HIPAA Compliance Guide for Birth Centers and Midwifery Practices: Requirements, Policies, and Checklist

This HIPAA compliance guide for birth centers and midwifery practices explains the core rules that protect patient privacy and secure medical data. You will find clear steps, midwifery-specific examples, and practical checklists to help you implement requirements with confidence.

The framework centers on the Privacy Rule, the Security Rule, and the Breach Notification Rule. Together, they govern how you handle Protected Health Information in paper, verbal, and Electronic PHI formats across your prenatal, intrapartum, and postpartum workflows.

HIPAA Overview for Midwifery Practices

Midwifery practices and birth centers routinely create, receive, and share clinical data such as prenatal histories, lab results, ultrasounds, labor notes, and newborn information. HIPAA sets the baseline obligations for how you use, disclose, and safeguard this data to protect individual rights and reduce organizational risk.

Key terms at a glance

• Protected Health Information: any individually identifiable health information in any form (paper, verbal, or digital) related to care, payment, or operations.
• Electronic PHI (ePHI): PHI that is created, stored, transmitted, or received electronically (EHRs, patient portals, e-fax, email, cloud backups, mobile devices).
• Breach Notification Rule: requires notices to affected individuals (and sometimes regulators and media) after certain unauthorized uses or disclosures of unsecured PHI.

Quick-start checklist

• Designate a Privacy Officer and a Security Officer; define roles and decision authority.
• Publish a current Notice of Privacy Practices and distribute it at intake.
• Adopt written policies for minimum necessary use, authorizations, patient rights, and complaint handling.
• Execute a Business Associate Agreement with each vendor that handles PHI.
• Implement Administrative Safeguards, Physical Safeguards, and Technical Safeguards for ePHI.
• Establish an incident response and breach notification process; train all workforce annually.
• Schedule a documented security risk analysis and ongoing audits.

Determining Covered Entity Status

You are a covered entity if you are a health care provider that transmits health information electronically in connection with standard transactions (for example, electronic claims, eligibility checks, remittance advice), even if a billing service or clearinghouse submits them on your behalf.

How to evaluate your status

• List all billing and payer interactions. If any claims or eligibility inquiries go electronically, you are a covered entity.
• Using an EHR or patient portal alone does not determine status; the trigger is participation in standard electronic transactions.
• If you never conduct standard transactions (e.g., paper-only, cash-pay), you may not be a covered entity—but adopting HIPAA-grade safeguards remains a smart baseline.

Hybrid and multi-function settings

If your organization also runs retail, education, or other non-clinical services, consider a hybrid entity designation to clearly separate covered health care components from non-covered functions.

Documentation checklist

• Written determination of covered entity status and rationale.
• Roster of standard transactions performed and the systems or vendors used.
• If hybrid, a policy delineating covered components and firewalls between functions.

Implementing Privacy Rule Requirements

The Privacy Rule governs how you use and disclose PHI, the rights you must extend to individuals, and the administrative requirements that support compliance. In a midwifery setting, this spans intake forms, birth plans, partner involvement, newborn records, and community referrals.

Core requirements for midwifery practices

• Use and disclosure: permit PHI uses for treatment, payment, and health care operations; obtain written authorization for other uses (e.g., marketing, photos for social media, non-care research).
• Minimum necessary: share only the least amount of PHI needed for the task, especially when coordinating doulas, lactation consultants, or community resources.
• Notice of Privacy Practices: provide at intake; post prominently; document acknowledgment.
• Individual rights: enable access, amendments, restrictions, confidential communication preferences, and accounting of disclosures in a timely, documented manner.
• Workforce management: train all staff, volunteers, and students; apply a sanctions policy; mitigate any improper disclosures.

Operational practices that work

• Intake workflow that captures disclosure preferences (e.g., who may receive updates during labor).
• Standard authorization form for photos, testimonials, and class rosters when PHI could be implicated.
• Private spaces and voice-lowering protocols at the front desk and postpartum rooms to limit incidental disclosures.

Documentation to maintain

• Policies and procedures; training logs; complaints and resolutions.
• Authorization forms; restriction requests; access and amendment logs.
• Current Notice of Privacy Practices and distribution records.

Ensuring Security Rule Safeguards

The Security Rule requires you to protect Electronic PHI through Administrative Safeguards, Physical Safeguards, and Technical Safeguards. Tailor controls to your size, complexity, and risk profile, but document how each standard is met.

Administrative Safeguards

• Risk analysis and risk management plan, updated regularly.
• Workforce security: role-based access, background checks where appropriate, training, and termination procedures.
• Contingency planning: data backups, disaster recovery, and emergency mode operations tested periodically.
• Vendor management: due diligence and a Business Associate Agreement before any PHI flows.
• Security incident procedures with clear escalation and documentation.

Physical Safeguards

• Facility access controls: keys or badges, visitor logs, and secured areas for servers and network gear.
• Workstation security: privacy screens, automatic lock, and clean-desk policy in shared clinic spaces.
• Device and media controls: encryption, secure storage, tracked assignment, and certified destruction for retired devices.

Technical Safeguards

• Unique user IDs, strong passwords, and multi-factor authentication for systems with ePHI.
• Encryption in transit and at rest for EHRs, laptops, mobile devices, backups, and email where feasible.
• Automatic logoff and session timeouts on shared workstations.
• Audit controls: centralized logging with periodic review for anomalous access.
• Integrity and transmission security: anti-malware, patching, secure Wi‑Fi, VPN for remote access, and restricted USB use.

