HIPAA Compliance Checklist for University Disability Services Offices

Use this checklist to determine which privacy rules apply to your office’s records and, when HIPAA applies, to organize responsibilities, safeguards, vendor review, and incident response. A checklist alone does not establish that an office or university is compliant; confirm decisions with your institution’s privacy, security, and legal officials.

Determine whether the office is a HIPAA-covered component

Start by asking whether the university, or an entity that includes the office, meets HIPAA’s definition of a covered entity. For a health care provider, that generally depends on whether it provides health care and conducts specified electronic transactions covered by HIPAA. A disability services office does not become a HIPAA-covered component just because it collects disability-related or medical documentation.

If the university is a covered entity, determine whether it has formally designated a HIPAA hybrid entity. A hybrid entity identifies its health care component or components in writing; HIPAA then applies to those designated components and to the relevant PHI they handle. Confirm whether the office is included in the university’s designation, rather than inferring its status from the type of documents it receives. See HHS guidance on postsecondary institutions and hybrid entities.

• Ask the university’s HIPAA privacy official whether the institution is a covered entity and whether it has adopted hybrid entity status.
• Request the written designation of the university’s covered health care component or components and confirm whether the office’s work is included.
• Identify any health care services the office itself provides, and determine whether those activities are part of a covered provider’s operations.
• Document the decision and its rationale, including who approved it and when it should be reviewed.

University records may fall under different legal frameworks depending on what they are, who maintains them, and how they are used. Make the determination record by record and in coordination with the offices responsible for FERPA and HIPAA.

Distinguish FERPA education records from HIPAA-protected health information

Many records held by a university disability services office—such as accommodation requests, documentation used to determine academic adjustments, and related university records—are likely to be education records governed by FERPA when they are directly related to a student and maintained by the university or someone acting for it. Student education records and qualifying FERPA treatment records are excluded from HIPAA’s definition of protected health information (PHI), even when the university also operates as a HIPAA covered entity. See HHS guidance on FERPA and HIPAA for student records and the Departments of Education and Health and Human Services joint guidance.

Do not assume, however, that every health-related record held by a university is governed by FERPA. A designated health care component may handle HIPAA-protected PHI, such as identifiable health information about nonstudent patients. The rules can also differ across parts of the same institution, so consider the record’s source, purpose, custodian, and use.

FERPA treatment records have a specific definition: they must be made or maintained by a qualifying professional, concern an eligible student, and be used only in connection with treatment. If a school discloses such records for a non-treatment purpose, they may become education records subject to FERPA’s requirements. Do not treat an accommodation file as a FERPA treatment record solely because it contains medical documentation.

• Map the office’s record types, systems, and record-sharing workflows.
• For each type, document the applicable rule, responsible custodian, access process, and approved disclosures.
• Coordinate FERPA and HIPAA procedures where the university handles both education records and HIPAA-protected PHI.
• When information is governed by FERPA, apply FERPA’s consent and disclosure rules; do not label it HIPAA PHI simply because it is sensitive health information.

Assign HIPAA privacy and security responsibilities

If the office handles PHI as part of a covered entity or designated covered health care component, establish clear lines of responsibility. The university should identify the officials responsible for HIPAA privacy and security, explain how the office works with them, and name an operational contact for staff who need guidance or need to report a concern.

Document who is responsible for reviewing access requests, approving disclosures, maintaining procedures, coordinating risk assessments, responding to suspected incidents, and communicating with central compliance and information security teams. HIPAA’s Security Rule requires a regulated entity to designate a security official responsible for developing and implementing required security policies and procedures. See HHS’s summary of the HIPAA Security Rule.

• Identify the university HIPAA privacy official and security official, and provide staff with their contact and escalation information.
• Assign office-level responsibilities for day-to-day handling of PHI, if applicable.
• Define how the office escalates uncertainty about record classification, access, disclosures, or incidents.
• Review responsibility assignments when staff, systems, services, or the university’s hybrid entity designation change.

Train staff and document confidentiality obligations

When HIPAA applies, train workforce members on the privacy policies and procedures they need to perform their duties. Training should reflect the person’s role and the information and systems they may access. The Security Rule also requires security awareness and training for workforce members. See HHS’s summary of the HIPAA Privacy Rule and HHS’s summary of the Security Rule.

Document the training provided, completion dates, covered policies, and any follow-up. Include practical instruction on verifying identity and authority, handling records in conversations and email, preventing misdirected disclosures, safeguarding devices, and reporting suspected incidents. Make sure staff understand university-specific confidentiality rules for FERPA education records as well as any HIPAA procedures relevant to their work.

HIPAA does not establish a universal annual certificate-renewal requirement for all staff. Follow the institution’s policies and provide training appropriate to job duties, policy changes, and identified risks. A training completion certificate documents training; it does not certify that the office or university is HIPAA-compliant.

• Train new personnel before or as they begin duties involving protected records.
• Provide updates when procedures, systems, responsibilities, or risks change.
• Keep training records and written confidentiality acknowledgments in accordance with institutional policy.
• Explain how staff can ask questions and report a possible privacy or security incident promptly.

Apply minimum necessary access and administrative, technical, and physical safeguards

For uses and disclosures to which the HIPAA Privacy Rule’s minimum necessary standard applies, take reasonable steps to limit PHI to what is needed for the intended purpose. Define which roles need access, which information each role needs, and the circumstances in which access is permitted. The standard has exceptions, including disclosures for treatment, so consult the university’s privacy official about the rules for a particular use or disclosure. See HHS guidance on the minimum necessary requirement.

