HIPAA Compliance for Mammography Programs: Meeting MQSA Archiving Rules for Digital Breast Tomosynthesis

Running a mammography program today means proving that you protect patient privacy and preserve image quality over time. This guide shows you how to meet the Health Insurance Portability and Accountability Act and the Mammography Quality Standards Act while building a future‑ready strategy for Digital Breast Tomosynthesis archiving and multimodality data retention.

HIPAA Privacy and Security Requirements

Privacy Rule essentials for mammography

• Apply the minimum necessary standard when using or disclosing protected health information (PHI), including images, reports, and scheduling data.
• Issue and maintain a current Notice of Privacy Practices; obtain patient authorizations for non‑treatment, non‑payment, and non‑operations uses.
• Honor patient rights: access, amendment, accounting of disclosures, and restrictions where applicable.

Security Rule safeguards and Electronic Health Record safeguards

• Perform a documented risk analysis that spans EHR, PACS/VNA, DBT workstations, modalities, and remote access paths.
• Administrative safeguards: role‑based access, workforce training, sanctions, contingency planning (backup, disaster recovery, emergency mode operations), and vendor oversight.
• Physical safeguards: controlled facility access, device/media controls, secure decommissioning, and protected equipment rooms.
• Technical safeguards: unique user IDs, multi‑factor authentication for remote/privileged access, encryption in transit and at rest, automatic logoff, integrity controls, and robust audit logging.
• Harden endpoints and viewers used for DBT with timely patching, allow‑listing, and endpoint detection and response to prevent unauthorized exfiltration of mammography data.

Business associate management

• Execute Business Associate Agreements with cloud archive, teleradiology, AI, and service vendors; define permitted uses, breach duties, and return/destruction of PHI.
• Validate vendors’ DICOM handling, key management, and data location; require immutability options for long‑term archiving.

Breach readiness and documentation

• Maintain incident response procedures for DBT/PACS/EHR events, including risk assessment, timely notifications, and corrective actions.
• Retain HIPAA policies, risk analyses, and training records for at least six years to demonstrate ongoing compliance.

MQSA Record Retention Standards

Under the Mammography Quality Standards Act, you must retain mammography images and reports for at least five years, or for at least ten years if no further mammograms are performed at your facility for that patient. If state law sets a longer period, follow the longer requirement. These timeframes apply equally to film, full‑field digital mammography (FFDM), and Digital Breast Tomosynthesis.

What must be retained and retrievable

• All clinical mammography images and final interpretive reports, including DBT studies and any associated synthetic 2D or CAD outputs.
• Records must be readily retrievable for comparison, transfer, and patient/provider requests without compromising image quality.
• Keep documented processes for prompt release and documented transfer logs to ensure chain‑of‑custody and completeness.

Practical retention model

• Adopt a lifecycle that keeps recent priors online for fast comparison and moves older studies to nearline or cold storage while honoring MQSA retention windows.
• Align mammographic modality data retention across FFDM and DBT so your prior‑fetch rules always surface the most relevant comparisons.

Digital Breast Tomosynthesis Image Archiving

What to archive for DBT

• Projection data (raw acquisitions) when available, reconstructed tomosynthesis slice stacks, and synthetic 2D images used for interpretation.
• Presentation states, annotations/CAD marks, radiation dose information, and DICOM Structured Reports needed for full clinical context.

How to archive for durability and fidelity

• Use a DICOM‑conformant PACS/Vendor Neutral Archive that preserves DBT geometry and metadata to ensure faithful reconstruction and viewing.
• Enable immutability (e.g., WORM/object lock), end‑to‑end checksums, and periodic fixity checks to prevent silent corruption.
• Encrypt at rest and in transit; separate encryption keys from stored data; practice key rotation and documented access approvals.
• Apply a 3‑2‑1 backup strategy with routine test restores and defined recovery time (RTO) and recovery point (RPO) objectives that reflect clinical urgency.

Performance and accessibility

• Size storage and bandwidth for multi‑frame DBT retrieval; prefetch priors based on worklist, patient, and modality to keep reading rooms efficient.
• Validate long‑term viewer compatibility so DBT studies remain reviewable years later, even after software or OS upgrades.

Privacy‑preserving secondary use

• When using DBT data for teaching, QA, or research, apply HIPAA de‑identification (expert determination or safe harbor) and maintain approval records.

Integration of DBT and FFDM Accreditation

Scope and alignment

• Ensure your accreditation explicitly lists each mammographic modality and unit—FFDM and DBT—so certificates match your operational footprint.
• Standardize acquisition protocols, positioning, and exposure techniques across units to support consistent image quality and dose.

Submission and ongoing compliance

• Maintain required test images/phantom results, QC logs, and medical physicist survey reports; keep them inspection‑ready.
• Update accreditation promptly when adding or upgrading DBT capabilities; capture change control, acceptance testing, and staff training artifacts.

