HIPAA Compliance Guide for Centers for Independent Living

When does HIPAA apply to a Center for Independent Living?

HIPAA applies to organizations that qualify as covered entities or business associates. A Center for Independent Living (CIL) is not automatically subject to HIPAA just because it serves people with disabilities, receives federal funding, or handles information about a person’s health. HHS explains that organizations outside those categories generally do not have to comply with the HIPAA Rules. HHS: Covered Entities and Business Associates

A CIL may nevertheless have HIPAA obligations if it provides health care and conducts certain standard electronic transactions, or if it performs services on behalf of a covered entity that involve protected health information (PHI). The key is the CIL’s actual activities and relationships—not its name, mission, or funding source.

Even when HIPAA does not apply, other privacy, security, civil-rights, contract, grant, or state-law requirements may still govern a CIL’s information practices. Treat sensitive information responsibly, but do not assume that every health-related record is HIPAA-regulated.

How to determine whether your CIL is a covered entity or business associate

Start by reviewing the organization’s legal structure, services, transactions, contracts, and information flows. A CIL can have more than one relevant role, so assess each activity rather than relying on a broad label.

• Covered entity: A CIL would qualify if it is a health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a transaction for which HHS has adopted a standard. A provider may meet this test when transactions are conducted on its behalf. HHS: Covered Entities and Business Associates
• Business associate: A CIL may qualify if a covered entity engages it to perform a function or service involving the creation, receipt, maintenance, or transmission of PHI on the covered entity’s behalf. Examples can include certain care-coordination, data, or administrative services, depending on what the CIL does and what information it handles. HHS: Business Associates Frequently Asked Questions
• Neither role: A CIL that does not meet either definition generally is not subject to HIPAA merely because it collects disability-related information or receives a referral from a health care provider.

When a covered entity engages a business associate, the parties generally need a written business associate agreement (BAA) that describes the work and safeguards for PHI. A BAA should reflect a relationship that actually meets the business-associate definition; signing one does not, by itself, determine the organization’s legal status. HHS describes the contractual assurances required for these relationships in its business associate guidance.

For a practical review, map who collects information, who decides how it is used, whether it is disclosed to or received from a covered entity, and whether the CIL is doing work on that entity’s behalf. If the facts are unclear, get advice based on the organization’s specific contracts and operations before treating the CIL as covered—or assuming it is not.

What the HIPAA Privacy Rule requires for protected health information

For covered entities, the Privacy Rule governs the use and disclosure of PHI and establishes individual rights concerning that information. PHI generally means individually identifiable health information held or transmitted by a covered entity, subject to HIPAA’s definitions and exclusions. The fact that information describes a disability or health condition does not, on its own, mean that every organization holding it is regulated by HIPAA.

Covered entities may use or disclose PHI when the Privacy Rule permits or requires it, or when the individual has provided a valid authorization. The rule allows certain uses and disclosures without authorization, including specified treatment, payment, and health care operations. It also generally requires covered entities to limit many uses, disclosures, and requests to the minimum necessary for the purpose, subject to exceptions such as disclosures to or requests by a provider for treatment. HHS: Summary of the HIPAA Privacy Rule HHS: Minimum Necessary Requirement

Covered entities also have duties related to individuals’ access to their PHI, workforce practices, safeguards, and complaints. A business associate must protect PHI in accordance with its agreement and the HIPAA provisions that apply directly to business associates; it does not simply assume every obligation of the covered entity.

If your CIL is not a covered entity or business associate, HIPAA’s Privacy Rule does not automatically govern its records. Confidentiality commitments in a grant, contract, referral arrangement, professional standard, state law, or the CIL’s own policies may still apply. Also, an organization that is a covered entity may hold records in a capacity—such as employer records—that HIPAA excludes from PHI.

How the HIPAA Security Rule safeguards electronic protected health information

The Security Rule applies to covered entities and business associates with electronic protected health information (ePHI). It requires reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI that the regulated organization creates, receives, maintains, or transmits. HHS: Summary of the HIPAA Security Rule

A HIPAA Security Rule risk analysis is a foundational requirement: the organization identifies and assesses risks and vulnerabilities to ePHI, then uses the results to manage those risks. HHS describes risk analysis as assessing potential threats and vulnerabilities and the likelihood they could affect the confidentiality, integrity, or availability of ePHI. HHS: Risk Analysis and Risk Management

For a CIL that is a regulated entity, the analysis should account for the systems and workflows that handle ePHI, including staff access, email, mobile devices, vendors, backups, and information shared with partners. Safeguards may include access controls, workforce training, secure device and media practices, contingency planning, and procedures for responding to security incidents. The Security Rule is designed to be flexible, so measures should be appropriate to the organization’s circumstances and risks rather than treated as a one-size-fits-all technology checklist.

A CIL that is not subject to the Security Rule may still benefit from similar protections. If it receives ePHI under a BAA, the agreement and HIPAA requirements applicable to the relationship matter. A referral, by itself, does not establish that the CIL is a business associate.

