HIPAA Compliance Guide for Epilepsy Monitoring Unit Programs

What HIPAA requirements apply to epilepsy monitoring unit programs?

HIPAA applies to an epilepsy monitoring unit (EMU) when it is part of a covered health care provider, such as a hospital that conducts certain electronic transactions. HIPAA also applies to business associates that handle protected health information (PHI) on the provider’s behalf. The rules do not apply to every organization simply because it provides health-related services; the organization must meet the applicable definition of a covered entity or business associate. See HHS guidance on covered entities and business associates.

Identifiable patient information in an EMU may be PHI whether it appears in a clinical note, EEG data, a photograph, or a video or audio recording. The HIPAA Privacy and Security Rules govern permitted uses and disclosures and the protection of electronic PHI. State privacy, recording, and patient-rights laws may add requirements, so an EMU should also follow its health system’s policies and applicable state law.

The HIPAA Privacy Rule governs how an EMU may use and disclose PHI. The HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards for electronic PHI, including video EEG data stored or transmitted electronically. The Breach Notification Rule applies when unsecured PHI is breached.

How should EMUs protect video EEG recordings and patient health information?

Start with a documented risk analysis that covers the full recording lifecycle: capture, live viewing, storage, playback, export, transmission, retention, and deletion. Identify who may need each type of data for patient care, operations, or another permitted purpose, and address risks such as unauthorized viewing, misdirected exports, lost devices, and compromised accounts. HHS guidance on Security Rule risk analysis explains that organizations must assess risks to electronic PHI and implement appropriate measures to reduce them.

Use role-based access control so each workforce member can access recordings and related PHI appropriate to their role. Assign unique user credentials, promptly remove access when responsibilities change, and review audit logs for unusual viewing, downloads, or exports. HIPAA requires access controls and audit controls; role-based permissions are a practical way to help implement appropriate limits. See the HHS summary of the Security Rule.

Apply the minimum necessary standard when it applies; see our guide to the minimum necessary standard for more detail. Limit PHI used, disclosed, or requested to what is reasonably needed for the purpose. The standard does not apply to disclosures to, or requests by, health care providers for treatment, but it may apply to other uses and disclosures, such as administrative activities. Review vendor and service-provider relationships as well. If a vendor creates, receives, maintains, or transmits PHI on the EMU’s behalf, a written business associate agreement may be required.

Who may access or disclose EMU monitoring data?

Authorized members of the care team may use relevant PHI for treatment, subject to the organization’s access policies and other applicable requirements. HIPAA also permits certain uses and disclosures for treatment, payment, and health care operations without patient authorization. These permissions do not justify access out of curiosity or sharing beyond the permitted purpose.

Family members do not automatically have a right to view an EMU recording. A provider may share PHI directly relevant to a family member’s or other person’s involvement in the patient’s care when the patient agrees, does not object when given the opportunity, or the provider can reasonably infer that the patient does not object. If the patient is unavailable or incapacitated, the provider may use professional judgment to determine whether a limited disclosure is in the patient’s best interests. See HHS guidance on disclosures to family and others involved in care.

For disclosures outside HIPAA’s permitted purposes and exceptions, obtain a valid authorization when required. An EMU should review requests for teaching, research, media, or other external use individually; a general desire to share an interesting recording does not itself authorize disclosure. Research use may be possible with an individual’s authorization or through another pathway allowed by the Privacy Rule. See HHS guidance on HIPAA and research.

How should staff manage patient authorization and consent?

Distinguish HIPAA authorization from consent to clinical care or to a recording procedure. HIPAA generally permits covered entities to use or disclose PHI for treatment, payment, and health care operations without a HIPAA authorization. For uses or disclosures that require authorization, the authorization must identify the information, who may use or disclose it, who may receive it, the purpose, and an expiration date or event. See HHS’s Summary of the HIPAA Privacy Rule.

HIPAA does not create a blanket authorization requirement solely because an EMU captures video or audio as part of care. However, other requirements may apply. For hospitals, the CMS State Operations Manual, Appendix A states that video recording patients undergoing medical treatment requires the consent of the patient or the patient’s representative. State law and facility policy may also impose additional consent, notice, or documentation requirements.

