HIPAA Compliance Guide for Acute Care Surgery Services

Acute care surgery can involve fast-moving decisions, multiple care teams, emergency transfers, and sensitive medical records. HIPAA compliance helps protect patients’ protected health information (PHI) while allowing appropriate information sharing for care, payment, and health care operations.

Use this guide as a practical overview, not a substitute for your organization’s policies or legal advice. Requirements depend on each organization’s role, the information involved, and the circumstances of its use or disclosure.

What HIPAA rules apply to acute care surgery services?

HIPAA does not create a separate set of rules specifically for acute care surgery. The Privacy Rule, Security Rule, and Breach Notification Rule apply when an organization is a covered entity or business associate. A health care provider is generally a covered entity if it conducts certain standard transactions electronically, such as electronic billing. Hospitals, surgical practices, and other providers should confirm their status and responsibilities rather than assume every organization has the same role. See HHS guidance on covered entities and business associates.

The Privacy Rule protects PHI in electronic, paper, and oral forms. The Security Rule applies specifically to electronic protected health information (ePHI), requiring appropriate administrative, physical, and technical safeguards. The Breach Notification Rule governs notification after a breach of unsecured PHI. These protections support medical record confidentiality while permitting HIPAA-authorized uses and disclosures. HHS summarizes the HIPAA Security Rule and the HIPAA Privacy Rule.

For surgical services, PHI may include patient identifiers and information about diagnoses, imaging, procedures, medications, consultation, discharge, and payment. Apply your organization’s policies to workforce members, including clinicians, administrative staff, trainees, and others who may encounter patient information.

How can surgical teams use and disclose PHI for treatment, payment, and operations?

HIPAA generally allows covered entities to use or disclose PHI for treatment, payment, and health care operations without obtaining a patient’s authorization. Treatment includes providing, coordinating, or managing care and consulting or referring patients among providers. For example, a surgical team may share relevant records with clinicians involved in a patient’s care or coordinate a transfer with another provider. HHS explains these permitted activities in its guidance on treatment, payment, and health care operations.

The minimum necessary standard generally requires reasonable limits on PHI used, disclosed, or requested for payment and operations. However, it does not apply to disclosures to, or requests by, a health care provider for treatment purposes. This exception does not mean that staff should browse records without a work-related reason: organizations should still use role-based access policies and follow their internal rules. See HHS guidance on the minimum necessary standard.

Payment activities may include billing, claims processing, and determining coverage. Health care operations may include quality assessment, administrative functions, and compliance activities. For disclosures outside these permitted purposes, check whether another HIPAA permission applies or whether a valid patient authorization is needed. Follow the organization’s Notice of Privacy Practices and policies, and take reasonable steps to avoid discussing patient details where unauthorized people may overhear.

What privacy rights do surgical patients have?

Patients generally have the right to receive a Notice of Privacy Practices (NPP) describing how a covered provider may use and disclose PHI, the provider’s privacy duties, and how patients can exercise their rights. A patient’s signature acknowledging receipt is not the same as authorization for additional uses or disclosures. HHS provides an overview of the Notice of Privacy Practices.

With limited exceptions, patients can request access to PHI in designated record sets, including many medical and billing records, and ask for an amendment if they believe information is inaccurate or incomplete. Patients may also request confidential communications, ask for restrictions on certain uses or disclosures, and request an accounting of certain disclosures. A provider usually does not have to agree to every requested restriction, although a specific rule applies when a patient pays in full out of pocket and asks that information about the service not be disclosed to the health plan for payment or operations, unless law requires disclosure. See HHS’s model notice for covered health care providers for an overview of these rights.

In an emergency, a patient’s immediate care needs may affect when the provider can deliver the notice, but the organization should follow its applicable notice and documentation procedures. Patients may raise concerns with the organization or file a complaint with HHS’s Office for Civil Rights (OCR).

Which safeguards protect electronic and paper surgical records?

The HIPAA Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards for ePHI. A HIPAA Security Rule risk analysis is a required foundation: organizations assess potential risks and vulnerabilities to ePHI and use the results to guide risk management. For a surgical service, the assessment should account for the systems and devices through which teams create, access, maintain, or transmit ePHI, including relevant vendor services. HHS describes the Security Rule safeguards and risk analysis requirements.