When the HIPAA Breach Notification Rule applies

The Breach Notification Rule applies to covered entities and business associates when there is a breach of unsecured PHI. In general, an impermissible use or disclosure is presumed to be a breach unless an exception applies or the organization documents, through the required risk assessment, a low probability that the PHI was compromised. The assessment considers the nature of the information, who received or used it, whether it was actually acquired or viewed, and how the risk was mitigated. HHS: Breach Notification Rule

Following a breach of unsecured PHI, a covered entity generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery. Additional notice to HHS—and, for breaches affecting 500 or more residents of a state or jurisdiction, notice to prominent media outlets—may also be required. A business associate that discovers a breach must notify the covered entity; its agreement may set a shorter reporting deadline. HHS: Breach Notification Rule

If a CIL is not a covered entity or business associate, HIPAA’s breach-notification duties do not apply to it solely because it holds sensitive information. But a contract, state breach-notification law, grant term, or other applicable rule may require notice. A CIL should check those obligations and its incident-response procedures rather than assume HIPAA is the only relevant standard.

How HIPAA obligations intersect with Rehabilitation Act program standards

HIPAA and the Rehabilitation Act address different obligations. HIPAA regulates certain organizations’ handling of PHI. Section 504 of the Rehabilitation Act prohibits disability discrimination by recipients of federal financial assistance in their covered programs or activities. HHS: Section 504 of the Rehabilitation Act

CILs receiving assistance under the relevant Rehabilitation Act programs must meet the standards and assurances applicable to their funding. These include requirements concerning the independent-living philosophy, cross-disability services, consumer-selected goals, and program planning and reporting. ACL describes the CIL standards and its role in overseeing compliance. 29 U.S.C. § 796f-4: Standards and Assurances for Centers for Independent Living ACL: Centers for Independent Living

Rehabilitation Act assurances do not automatically make a CIL a HIPAA covered entity or business associate. Conversely, a CIL’s HIPAA status does not replace its obligations under Section 504 or its program standards. A CIL may need to satisfy both sets of requirements when its activities and funding bring both into play.

In practice, accessible communication, appropriate handling of sensitive information, clear staff procedures, and well-defined partner agreements can support responsible service delivery. Those practices should be tied to the requirements that actually apply; they are not a substitute for analyzing HIPAA status or Rehabilitation Act obligations.

Examples and limits of HIPAA applicability for CILs

These examples illustrate how the rules may apply; they are not a determination of any particular CIL’s status.

• Independent-living services: A CIL provides peer support, advocacy, information and referral, or independent-living skills services using information it collects for its own program. Those activities alone do not automatically make the CIL a covered entity or business associate.
• Electronic health care transactions: A CIL also operates as a health care provider and conducts a standard electronic transaction, such as an applicable electronic billing transaction. It may meet the covered-entity definition based on those activities.
• Work performed for a health care provider: A provider engages a CIL to perform a service on the provider’s behalf that involves handling PHI. Depending on the work and information access, the CIL may be a business associate and need a BAA.
• Referral or information sharing: A CIL receives information from a provider for a referral or shares information at an individual’s request. That exchange alone does not necessarily establish a business-associate relationship; the purpose, role, and applicable HIPAA permissions matter.
• Mixed activities: A CIL has both independent-living programs and a separate activity that meets the covered-entity definition. Its HIPAA responsibilities depend on its structure and the rules governing the covered function; it should assess the arrangement rather than assume every record or program is treated identically.

In summary, determine whether your CIL is a covered entity or business associate by examining its services, electronic transactions, contracts, and handling of PHI on behalf of covered entities. Then keep that analysis distinct from the CIL’s Rehabilitation Act standards and assurances, which may apply through its funding and program activities regardless of HIPAA status.

FAQs

Are all Centers for Independent Living required to comply with HIPAA?

No. HIPAA applies to covered entities and business associates, not to every organization that serves people with disabilities or handles health-related information. A CIL’s status depends on its activities and relationships. A CIL may still have privacy, security, or nondiscrimination obligations under other laws, grant terms, contracts, or state requirements. HHS: Covered Entities and Business Associates

Can a CIL become a HIPAA business associate?

Yes. A CIL may become a business associate when it performs a function or service on behalf of a covered entity that involves the use or disclosure of PHI, including creating, receiving, maintaining, or transmitting it. The parties generally need a written business associate agreement addressing the work and required safeguards. The relationship depends on the actual arrangement, not merely the fact that information is exchanged. HHS: Business Associates Frequently Asked Questions

Which HIPAA rules may apply to a CIL?

If a CIL is a covered entity, the HIPAA Privacy, Security, and Breach Notification Rules may apply according to the information and activities involved. A business associate has direct duties under certain HIPAA provisions and obligations under its agreement, including applicable privacy, security, and breach-notification requirements. A CIL that is neither a covered entity nor a business associate is not subject to the HIPAA Rules solely because it handles health-related information.

How do Rehabilitation Act requirements differ from HIPAA?

HIPAA governs the privacy, security, and breach reporting of PHI by covered entities and business associates. Section 504 of the Rehabilitation Act prohibits disability discrimination by recipients of federal financial assistance in covered programs or activities, while CILs receiving relevant program assistance must also meet applicable standards and assurances. These requirements serve different purposes and can apply independently—or both apply to the same organization. HHS: Section 504 of the Rehabilitation Act 29 U.S.C. § 796f-4: CIL Standards and Assurances