HIPAA Compliance Checklist for Vestibular Rehabilitation Therapy Clinics

Vestibular rehabilitation clinics handle sensitive information through scheduling, clinical documentation, balance and gait assessments, video recordings, billing, and communication with patients and other providers. If your clinic is subject to HIPAA, use this checklist to review how you protect protected health information (PHI) and electronic protected health information (ePHI) across your people, systems, and physical spaces.

HIPAA calls for reasonable and appropriate safeguards based on your organization’s circumstances; this checklist is a practical aid, not a guarantee of compliance. Start with the clinic’s actual workflows and document how your safeguards address the risks you identify.

How should clinics assess and manage ePHI risks?

Conduct an accurate and thorough electronic protected health information risk analysis. Identify where the clinic creates, receives, maintains, or transmits ePHI, then evaluate potential threats and vulnerabilities that could affect its confidentiality, integrity, or availability. HHS explains that the analysis should cover all ePHI, regardless of the electronic medium or where it is stored. See HHS guidance on Security Rule risk analysis.

• Map ePHI flows: List your electronic health record (EHR), scheduling and billing systems, patient portal, email and messaging tools, backup systems, cloud storage, and connected devices. Include tablets used during treatment, phones used for clinic business, and systems that store balance-assessment data or patient videos.
• Inventory devices and locations: Record clinic-owned and approved workforce devices, removable media, network equipment, and any systems used remotely. Note where ePHI is stored, who can access it, and how it moves between systems and people.
• Assess threats and vulnerabilities: Consider risks such as stolen devices, phishing, weak or shared passwords, misdirected messages, unpatched software, unauthorized viewing at reception, accidental recording, and loss of data or system availability.
• Rate and address risks: Document the likelihood and potential impact of each risk, the safeguards already in place, and any additional steps needed. Assign an owner and target date to each action, and record the reason for decisions.
• Review changes: Reassess when the clinic adopts new technology, changes vendors or workflows, experiences a security incident, or identifies a new threat. The Security Rule requires regular reevaluation, but it does not set one universal annual interval for every clinic.
• Plan for continuity: Establish procedures for backing up ePHI, restoring it, and continuing essential clinic operations during an emergency or system outage.

A risk analysis is not the same as risk management. The analysis identifies risks; risk management means selecting and implementing safeguards to reduce them to a reasonable and appropriate level. HHS describes both as part of the ongoing security management process in its risk analysis and risk management guidance.

How can clinics assign responsibilities, train staff, and document evaluations?

The HIPAA Security Rule administrative safeguards include assigning security responsibility, managing workforce access, training staff, responding to incidents, and periodically evaluating security measures. For a small clinic, one person may coordinate these responsibilities, but leadership should clearly authorize the role and ensure the person has the time and support to carry it out. Review the HHS Security Rule summary for the relevant standards.

• Name accountable leads: Designate a security official to develop and implement Security Rule policies and procedures. Assign a privacy contact or another responsible person to handle privacy questions, patient requests, and complaints.
• Define responsibilities: Specify who approves access, manages devices and accounts, reviews security alerts, handles vendor relationships, responds to incidents, and processes patient record requests.
• Train the workforce: Train employees and other workforce members on the clinic’s applicable privacy and security policies, including how to recognize and report suspected phishing, misplaced devices, misdirected records, and inappropriate access. Provide training appropriate to each person’s job duties and update it when policies or risks change.
• Document training: Keep records of training dates, topics, attendance, and any follow-up. A training completion certificate documents an individual’s participation; it does not establish that the clinic as an organization is HIPAA compliant. Follow employer-specific policy and applicable requirements rather than treating annual certificate renewal as a universal federal requirement.
• Evaluate safeguards: Periodically evaluate whether technical and non-technical measures remain effective, including after significant changes. Record findings, corrective actions, responsible staff, and completion dates.
• Apply written policies consistently: Maintain current policies and procedures, communicate revisions, and document required actions such as access decisions, incident outcomes, and sanctions when applicable.

What physical safeguards protect clinic devices, workstations, and media?

The HIPAA Security Rule physical safeguards protect the facilities and equipment that hold or access ePHI. They apply to electronic information systems whether they are located at the clinic or elsewhere. Choose measures that fit your layout, equipment, and risk assessment; HHS describes these requirements in its physical safeguards guidance.