Enterprise considerations

• For multi‑site programs, harmonize naming conventions, DICOM tags, and prior‑fetch rules so DBT and FFDM priors flow seamlessly between sites.
• Use centralized dashboards to track Mammography Accreditation Requirements, expirations, and corrective action items.

Personnel Training for Digital Mammography

Technologists

• Complete at least eight hours of modality‑specific education in Digital Breast Tomosynthesis before performing DBT independently.
• Maintain continuing experience (e.g., a minimum of 200 mammography examinations in 24 months) and continuing education (e.g., 15 CEUs in mammography within 36 months); DBT‑focused CEUs strengthen modality competence.
• Document device‑specific training after software/hardware upgrades, including positioning, compression technique, and dose optimization.

Interpreting physicians

• Obtain modality‑specific DBT training (commonly eight hours) before independent interpretation.
• Maintain continuing experience (e.g., 960 mammogram interpretations in 24 months) and CME focused on mammography within 36 months.
• Track performance metrics (recall, PPV) to inform targeted education and peer learning.

Medical physicists

• Hold documented training and experience with DBT systems; perform acceptance testing after install/upgrades and conduct annual surveys covering DBT performance.

Documentation you should keep

• Licenses/certifications, initial modality training (including the eight‑hour DBT training), continuing education, continuing experience logs, and competency attestations.
• Mammography Personnel Training Documentation should be consolidated, current, and quickly retrievable for inspections and audits.

Quality Assurance and Equipment Compliance

Daily, weekly, and monthly QC

• Follow vendor and physicist‑approved QC schedules: detector calibrations, phantom imaging, AEC checks, compression force verification, artifact evaluation, and dose tracking.
• Trend QC results to catch drift early; document corrective actions with dates, root cause, and verification of effectiveness.

Annual and event‑driven testing

• Complete annual medical physicist surveys that include DBT‑specific tests (geometric accuracy, slice sensitivity profile, uniformity, and spatial resolution).
• Repeat acceptance/constancy tests after software patches, detector replacements, or major service events; keep service reports with test results.

Operational reliability and cybersecurity

• Define uptime targets for acquisition and viewing systems; simulate failover and image restore scenarios at least annually.
• Control vendor remote access with time‑bound authorizations, MFA, logging, and screen recording where feasible.

Recordkeeping for Mammography Personnel

Core records to maintain

• Qualifications for interpreting physicians, technologists, and medical physicists: licenses, certifications, initial and ongoing training, and experience logs.
• DBT‑specific onboarding checklists, supervised case logs (where applicable), and competency reassessments after upgrades.

Retention and accessibility

• Keep records for the duration of employment and consistent with MQSA inspection cycles and state requirements; many programs retain at least six years to align with HIPAA documentation practices.
• Store in an access‑controlled repository with versioning; ensure rapid retrieval during accreditation renewals or inspections.

Internal audits and readiness

• Audit personnel files and modality rosters at least annually; reconcile against schedules, modality lists, and accreditation scope.
• Maintain a readiness binder (digital or physical) that maps each staff member to required credentials and current DBT authorizations.

Summary

Integrate HIPAA safeguards across your EHR and imaging stack, meet MQSA’s five‑ and ten‑year retention rules, and archive DBT comprehensively with secure, immutable, and test‑restored storage. Keep accreditation synchronized with your active FFDM and DBT units, and maintain rigorous training, QC, and recordkeeping so you can prove compliance any day an inspector walks in.

FAQs

What are the key HIPAA requirements for mammography data?

Conduct a risk analysis covering EHR, PACS/VNA, DBT workstations, and networks; implement administrative, physical, and technical safeguards; encrypt data in transit and at rest; enforce role‑based access and MFA; log and review activity; manage vendors with Business Associate Agreements; and retain HIPAA policies and training records for at least six years.

How long must MQSA mammography records be retained?

Retain mammography images and interpretive reports for at least five years, or for at least ten years if no subsequent mammograms are performed at your facility for that patient. If state law requires a longer period, follow the longer timeframe. The rule applies to film, FFDM, and Digital Breast Tomosynthesis.

How should digital breast tomosynthesis images be archived?

Archive projection data (when available), reconstructed slice stacks, synthetic 2D, presentation states, CAD/annotations, and dose information in a DICOM‑conformant system. Use immutable storage with end‑to‑end checksums, strong encryption, 3‑2‑1 backups, and routine test restores. Ensure viewer compatibility and fast retrieval so priors are always available for comparison.

What training is required for DBT technologists?

Before performing DBT independently, technologists should complete at least eight hours of modality‑specific DBT education. They must also maintain continuing experience (e.g., a minimum of 200 mammography exams in 24 months) and continuing education (e.g., 15 CEUs in mammography within 36 months), documenting all training and updates after system upgrades.