Use a clear process for explaining the purpose and scope of monitoring, documenting any required consent, recording a patient’s objection or withdrawal where applicable, and confirming who may act for a patient who cannot make decisions. Keep any authorization for external use separate and specific when required; authorization for one purpose should not be treated as permission for unrelated disclosures.

What safeguards apply to recording, storage, and transmission?

Use EMU systems and workflows that limit recordings to authorized users and protect them from being viewed, altered, or sent improperly. Consider unique accounts, strong authentication, audit logging, secure workstations, controlled exports, and safeguards that prevent visitors from seeing or hearing monitoring feeds. These are implementation measures to support the Security Rule’s requirements; the specific safeguards should be informed by the organization’s risk analysis.

Protect recordings in storage and during transmission using safeguards appropriate to the identified risks. HIPAA treats encryption as an addressable implementation specification, not an unconditional mandate in every circumstance: the organization must assess whether it is reasonable and appropriate and, if it is not, document that decision and implement an equivalent alternative measure when appropriate. See HHS guidance on encryption under the Security Rule.

Set and follow policies for retention, authorized playback, export, secure deletion, and handling removable media. The Security Rule requires reasonable and appropriate safeguards, but an EMU should not assume HIPAA sets one universal retention period for all recordings; apply organizational policy and any relevant state or other legal requirements. If a cloud provider or other vendor stores or processes recordings on the EMU’s behalf, assess the vendor’s role and enter into a business associate agreement when required. HHS cloud-computing guidance explains that a cloud provider maintaining electronic PHI on behalf of a covered entity can be a business associate.

How should EMUs respond to privacy incidents and breaches?

Tell staff to report suspected privacy or security incidents promptly to the designated privacy or security official. Follow the organization’s incident-response procedures to contain the issue, preserve relevant evidence and audit logs, investigate what happened, mitigate harm where practicable, and document the incident and its outcome. These steps support the Security Rule’s requirements for responding to and documenting security incidents.

For a suspected impermissible use or disclosure, assess whether a breach of unsecured PHI occurred. The HIPAA Breach Notification Rule generally presumes a breach unless an exception applies or a documented risk assessment shows a low probability that the PHI was compromised. The assessment considers factors including the type of PHI involved, who received it, whether it was actually acquired or viewed, and the extent to which the risk was mitigated. See the HHS Breach Notification Rule guidance.

If notification is required, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 days after discovering the breach. Breaches affecting 500 or more individuals also require notice to HHS and, in some circumstances, the media; breaches affecting fewer than 500 individuals are generally reported to HHS within 60 days after the end of the calendar year. A business associate must notify the covered entity under the applicable rule and agreement. Check state law and organizational policy for additional or shorter deadlines.

Summary: EMUs should treat identifiable video EEG and related records as PHI, limit access and disclosures to authorized purposes, use appropriate safeguards throughout the recording lifecycle, and investigate and assess suspected incidents promptly. HIPAA authorization, clinical consent, and other recording requirements are distinct; apply the rules relevant to the specific use and setting.

FAQs.

Are video and audio recordings from an EMU protected health information?

They can be. When a recording identifies a patient or links the patient to care or health information and is handled by a covered entity or business associate, it may be PHI. Protect identifiable recordings under applicable HIPAA requirements and organizational policies.

Can EMU staff share monitoring recordings with a patient’s family?

Not automatically. Staff may share information directly relevant to a family member’s involvement in the patient’s care when the patient agrees, does not object when given the opportunity, or the provider determines under professional judgment that a limited disclosure is in the patient’s best interests if the patient is unavailable or incapacitated. A full recording may contain more information than is relevant, so assess the proposed disclosure carefully.

Does HIPAA require patient authorization for EMU video recording?

HIPAA does not impose a blanket authorization requirement solely because video is recorded for care. However, hospital guidance from CMS says recording patients undergoing medical treatment requires consent from the patient or the patient’s representative, and state law or facility policy may add requirements. Authorization may also be required for a later use or disclosure that is not otherwise permitted by HIPAA.

What should an EMU do after a suspected privacy breach?

Report the incident promptly through the organization’s process, contain it, preserve evidence, investigate and document what occurred, and assess whether unsecured PHI was breached. If the Breach Notification Rule requires notice, meet its deadlines and notify affected individuals, HHS, or others as applicable. Work with the privacy or security official to determine the required response.