• Control facility access: Decide how staff, patients, vendors, and visitors enter areas where records or systems are kept. Secure rooms or cabinets containing servers, backup media, or paper records, and use visitor procedures appropriate to your premises.
• Protect treatment-area devices: Position monitors and tablets so patients or passersby cannot casually view another patient’s information. Use screen locks, keep devices under staff control, and avoid leaving logged-in workstations unattended during treatment sessions.
• Manage device movement: Track the issue, return, maintenance, and disposal of laptops, tablets, phones, and removable media that may contain ePHI. Establish procedures for taking devices off-site and for reporting loss or theft.
• Safeguard recordings and assessments: Store patient videos and digital balance or gait assessment files only in approved systems. Limit access, avoid retaining unnecessary copies on camera equipment or personal devices, and follow clinic policy for recording, transfer, and deletion.
• Dispose of media securely: Before reusing or disposing of computers, drives, memory cards, or other media, ensure ePHI is removed or the media is securely destroyed using a process appropriate to the device and risk.
• Plan for emergencies: Protect equipment from foreseeable physical hazards and establish how staff will maintain or restore access to essential information during an emergency.

Which technical safeguards control access and monitor ePHI activity?

The HIPAA Security Rule technical safeguards address access to electronic systems, recording and reviewing activity, preserving data integrity, authentication, and transmission security. Apply them to the EHR and to other systems that contain or use ePHI. See the HHS Security Rule overview for these standards.

• Use individual accounts: Assign unique user IDs rather than shared logins so the clinic can connect system activity to individual users. Remove or disable access promptly when someone leaves or changes roles.
• Limit access by role: Give each workforce member access appropriate to their job duties. Review permissions when responsibilities change and periodically confirm that access remains necessary.
• Authenticate users: Use appropriate person-or-entity authentication and establish password and account-protection practices. Consider stronger authentication for remote access and systems holding sensitive data based on your risk analysis.
• Review system activity: Enable and periodically review available audit logs and alerts for unusual access, repeated failed logins, bulk exports, or activity outside expected patterns. Document how suspected issues are escalated.
• Protect data integrity: Use safeguards that help prevent or detect improper alteration or destruction of ePHI, and maintain backup and recovery procedures suited to the clinic’s systems.
• Secure transmissions: Use approved secure methods when sending ePHI, such as appropriate portal or encrypted communication tools. Verify recipients before sending records and avoid placing patient information in unapproved messaging or storage services.
• Make risk-based encryption decisions: Consider encryption for stored devices and transmitted ePHI as part of the risk analysis. Document the clinic’s decision and any alternative measures where appropriate; do not assume that a vendor’s security claim alone resolves the clinic’s responsibilities.

The Privacy Rule’s HIPAA minimum necessary standard generally requires reasonable efforts to limit uses, disclosures, and requests for PHI to what is needed for the purpose. Establish role-based access for workforce members. The standard does not apply to disclosures to or requests by a health care provider for treatment purposes, among other exceptions. See HHS guidance on the minimum necessary requirement.

How should clinics manage business associates and business associate agreements?

Review vendors and service providers that create, receive, maintain, or transmit PHI on the clinic’s behalf. When a vendor meets HIPAA’s definition of a business associate, the clinic generally needs a written business associate agreement (BAA) before allowing the vendor to handle PHI. Examples may include an EHR provider, billing service, cloud storage provider, or IT contractor whose work involves access to ePHI. HHS explains the definition and examples in its business associate guidance.

• Assess the relationship: Determine whether the vendor performs services for the clinic involving PHI, rather than relying only on a vendor’s marketing language or general security assurances.
• Sign a BAA before access: The agreement should define permitted and required uses and disclosures, require appropriate safeguards, address incident and breach reporting, and set terms for return or destruction of PHI when the relationship ends, as applicable.
• Address subcontractors: Confirm the agreement requires the business associate to obtain appropriate assurances from subcontractors that will handle PHI.
• Set practical reporting terms: Specify how and how quickly the vendor must report suspected security incidents and breaches so the clinic has time to investigate and meet any applicable duties. The contract may set a shorter reporting period than HIPAA’s outer limit.
• Keep an inventory: Maintain a list of vendors with potential PHI access, executed BAAs, service scopes, renewal or termination dates, and any follow-up needed.
• Review access and offboarding: Limit vendor access to what is appropriate, remove it when no longer needed, and ensure PHI is returned or destroyed according to the agreement and applicable requirements.

A contract alone does not eliminate the clinic’s responsibilities. HHS notes that a cloud provider maintaining ePHI on a clinic’s behalf may be a business associate even when the data is encrypted and the provider lacks the decryption key. See HHS guidance on HIPAA and cloud computing.

What steps should clinics take after a suspected breach?

Use a written response process for suspected or known security incidents. A misplaced tablet, misdirected patient email, unauthorized chart access, or vendor alert may require prompt investigation. Do not assume every incident is a reportable breach; assess the facts, contain the issue, and document the reasoning and actions taken.

