care provider with a direct treatment relationship must provide a Notice of Privacy Practices (NPP) by the first service delivery and make a good-faith effort to obtain written acknowledgment of receipt. If the clinic maintains a physical service site, it must post the notice prominently and make it available there; a provider website that describes services must also prominently post the notice. Document an unsuccessful effort to obtain acknowledgment. The notice explains permitted uses and disclosures, patient rights, and how to raise a complaint. HHS Notice of Privacy Practices guidance

• Keep the NPP consistent with your clinic’s current privacy practices and applicable state law.
• Explain how patients can request access to or amendment of their records, request confidential communications, and submit a complaint.
• Keep the NPP distinct from an authorization: the notice does not replace written authorization when HIPAA requires one for a particular use or disclosure. HHS guidance on authorizations and privacy notices

What workforce training should speech-language pathology staff complete?

Train workforce members on the clinic’s privacy policies and procedures as needed for their roles. New workforce members must receive training within a reasonable period after joining, and staff whose duties are affected by a material policy change must receive training within a reasonable period after that change takes effect. The Privacy Rule requires documentation of training. It does not establish a universal annual training or certificate-renewal requirement for every employee. HIPAA Administrative Simplification Regulation Text

Tailor instruction to the work staff actually perform. SLPs and assistants may need guidance on session notes, recordings, telepractice, and sharing information with caregivers or other providers. Front-desk and billing staff may need practice verifying identities, handling intake forms, and avoiding disclosures in waiting areas or routine messages.

• Teach staff how to report a suspected misdirected message, lost device, unauthorized record access, or unintended session recording.
• Provide security awareness instruction appropriate to the clinic’s systems and risks, and keep records of training dates, topics, and participants.
• Update training when responsibilities, technology, or clinic policies change. HIPAA’s training requirements are tied to staff roles and relevant changes, not to a single mandatory annual schedule.

How can clinics safeguard records during in-person care and telepractice?

Apply safeguards to PHI in every form. During in-person care, keep paper files and screens away from public view, secure records when not in use, limit access to authorized staff, and avoid discussing a patient’s treatment where others can overhear. For electronic records, use individual accounts, lock unattended workstations, and protect devices and stored files according to the clinic’s risk assessment.

For telepractice, use technology and workflows that protect the information the clinic handles. Hold sessions in private locations when feasible, confirm the patient’s identity and who else is present, and avoid recording unless needed for care and handled under the clinic’s policies. Tell patients how to reduce the chance that others will overhear or see the session. HHS describes privacy, security, and access-control safeguards for telehealth in its telehealth privacy and security guidance.

HIPAA does not categorically prohibit email. However, clinics must use reasonable safeguards for communications and meet Security Rule requirements for ePHI in transit. Assess the communication method and document appropriate protections; when using email, verify the address and consider limiting the information in an unencrypted message. HHS guidance on email communications with patients and HHS guidance on email and the Security Rule

Fax may be used when appropriate, but take reasonable precautions to prevent misdirection or unauthorized access. Confirm unfamiliar fax numbers with the intended recipient, use a secure fax location, and retrieve incoming documents promptly. HHS guidance on faxing patient information

When do vendors need business associate agreements?

A vendor generally needs a business associate agreement (BAA) when it creates, receives, maintains, or transmits PHI on behalf of a covered clinic, unless a HIPAA exception applies. Potential business associates may include telepractice platforms, cloud storage providers, billing services, and contractors who handle PHI for the clinic. Assess what each vendor does with PHI rather than relying only on product labels or marketing claims.

The written agreement must define permitted uses and disclosures, require appropriate safeguards, address reporting of impermissible uses or breaches, and cover other required terms. A vendor that stores ePHI may be a business associate even if the data is encrypted and the vendor cannot read it. HHS sample business associate agreement provisions and HHS guidance on cloud services and the conduit exception

The conduit exception is narrow: it generally applies to a service that only transmits PHI, with any storage temporary and incidental to transmission. A vendor’s BAA does not by itself make the clinic compliant; the clinic remains responsible for its own HIPAA obligations. HHS telehealth guidance explains that covered providers must use vendors that comply with HIPAA and enter into BAAs when required for the vendor’s services. HHS guidance on HIPAA and telehealth technology

How should clinics manage access, audit logs, and breach response?

Set permissions so workforce members can access ePHI appropriate to their roles and duties. Role-based access control can help operationalize this approach. Use unique user IDs rather than shared logins, promptly change or remove access when a worker’s role changes or employment ends, and maintain procedures for authorized emergency access.

The Security Rule requires audit controls: mechanisms to record and examine activity in systems that contain or use ePHI. Establish a process for reviewing relevant activity and following up on access that appears inappropriate. HIPAA requires the controls, but does not prescribe one universal review schedule for every clinic. HHS Summary of the HIPAA Security Rule

Maintain a written incident and breach-response process. Staff should promptly report suspected incidents so the clinic can contain the issue, preserve relevant records, determine what information was involved, and assess whether the event is a reportable breach. For a breach of unsecured PHI, the clinic must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Other reporting duties may apply, including notice to HHS and, for certain larger breaches, the media. HHS Breach Notification Rule guidance

What clinical documentation should clinics retain?

Maintain complete, accurate speech-language pathology records consistent with applicable state law, professional requirements, payer rules, and clinic policy. Depending on the services provided, the record may include intake and consent documentation, assessments, treatment plans and goals, progress notes, attendance, referrals, discharge information, relevant communications, and billing records. Store records securely and establish procedures for access, correction, transfer, retention, and secure disposal.

HIPAA does not set a general retention period for medical records; state law generally governs how long those records must be kept. Separately, HIPAA requires covered entities to retain required HIPAA documentation—such as policies and procedures—for six years from its creation or the date it was last in effect, whichever is later. Do not treat that documentation period as a universal medical-record retention period. HHS guidance on medical-record retention and HHS HIPAA audit protocol

As a final check, connect the clinic’s risk analysis to its policies, staff training, vendor agreements, access controls, incident response, and recordkeeping. Review those safeguards when the clinic’s systems or services change, and retain clinical records according to the rules that apply in your state.

FAQs.

Does HIPAA apply to stuttering and fluency disorders clinics?

It can. A clinic is generally a covered health care provider if it conducts certain standard electronic transactions, such as electronic claims, itself or through a billing service on its behalf. HIPAA may also apply to a business associate that handles PHI for a covered entity. The type of therapy provided does not by itself determine whether the clinic is covered. HHS guidance on covered entities

When must a clinic have a business associate agreement with a telepractice vendor?

When the vendor creates, receives, maintains, or transmits PHI on the clinic’s behalf and is a business associate, the clinic generally must have a written BAA in place. A limited exception may apply to a service that only transmits PHI and has no more than temporary storage incidental to transmission. Assess the vendor’s actual services before sharing PHI. HHS guidance on the conduit exception

How soon must a clinic notify affected individuals after discovering a reportable breach?

Without unreasonable delay and no later than 60 calendar days after discovering the breach. Additional reporting requirements may apply depending on how many individuals are affected. HHS Breach Notification Rule guidance

What HIPAA safeguards apply to patient information sent by email or fax?

Use reasonable safeguards to prevent misdirected or unauthorized disclosure. For email, check recipient addresses and assess protections for ePHI in transit; HIPAA does not categorically prohibit email. For fax, verify unfamiliar numbers and use a location where unauthorized people cannot access incoming or outgoing documents. HHS email guidance and HHS fax guidance