Administrative safeguards include security policies, assigned responsibilities, workforce access controls, and training. Physical safeguards include protecting work areas, devices, and media against unauthorized access or loss. Technical safeguards may include user access controls, authentication, audit controls, and measures to protect information during transmission. HIPAA calls for safeguards appropriate to the organization’s circumstances; it does not prescribe one identical technology setup for every provider.

Paper records and spoken information are not governed by the Security Rule, but they remain protected by the Privacy Rule. Reasonable practices can include securing charts, limiting access to clinical areas, disposing of records securely, verifying recipients before sending information, and taking care not to discuss patient details in public spaces. These examples should be adapted to the organization’s risk assessment, policies, and care environment.

How should acute care services manage vendors and business associate agreements?

A vendor may be a business associate when it performs a function or service on behalf of a covered entity that involves creating, receiving, maintaining, or transmitting PHI. Examples can include billing, transcription, certain IT or cloud services, and servicing a device that stores PHI when the service gives the vendor access to that information. A vendor’s label or contract title does not by itself determine its status; assess what it actually does and what information it can access.

Before allowing a business associate to handle PHI, the covered entity generally must obtain satisfactory assurances in a written contract or other permitted arrangement, commonly called a business associate agreement (BAA). The agreement should address permitted uses and disclosures, safeguards, reporting of security incidents and breaches, and applicable obligations for subcontractors. HHS provides guidance on business associates and business associate agreements.

Keep an inventory of vendors that may access PHI, determine whether a BAA is required, and ensure agreements are in place before the relevant access begins. Review each vendor’s role and the agreement when services or data flows change. A BAA supports compliance but does not replace the covered entity’s own responsibility to safeguard PHI.

How should teams respond to a breach of unsecured PHI?

When staff suspect an impermissible use or disclosure, lost device, misdirected record, or other security incident, they should promptly report it through the organization’s incident-response process. Preserve relevant information, limit further exposure when appropriate, and involve the privacy or security official. The organization should document the incident and assess whether it meets HIPAA’s definition of a breach. An impermissible use or disclosure is generally presumed to be a breach unless an exception applies or a documented risk assessment demonstrates a low probability that the PHI was compromised.

For a breach of unsecured PHI, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. HHS must also be notified; incidents affecting 500 or more individuals require notice without unreasonable delay and within 60 days, while incidents affecting fewer than 500 individuals may be reported to HHS annually, no later than 60 days after the end of the calendar year. A breach affecting more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area. A business associate must notify the covered entity of a breach at or by the business associate without unreasonable delay and no later than 60 days after discovery. See HHS’s Breach Notification Rule guidance and instructions for reporting breaches to the Secretary.

Keep written breach-response policies, train the workforce on reporting procedures, and retain records supporting the organization’s breach determination and any notifications. Timely escalation helps the organization investigate, mitigate harm, and meet applicable breach notification requirements. In practice, consistent access controls, careful vendor oversight, and clear response procedures are central to protecting surgical patients’ PHI.

FAQs.

Does HIPAA apply to acute care surgery services?

HIPAA applies when the organization is a covered entity or business associate. A health care provider generally qualifies as a covered entity when it conducts certain standard transactions electronically. Acute care surgery itself is not a separate HIPAA category, so an organization should determine its status and responsibilities based on its role and activities.

Can surgical teams share PHI for treatment and care coordination?

Yes. HIPAA generally permits providers to use and disclose PHI for treatment, including consultation, referral, and care coordination, without patient authorization. The minimum necessary standard does not apply to provider disclosures or requests for treatment, but teams must still follow applicable access policies and protect information from unauthorized access or disclosure.

When does a surgical vendor need a business associate agreement?

A BAA is generally needed when a vendor performs a service on behalf of a covered entity that involves creating, receiving, maintaining, or transmitting PHI. Assess the vendor’s actual services and access to information; if it acts as a business associate, put the required written arrangement in place before allowing the relevant PHI access.

What must an organization do after a breach of unsecured PHI?

Promptly escalate and investigate the incident, document the breach assessment, mitigate harm where possible, and provide any required notifications. Covered entities generally notify affected individuals without unreasonable delay and within 60 days of discovery, and report to HHS according to the number of individuals affected. Additional media notice may be required for a breach affecting more than 500 residents of a state or jurisdiction.