Small-practice implementation tips

• Use reputable cloud EHRs that provide security certifications and a Business Associate Agreement.
• Adopt a managed service provider for updates, backups, and monitoring if you lack in-house IT.
• Standardize on encrypted, policy-managed devices rather than a mix of personal hardware.

Managing Breach Notification Obligations

A breach is an impermissible use or disclosure of unsecured PHI that compromises privacy or security. Determine whether an incident is a breach by assessing the nature and extent of PHI, the unauthorized recipient, whether the PHI was actually viewed, and the extent of mitigation.

What to do when an incident occurs

• Contain and investigate immediately; document who, what, when, where, and how.
• Conduct the breach risk assessment; apply any exceptions that may fit (e.g., good-faith workforce access, inadvertent disclosure within your organization, or low probability of compromise after mitigation).
• If breach: notify affected individuals without unreasonable delay and no later than 60 calendar days from discovery.
• Large breaches (500+ residents of a state or jurisdiction): notify HHS and local media as required; small breaches: record and report to HHS annually.
• Include required content in notices: brief description, types of PHI, steps individuals should take, what you are doing to investigate and mitigate, and contact information.
• Update policies, retrain staff, and strengthen controls to prevent recurrence.

Conducting Risk Assessments and Audits

A security risk analysis is the backbone of HIPAA compliance. It identifies where ePHI lives, who can access it, what threats exist, and how well your safeguards perform, culminating in a prioritized remediation plan with timelines and owners.

How to run an effective risk analysis

• Inventory systems, devices, applications, users, and data flows that touch ePHI.
• Identify threats and vulnerabilities (loss, theft, snooping, ransomware, misdirected email, misconfiguration).
• Rate likelihood and impact; assign risk levels to each scenario.
• Select and document Administrative, Physical, and Technical Safeguards to reduce risk to a reasonable and appropriate level.
• Create a remediation roadmap; test controls; track completion and residual risk.
• Repeat after major changes and at least annually; log internal audits and spot-checks.

Complete HIPAA compliance checklist

• Named Privacy and Security Officers with current contact details.
• Up-to-date policies and procedures; staff training and acknowledgments.
• Notice of Privacy Practices distributed and posted.
• Business Associate Agreement executed with every applicable vendor and subcontractor.
• Documented risk analysis, remediation plan, and backup/restore tests.
• Access controls, MFA, encryption, and audit logging enabled across systems.
• Incident response plan, breach decision documentation, and notification templates.

Audit rhythm and metrics

• Monthly: user access reviews, patch status, backup success, and log sampling.
• Quarterly: policy refreshers, phishing drills, and vendor attestations.
• Annually: full risk analysis, disaster recovery test, and workforce training.

Establishing Business Associate Agreements

A Business Associate Agreement is required before a vendor creates, receives, maintains, or transmits PHI on your behalf. Common business associates include EHR and practice management vendors, cloud hosting and backup providers, billing services, IT support, e-fax and secure messaging vendors, shredding/document storage services, and marketing firms that handle PHI.

No Business Associate Agreement is generally required for disclosures to another provider for treatment (e.g., laboratories or hospitals), but you still must ensure the disclosure is appropriate and limited to the minimum necessary for the purpose.

What your BAA should include

• Permitted and required uses/disclosures of PHI and prohibition on others.
• Security Rule compliance for ePHI; incident and breach reporting timelines and cooperation duties.
• Safeguards, subcontractor flow-down obligations, and right to audit or receive attestations.
• Support for individual rights (access, amendment, accounting) when the vendor holds PHI.
• Return or secure destruction of PHI at contract end; termination for cause.

BAA due diligence checklist

• Confirm the vendor’s need for PHI and data minimization approach.
• Review encryption, access control, backup, and incident response capabilities.
• Verify where data is stored, who can access it, and how subcontractors are governed.
• Record the date the Business Associate Agreement was fully executed and where it is stored.

FAQs

What constitutes PHI in midwifery practices?

PHI includes any data that identifies a person and relates to health or care delivery—prenatal histories, vitals, lab and ultrasound results, labor notes, newborn information, invoices, and even appointment reminders when linked to identity. PHI can be paper, verbal, or electronic; Electronic PHI adds systems like EHRs, email, e-fax, and mobile devices.

How do birth centers determine covered entity status?

Ask whether you transmit health information electronically in standard transactions, such as claims or eligibility checks. If you or a billing service/clearinghouse send these transactions for you, you are a covered entity. If you operate entirely without standard transactions, you may not be—but adopting HIPAA-aligned safeguards remains prudent.

What are the key elements of the HIPAA Security Rule?

Implement Administrative Safeguards (risk analysis, training, contingency planning, vendor oversight), Physical Safeguards (facility and device controls), and Technical Safeguards (access control, MFA, encryption, audit logs, integrity and transmission security). Document how each standard is met and review controls regularly.

How should a midwifery practice respond to a data breach?

Act quickly: contain the incident, investigate, and perform a documented risk assessment. If it is a breach, notify affected individuals without unreasonable delay and no later than 60 days from discovery; for large incidents, notify regulators and media as required. Provide clear notices, offer mitigation guidance, and strengthen controls to prevent recurrence.