HIPAA Compliance Guide for Ehlers-Danlos Syndrome Specialty Clinics

Ehlers-Danlos syndrome (EDS) specialty clinics may coordinate care among clinicians in several disciplines, such as primary care, rehabilitation, cardiology, pain management, and genetics. When a clinic is a HIPAA covered entity, it must protect patient information under the HIPAA Privacy Rule and, for electronic protected health information, the HIPAA Security Rule. HIPAA sets a framework for appropriate use, disclosure, and safeguarding of information; it does not prevent clinicians from sharing information for treatment when the rules permit it. HHS guidance on covered entities explains which providers are subject to the HIPAA Rules.

What information qualifies as protected health information in an Ehlers-Danlos specialty clinic?

Protected health information (PHI) is individually identifiable health information that relates to a person’s past, present, or future health or condition, the care provided to them, or payment for that care. It is PHI when held or transmitted by a covered entity or its business associate in electronic, paper, or oral form. HHS’s explanation of protected health information describes the definition and examples.

In an EDS clinic, PHI may include an identifiable patient’s diagnosis or suspected diagnosis, symptoms, examination findings, family or medical history, referrals, treatment plans, test results, appointment information, insurance details, and billing records. A patient’s name, date of birth, contact information, or medical record number is PHI when associated with health, care, or payment information. Information about a person alone is not necessarily PHI if it is not connected to their health information.

The protections apply across formats: a conversation at the front desk, a paper intake form, an email containing clinical details, and a record in the electronic health record can all involve PHI. Information that has been properly de-identified under HIPAA is treated differently; identifiable records do not stop being PHI simply because a clinic uses them for care coordination.

HIPAA applies to providers that meet the covered-entity definition, including many providers that conduct certain standard transactions electronically. A specialty clinic should determine its status rather than assume that its specialty or size alone decides whether HIPAA applies. HHS’s covered-entity guidance describes the scope of the Rules.

When can clinics use or disclose patient information without written authorization?

A covered clinic generally may use or disclose PHI for treatment, payment, and health care operations without obtaining a patient’s written authorization, subject to HIPAA’s requirements and any other applicable law. Treatment includes providing, coordinating, or managing care and consulting with another health care provider about a patient. For example, a clinic may share relevant clinical information with a treating specialist involved in an EDS patient’s care without first obtaining a HIPAA authorization. HHS guidance on treatment, payment, and health care operations disclosures explains these permissions.

HIPAA also permits certain other disclosures without authorization, including disclosures required by law, disclosures for specified public health purposes, and disclosures needed to avert a serious and imminent threat when the applicable conditions are met. These are limited permissions, not a general license to share a patient’s information. The clinic should identify the applicable HIPAA provision, follow any required limits, and check other legal requirements. HHS’s HIPAA Privacy Rule summary outlines examples of permitted disclosures.

A clinic may share limited information with family members, caregivers, or other people involved in a patient’s care when HIPAA’s conditions are satisfied—for example, when the patient agrees, does not object after being given an opportunity to do so, or the clinician reasonably infers from the circumstances that the patient does not object. A patient’s family relationship alone does not automatically authorize unrestricted access to the patient’s chart. HHS’s guidance on sharing information with family and others involved in care explains when written permission is not required.

Written authorization is generally needed when a proposed use or disclosure is not otherwise permitted or required by HIPAA. Some information, including psychotherapy notes maintained separately from the medical record, has additional protections. Clinics should also consider stricter state laws and any other rules that apply to the information or recipient.

How does the minimum necessary standard apply to clinic operations?

The minimum necessary standard generally requires a covered entity to make reasonable efforts to limit PHI used, disclosed, or requested to what is needed for the intended purpose. It applies to many administrative and operational activities, such as billing, quality improvement, and certain internal workflows. A clinic can put role-based policies in place so that workforce members access the information they need for their job duties rather than routinely viewing every patient’s entire record. HHS’s minimum necessary guidance describes how covered entities should apply the standard.

There is an important treatment exception: the minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment. A treating clinician may need broad clinical context to coordinate EDS care safely; HIPAA does not impose the minimum necessary standard on that provider-to-provider treatment disclosure. However, the clinic should still use reasonable safeguards and follow its access policies. HHS’s minimum necessary FAQ confirms the treatment exception.

For activities where the standard applies, clinics should identify routine disclosures and requests, define reasonable criteria for them, and review non-routine requests individually. Staff should be able to distinguish a treatment disclosure from a payment or operational request, and understand when to seek guidance from the clinic’s privacy official.

How can patients exercise their HIPAA rights?

Patients generally have the right to inspect or obtain a copy of PHI in the clinic’s designated record set, subject to limited exceptions. This may include medical and billing records, test reports, and other information the clinic uses to make decisions about the patient. A clinic must generally act on an access request within 30 calendar days; if it needs an extension, it must provide written notice within the initial period and may take up to 30 additional days. HHS’s guidance on medical records and its access-timing FAQ describe these rights and timelines.

Patients can ask the clinic to amend information they believe is inaccurate or incomplete. The clinic must respond, but HIPAA does not give patients the right to directly alter their records or guarantee that every requested change will be made. If the clinic denies an amendment request, the patient may have the right to submit a statement of disagreement. The clinic generally must act within 60 days, with a possible extension of up to 30 additional days if it provides timely written notice. The HIPAA Privacy Rule’s amendment provisions describe the process.