When the Security Rule applies to electronic PHI, safeguards must be appropriate to protect its confidentiality, integrity, and availability. The Rule organizes safeguards into administrative, physical, and technical categories. Covered entities must conduct a risk analysis and use the results to manage identified risks; specific measures should be selected based on the university’s circumstances and applicable requirements. See HHS’s overview of the HIPAA Security Rule and its summary of required safeguards.

• Administrative: Maintain written procedures for authorizing access, onboarding and offboarding personnel, reviewing system activity, managing risks, responding to incidents, and training staff.
• Technical: Use role-appropriate account permissions and other security measures selected through the university’s risk analysis. Review access when an employee’s role changes and remove it when it is no longer needed.
• Physical: Protect rooms, workstations, devices, and media from unauthorized access. Use secure storage and disposal practices for records in any form, as applicable.
• Ongoing review: Reassess access and safeguards when the office changes its workflows, systems, vendors, or ways of storing or sharing information.

Review vendor access and business associate agreements

Before a vendor receives, creates, maintains, or transmits PHI on behalf of a HIPAA covered entity, determine whether the vendor is acting as a business associate. A business associate agreement (BAA) is generally required when a business associate performs functions or services involving PHI for a covered entity, subject to applicable regulatory exceptions. A vendor is not automatically a business associate merely because it supplies a product or service; consider the vendor’s role and whether it handles PHI on the university’s behalf. See HHS’s business associate guidance.

Route vendor reviews through the university’s privacy, security, procurement, and legal processes. Do not upload or share PHI with a vendor until the institution has determined what protections and agreements are required. A BAA should address permitted uses and disclosures, safeguards, reporting of unauthorized uses or breaches, applicable subcontractors, and what happens to PHI when the arrangement ends. See HHS’s overview of business associate contract provisions.

• List vendors and services that may access or handle PHI, including relevant hosted systems and support services.
• Confirm whether each vendor acts as a business associate or falls within an applicable exception.
• Obtain and approve a BAA when required before allowing access to PHI.
• Coordinate required privacy and security review, and document approved uses and access limits.
• Review the arrangement when the vendor’s services, data access, or contract terms change.

Maintain policies for incident response and breach notification

Maintain a written process that tells staff how to report a suspected loss, misdirected message, unauthorized access, or other possible privacy or security incident. The office should promptly escalate reports to the university officials designated to investigate them. Preserve relevant information, limit further access or disclosure where appropriate, and follow institutional instructions; staff should not make their own final legal determination about whether notification is required.

When a suspected incident involves PHI, the covered entity must assess whether it is a breach under HIPAA’s Breach Notification Rule. An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an exception applies or the covered entity demonstrates a low probability that the PHI was compromised through the required risk assessment. The assessment considers the information involved, who received or used it, whether it was actually acquired or viewed, and how effectively risk was mitigated. See HHS’s Breach Notification Rule guidance.

If notification is required, the applicable covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Other reporting duties may apply depending on the number of affected people and the circumstances. A business associate must notify the covered entity as required by the Rule and its BAA; the university’s designated officials should coordinate any required notices. Keep records of the investigation, risk assessment, mitigation, decisions, and any notifications—or the basis for determining notification was not required.

• Make the internal reporting route easy for staff to find and use.
• Escalate suspected PHI incidents promptly to the university’s privacy and security officials.
• Document what happened, what information may be involved, actions taken, and the outcome of the assessment.
• Coordinate mitigation and any required notices with the responsible university officials and, where relevant, the vendor.
• Use incident reviews to identify and address gaps in procedures, training, access, or safeguards.

In practice, an effective checklist starts with correctly classifying the office’s records and its place in the university’s HIPAA structure. From there, assign clear responsibilities, train staff, limit access, assess vendors, and maintain an incident process that brings suspected issues to the right university officials quickly.

FAQs

Are student disability records covered by HIPAA or FERPA?

Many student disability services records maintained by a university are FERPA education records, not HIPAA-protected PHI. The classification depends on the record, who maintains it, and its purpose. Qualifying FERPA treatment records are also excluded from HIPAA’s definition of PHI. A university may separately handle HIPAA-protected PHI in a designated covered health care component or in other applicable circumstances. See HHS guidance on student records.

Can a university disability services office be a HIPAA-covered component?

It can be included in a university’s designated covered health care component if the university is a HIPAA covered entity and formally designates the relevant component as part of a hybrid entity. But an office does not become a covered component simply because it collects medical documentation. Confirm the university’s covered entity status, written hybrid entity designation, and the office’s specific role with the university’s HIPAA privacy official.

When does a vendor need a business associate agreement?

A BAA is generally needed when a vendor that is not part of the covered entity’s workforce performs a function or service for the covered entity that involves PHI, unless an applicable exception applies. Determine whether the vendor creates, receives, maintains, or transmits PHI on the university’s behalf, and have the university’s privacy and contracting officials review the arrangement before PHI is shared. See HHS business associate guidance.

What steps should the office take after a suspected PHI breach?

Promptly follow the university’s incident-reporting process and notify its designated privacy and security officials. Preserve relevant information, help prevent further unauthorized access or disclosure as directed, and provide the facts needed for the university to investigate and assess the incident. The covered entity’s officials determine whether the event is a reportable breach and coordinate any required notifications under HIPAA’s Breach Notification Rule.