HIPAA Compliance Guide for Certified Lymphedema Therapy Clinics

Which lymphedema therapy clinics must comply with HIPAA?

HIPAA coverage depends on what a clinic does—not whether a therapist holds a lymphedema certification. A health care provider is generally a HIPAA covered entity if it transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as submitting insurance claims or checking eligibility. A clinic can conduct those transactions itself or use a billing service to do so. HHS guidance on who must comply explains which providers are covered entities.

If a clinic provides care and accepts only direct cash payments without conducting standard electronic transactions, it may not meet the covered-entity definition on that basis alone. It could still have HIPAA obligations if it performs work involving protected health information (PHI) for another covered entity as a business associate. State privacy laws, contracts, and professional rules may also apply, even when HIPAA does not. HHS guidance on covered entities and business associates describes these categories.

PHI is individually identifiable health information held or transmitted by a covered entity or business associate. It can include a patient’s name, contact details, treatment records, appointment information, and clinical images associated with care. Clinics should first determine whether they are a covered entity, a business associate, both in different roles, or neither, then document the basis for that determination.

How should clinics provide privacy notices and support patient rights?

A covered clinic with a direct treatment relationship generally must give patients a Notice of Privacy Practices (NPP) by the first service and make a good-faith effort to obtain written acknowledgment of receipt, except in an emergency. If the clinic cannot obtain acknowledgment, it should document its efforts and the reason. The notice must use plain language and describe how the clinic may use and disclose PHI, the patient’s rights, how to make complaints, and whom to contact. HHS guidance on the Notice of Privacy Practices explains the notice requirements.

Make the current notice available at the clinic and on its website if the clinic maintains one. Train front-desk and clinical staff to direct privacy questions and requests to the designated contact rather than improvising an answer. Patients generally have rights to access their information, request corrections, ask for certain restrictions, and request confidential communications through an alternative method or location. A provider must accommodate reasonable requests for confidential communications. HHS’s HIPAA Privacy Rule summary outlines these rights.

Track requests promptly. A clinic generally must act on an access request within 30 calendar days, with one additional 30-day extension available if it gives the patient a written explanation and completion date within the original period. HHS’s access-request timeline guidance provides details.

When can staff use or disclose protected health information?

Clinics may generally use or disclose PHI for treatment, payment, and health care operations without obtaining a separate HIPAA authorization. For example, staff may use relevant records to coordinate a patient’s care or bill an insurer. Disclosures must still follow the clinic’s privacy policies and applicable law. The minimum-necessary standard generally applies to many uses and disclosures, but not to disclosures to or requests by a health care provider for treatment. HHS guidance on treatment, payment, and health care operations explains these permissions and limits.

For other purposes, check whether the Privacy Rule permits the disclosure or requires a valid, written authorization. Staff should verify the recipient and purpose, disclose only what is appropriate, and use approved channels. Do not assume that a patient’s general consent to treatment permits sharing details with family, posting information online, or using a patient story in promotional materials.

Clinics should have a clear process for handling requests from family members, other providers, insurers, and outside organizations. When staff are unsure whether a disclosure is permitted, they should pause and consult the privacy officer or other designated lead before sending PHI.

What administrative, physical, and technical safeguards protect electronic health information?

The HIPAA Security Rule requires covered entities and business associates to use reasonable and appropriate administrative, physical, and technical safeguards to protect electronic protected health information (ePHI). It is designed to be scalable: safeguards should reflect the clinic’s size, systems, operations, and risks rather than follow a single prescribed technology checklist. HHS’s Security Rule summary describes the standards.

• Administrative safeguards: Conduct and document a risk analysis; manage identified risks; assign security responsibility; establish workforce access and incident procedures; plan for emergencies; and review security measures as the clinic’s systems and risks change.
• Physical safeguards: Limit access to areas and equipment containing ePHI, secure workstations, and control how devices and media are used, moved, and disposed of.
• Technical safeguards: Use access controls, audit controls, authentication, integrity protections, and transmission security appropriate to the clinic’s risk analysis.

In practice, role-based access controls can help ensure each employee sees only the records and functions needed for their duties. Use unique user accounts, promptly remove access when a worker leaves or changes roles, and review access and audit records. Secure devices and accounts, restrict unattended screens, and choose approved methods for sending patient information. These are practical measures to consider—not a claim that HIPAA mandates one particular product or configuration. HHS guidance on Security Rule risk analysis explains how to assess ePHI risks across systems and devices.

How should clinics train staff and respond to breaches?

Train workforce members on the clinic’s privacy policies and procedures as needed for their roles, and provide a security awareness and training program for the workforce, including management. Training should cover how to recognize PHI, use approved systems, protect screens and devices, report mistakes or suspicious activity, and follow the clinic’s incident process. The rules do not impose a universal annual certificate-renewal requirement; clinics should set training schedules that meet their obligations and their own policies. Training completion certificates document participation, not that the organization as a whole is HIPAA compliant. HHS’s HIPAA guidance describes workforce training obligations for covered entities.