1. Report and contain: Direct staff to report suspected incidents immediately to the designated contact. Take reasonable steps to stop ongoing exposure, such as disabling a compromised account or recovering a device, while preserving relevant evidence.
2. Investigate and document: Record when the incident was discovered, what happened, which systems and individuals may be involved, what PHI was affected, and what containment or mitigation steps were taken.
3. Assess whether it is a breach: An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an exception applies or a documented assessment shows a low probability that the PHI was compromised. The assessment considers the nature and extent of the PHI, who received or used it, whether it was actually acquired or viewed, and the extent of mitigation. See the HHS Breach Notification Rule guidance.
4. Coordinate with business associates: If a vendor is involved, obtain the facts and affected-person information promptly under the BAA. A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery, though the agreement may require faster reporting.
5. Make required notifications: If a breach of unsecured PHI is reportable, notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting 500 or more individuals require notice to HHS within that period; breaches affecting fewer than 500 individuals may be reported to HHS annually, no later than 60 days after the end of the calendar year in which they were discovered. Media notice may also be required for breaches affecting more than 500 residents of a state or jurisdiction.
6. Correct and follow up: Address the cause, update safeguards or training as needed, and preserve the investigation and notification records.

The clinic’s written breach procedures should specify who makes the assessment, who approves notifications, how vendor incidents are escalated, and how decisions are recorded. The HIPAA breach assessment and notification process should be followed without unreasonable delay; the 60-day deadline is an outer limit for individual notification, not a reason to postpone action.

How should clinics handle patient privacy practices, access requests, and complaints?

Maintain clear procedures for communicating privacy practices and responding to individuals. Most covered health care providers must develop and provide a Notice of Privacy Practices explaining how PHI may be used or disclosed, individuals’ rights, and how to raise a complaint. See HHS guidance on Notices of Privacy Practices.

• Provide and maintain the notice: Make the clinic’s current notice available as required and train staff to direct patient questions to the appropriate contact. Use procedures that fit the clinic’s intake and service workflows.
• Route access requests: Give staff a clear process to receive, date, verify, and forward requests for records. Track the requested record set, the response deadline, any needed vendor coordination, and the date and method of fulfillment.
• Meet the access timeline: A covered entity generally must act on an access request within 30 calendar days. It may take one additional 30-day extension if it provides the individual a written explanation and the expected completion date within the initial period. See HHS guidance on access request timelines.
• Provide the requested format when feasible: Provide access in the requested form and format if readily producible, or agree on a readable alternative. If the patient directs the clinic in writing to send a copy to another person, follow the applicable requirements for a properly identified recipient.
• Handle complaints without retaliation: Establish a way for individuals to submit privacy complaints, document each complaint and its disposition, and communicate the process described in the clinic’s notice. HHS provides details on complaint procedures under the Privacy Rule.
• Protect privacy during care: Limit conversations and displays that could expose another patient’s information in the waiting room or treatment area. Use practical safeguards for check-in, patient flow, and vestibular assessments while allowing appropriate communication for care.

In summary, an effective clinic checklist connects documented risk analysis with administrative, physical, and technical safeguards; assigns clear ownership; manages vendors through appropriate agreements; and gives staff reliable procedures for incidents and patient rights. Revisit these practices as your clinic, technology, and risks change.

FAQs

How often should a vestibular rehabilitation clinic reassess ePHI risks?

HIPAA requires regular reevaluation but does not prescribe one universal annual interval for every clinic. Reassess when meaningful changes occur, such as adopting a new system, changing vendors or workflows, or responding to a security incident, and establish a recurring review schedule that fits your clinic’s risks. Document the analysis, findings, and actions taken. See HHS risk analysis guidance.

When does a clinic need a business associate agreement?

A clinic generally needs a written BAA when a vendor or other service provider meets HIPAA’s definition of a business associate by creating, receiving, maintaining, or transmitting PHI on the clinic’s behalf. Common examples can include an EHR or cloud provider, billing service, or IT contractor whose work involves access to ePHI. Assess the actual services and relationship; not every vendor needs a BAA. See HHS business associate guidance.

How soon must patients be notified of a reportable breach?

For a reportable breach of unsecured PHI, affected individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. Additional HHS or media notification duties may apply depending on the number and location of affected individuals. See the HHS Breach Notification Rule guidance.

What processes should clinics have for patient record access requests?

Set a documented process to receive and date requests, verify the requester’s authority, identify the records sought, track deadlines, coordinate with any business associate holding records, and provide access in a permitted format. A covered entity generally must act within 30 calendar days; one additional 30-day extension is permitted if the required written notice is provided within the initial period. See HHS access request timing guidance.