Patients may also request confidential communications by alternative means or to an alternative location—for example, a phone call at a specified number or mail sent to a different address. A covered health care provider must accommodate reasonable requests. Patients can ask for restrictions on certain uses or disclosures, although a clinic generally is not required to agree to every restriction request. HHS guidance on treatment, payment, and operations explains these rights.

Clinics should make it clear how patients can submit access, amendment, restriction, and confidential communications requests, and identify the person or office responsible for handling them. Staff should route requests promptly so the clinic can meet applicable deadlines, including when records are held by a business associate on the clinic’s behalf.

What safeguards should a specialty clinic include in its privacy and security program?

The HIPAA Privacy Rule requires appropriate safeguards for PHI, while the HIPAA Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards for electronic PHI. The objective is to protect confidentiality, integrity, and availability—not to mandate one technology or identical controls for every practice. HHS’s Security Rule summary describes the required safeguard framework.

A clinic’s written program should be tailored to its size, workflows, systems, and risks. It may cover who can access records, how staff verify identities and permissions, how paper records and work areas are secured, how information is sent and disposed of, and how suspected privacy or security incidents are reported and addressed. Technical controls could include unique user accounts, access controls, secure communication systems, and safeguards for devices that store or access ePHI; the clinic should choose and document measures based on its environment and risk assessment.

A HIPAA risk analysis is a required starting point for the Security Rule’s security management process. It should identify where the clinic’s ePHI is created, received, maintained, or transmitted, assess relevant threats and vulnerabilities, and inform risk-management decisions. The clinic should revisit its analysis and security measures when its systems, vendors, staffing, or care-coordination practices change. HHS guidance on Security Rule risk analysis explains the requirement.

Clinics must train workforce members on privacy policies and procedures as necessary and appropriate for their roles, apply appropriate sanctions for violations, and maintain required documentation. HIPAA does not set a universal annual certificate-renewal requirement. A training completion certificate can document participation, but it does not by itself establish that the clinic is HIPAA compliant; staff training should address the clinic’s own policies and workflows. HHS’s overview of provider responsibilities and OCR’s audit protocol describe training and documentation obligations.

If a vendor creates, receives, maintains, or transmits PHI on the clinic’s behalf, the clinic generally must have a business associate agreement (BAA) with that business associate. The agreement should set permitted uses and disclosures and require appropriate safeguards and reporting of relevant incidents. A BAA is not a substitute for the clinic’s own risk analysis or oversight. Independent clinicians receiving PHI for treatment are not automatically the clinic’s business associates simply because they participate in a patient’s care. HHS’s business associate guidance explains when agreements are required and what they cover.

HIPAA generally requires covered entities to retain required documentation for six years from its creation or the date it was last in effect, whichever is later. This documentation requirement is distinct from state medical-record retention rules. HHS’s Security Rule summary describes the documentation period.

How should clinics coordinate Ehlers-Danlos care across disciplines while protecting patient information?

Start by defining the care team and the information flows needed for treatment. With appropriate clinical workflows, the clinic may share relevant PHI with other treating providers—such as a specialist, physical therapist, or primary care clinician—without a written HIPAA authorization for each treatment disclosure. HIPAA permits these disclosures but does not require a provider to share records in every circumstance. HHS’s treatment disclosure guidance explains the permission.

Use secure, approved channels for referrals, records, and care-team communications, and confirm that information is being sent to the intended recipient. Within the clinic, configure access according to staff roles and responsibilities. Even though the minimum necessary standard does not apply to provider-to-provider treatment disclosures, role-appropriate internal access and reasonable safeguards remain important.

Clarify whether a recipient is a treating provider, a business associate acting on the clinic’s behalf, or another party. A treatment disclosure to an independent provider does not itself require a BAA; a vendor handling PHI for the clinic generally does. For family members or caregivers, follow HIPAA’s rules for involving people in care and respect any patient objections or reasonable requests for confidential communications.

Document the clinic’s processes for referrals, records exchange, patient preferences, access permissions, and incident escalation. Strong coordination lets clinicians share information needed for care while preserving patient privacy through appropriate policies, safeguards, and clear accountability.

FAQs.

Does HIPAA allow Ehlers-Danlos clinicians to share information for treatment?

Yes. HIPAA generally permits covered providers to share PHI with other health care providers for treatment without written authorization. The minimum necessary standard does not apply to disclosures to, or requests by, a provider for treatment. Clinics should still use reasonable safeguards and confirm that information is going to the intended treating provider. HHS’s treatment disclosure guidance explains this permission.

Does the minimum necessary standard apply to disclosures for treatment?

No. HIPAA expressly excludes disclosures to, and requests by, health care providers for treatment from the minimum necessary standard. The standard does apply to many other uses, disclosures, and requests, so clinics should distinguish treatment coordination from administrative or operational activity. HHS’s minimum necessary FAQ explains the exception.

Can patients request amendments to their clinic records?

Yes. Patients may ask a covered clinic to amend PHI in the clinic’s designated record set that they believe is inaccurate or incomplete. The clinic must respond, but it may deny a request on permitted grounds. If denied, the patient may be able to submit a statement of disagreement for inclusion with the record. HHS’s medical records guidance describes amendment rights.

What HIPAA safeguards should an Ehlers-Danlos specialty clinic document?

Document safeguards and activities appropriate to the clinic’s risks and operations, including its HIPAA risk analysis and risk-management decisions, relevant privacy and security policies, workforce training, access controls, incident-handling procedures, and applicable business associate agreements. The Security Rule calls for reasonable and appropriate safeguards rather than one universal technical configuration. HHS’s Security Rule summary outlines safeguard and documentation requirements.