When staff discover a possible exposure, they should report it immediately to the designated privacy or security lead. The clinic should contain the incident where possible, preserve relevant records, identify what information and individuals may be affected, and document its assessment. An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an exception applies or the clinic demonstrates, through a risk assessment, a low probability that the PHI was compromised. HHS’s Breach Notification Rule guidance explains this standard.

If notification is required, the clinic generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. It must also notify HHS; breaches affecting fewer than 500 people may be reported annually, while breaches affecting 500 or more require notice to HHS within the applicable 60-day period. A breach affecting more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area. Document the investigation and notifications, and apply the clinic’s policies for corrective action and appropriate workforce sanctions. HHS’s breach guidance provides the reporting details.

How can clinics securely store and use clinical photographs?

A patient photograph can be PHI when it identifies a patient and is connected to the patient’s health care or treatment. Store clinical images in an approved record system with access controls, and link them to the correct patient record. Avoid storing them in personal photo libraries, messaging apps, or accounts that automatically upload images to unapproved services. Use clinic-managed devices and storage, restrict access to staff who need the images, and follow retention and deletion policies.

For treatment documentation, a covered clinic may generally use PHI for treatment without a separate HIPAA authorization. But using an identifiable patient photograph in public-facing promotion—such as a website, social media post, brochure, or advertisement—generally requires the patient’s valid written HIPAA authorization. Obtain specific, voluntary permission before taking or using images for that purpose; do not make treatment conditional on permission to use a photo for marketing. Keep the authorization with the clinic’s records, and ensure the image and accompanying text do not reveal more than the patient agreed to share. HHS guidance on marketing and HHS guidance on authorizations explain when authorization is required.

If a clinic uses an image for a purpose other than treatment, determine whether that purpose is otherwise permitted under HIPAA or requires authorization. Removing a name alone may not make an image de-identified if the patient can still be recognized or linked to other identifying details.

When do vendors need a business associate agreement?

A vendor generally needs a business associate agreement (BAA) when it creates, receives, maintains, or transmits PHI on behalf of a covered clinic to perform a service or function. Potential examples include billing companies, hosted electronic health record providers, cloud storage providers holding ePHI, and IT or image-management vendors that can access patient information. The vendor’s ability to view the information is not the only consideration: a cloud service provider that maintains ePHI for the clinic may be a business associate even if the data is encrypted and the provider cannot decrypt it. HHS guidance on HIPAA and cloud computing addresses cloud providers.

The written BAA should define permitted uses and disclosures, require appropriate safeguards, require the vendor to report security incidents and breaches, and address subcontractors and the return or destruction of PHI when services end. A vendor’s general claim that it is “HIPAA compliant” does not replace a BAA where one is required. The clinic remains responsible for choosing appropriate vendors and managing its own HIPAA duties. HHS’s business associate guidance describes the agreement requirements.

In short, determine whether HIPAA applies based on the clinic’s transactions and business relationships, protect PHI through documented safeguards, support patient rights, and use written agreements and authorizations when required. Certification as a lymphedema therapist does not itself determine HIPAA status.

FAQs

Does HIPAA apply to every certified lymphedema therapist?

No. Certification alone does not determine whether HIPAA applies. A therapist or clinic is generally a covered entity if it furnishes health care and electronically conducts a standard transaction, such as submitting claims. A clinic may also have HIPAA obligations when acting as a business associate for a covered entity. HHS guidance on covered entities explains the criteria.

When can a clinic use patient photographs for marketing?

For identifiable patient photographs used in public-facing marketing, a covered clinic generally needs the patient’s valid written HIPAA authorization before using or disclosing the image. The clinic should obtain specific permission and should not condition treatment on the patient agreeing to marketing use. HHS marketing guidance explains the authorization rule.

What should a clinic do after discovering a breach of unsecured PHI?

Report and contain the incident promptly, preserve relevant evidence, assess what PHI and individuals were affected, and document the risk assessment. If notification is required, provide notice without unreasonable delay and no later than 60 calendar days after discovery; report to HHS and notify media when the applicable thresholds require it. HHS breach notification guidance explains the assessment and reporting requirements.

Do cloud storage vendors need a business associate agreement?

Generally, yes, if a cloud provider creates, receives, maintains, or transmits ePHI on behalf of the clinic. This can apply even if the provider cannot view encrypted information. Before storing ePHI, the clinic should obtain a HIPAA-compliant BAA and assess whether its own safeguards and vendor arrangements meet HIPAA requirements. HHS’s cloud computing guidance provides more detail.