HIPAA Compliance Guide for Fetal Alcohol Spectrum Disorder Clinics

Which HIPAA rules apply to FASD clinics and their business associates?

A clinic that diagnoses or treats fetal alcohol spectrum disorder (FASD) is not automatically covered by HIPAA simply because it handles health information. A health care provider is generally a HIPAA covered entity if it conducts certain standard transactions electronically, such as electronic claims or eligibility inquiries. HIPAA also applies to health plans and health care clearinghouses. See the HHS explanation of who must comply with the Privacy Rule.

For a covered clinic, the HIPAA Privacy Rule governs permitted uses and disclosures of protected health information (PHI), patient rights, and privacy safeguards. The HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards for electronic PHI. The HIPAA Breach Notification Rule sets notification duties after a breach of unsecured PHI.

Outside organizations that perform services for a covered clinic involving PHI—such as billing, cloud hosting, or certain records-management services—may be business associates. Before disclosing PHI to a business associate for those services, the clinic generally needs a written business associate agreement that describes permitted uses and requires safeguards. Check the HHS business associate guidance. A clinic should also determine whether a vendor is acting as a business associate or instead receiving information for its own independent purpose.

How should clinics protect FASD assessment records and prenatal alcohol exposure information?

Treat identifiable assessment records as PHI when they are held or transmitted by a HIPAA covered entity or its business associate. These records may include developmental and medical history, test results, diagnostic impressions, treatment plans, and details about prenatal alcohol exposure. Limit access according to staff roles and job duties, and train the workforce on clinic policies for handling, discussing, sending, and storing records.

For electronic PHI, HIPAA requires a security risk analysis and reasonable, appropriate safeguards. Depending on the clinic’s systems and risks, practical measures may include individual user accounts, access controls, secure data transmission, audit-log review, protected backups, and procedures for lost devices or suspected unauthorized access. For paper records, use controlled access, secure storage, and secure disposal. The HHS Security Rule summary explains the required safeguards and risk-management approach; HIPAA does not prescribe one identical technology setup for every clinic.

Apply the minimum necessary standard to uses, requests, and disclosures where it applies, such as many payment and health care operations activities. It does not apply to disclosures to or requests by a health care provider for treatment, or to disclosures made under a valid authorization. See HHS guidance on the minimum necessary standard. Even when the standard does not apply, clinics can use role-based access and thoughtful information-sharing practices to reduce unnecessary exposure.

When can FASD clinic staff share information with caregivers, schools, or other providers?

For an adult patient, staff generally need the patient’s authorization to disclose assessment results to a caregiver who is not otherwise legally authorized to act for the patient. For a minor, a parent or guardian is usually the child’s personal representative, but state law and specific HIPAA exceptions can affect who may access particular records. Confirm authority before sharing, especially when custody arrangements, minor-consented care, or safety concerns are involved. The HHS personal-representative guidance describes these rules.

A covered provider may generally share PHI with another health care provider for treatment without a HIPAA authorization. A school is not automatically a treatment provider, however, and a school’s request for assessment results for educational planning is not the same as a provider-to-provider treatment disclosure. For non-treatment disclosures, obtain a valid authorization or identify another specific legal basis; disclose only what is permitted for the purpose. HHS explains how HIPAA applies to disclosures to school nurses and physicians in its guidance on sharing student information with school health providers.

Social service agencies and other caregivers do not receive blanket access merely because they support the patient. Staff should verify the person’s authority, the purpose of the request, and whether the patient has provided a valid authorization or another HIPAA permission applies. Separate rules may permit or require certain disclosures, such as those required by law or related to child-abuse reporting. Document the basis for disclosures when clinic policy or applicable law calls for it.

How do state confidentiality laws affect FASD records and referrals?

HIPAA is a federal baseline, not a reason to ignore stricter state protections. A state law that provides greater privacy protections or rights may prevail over a conflicting HIPAA Privacy Rule provision; when the laws are not in conflict, a clinic may need to follow both. See HHS guidance on more stringent state laws.

Because requirements vary by state, clinics should check applicable laws on medical-record confidentiality, minor consent and parental access, guardianship and custody, mandatory reporting, and disclosures to schools or social services. Do not assume that FASD records receive a special confidentiality status simply because they concern prenatal alcohol exposure; confirm whether a specific state law applies to the information and the circumstances of the disclosure.

Before making a referral or responding to a records request, verify the patient’s authority to consent, the recipient’s role, and any state-law limits or reporting duties. If the clinic operates in multiple states or the rules are unclear, consult qualified legal counsel or the clinic’s privacy officer.

What should clinics do after a breach of unsecured protected health information?

Secure the affected systems or records, limit further unauthorized access, preserve relevant evidence, and promptly involve the clinic’s privacy and security leads. Investigate what happened, whose PHI was involved, whether it was unsecured, and what steps may reduce potential harm. An impermissible use or disclosure is generally presumed to be a breach unless the covered entity or business associate documents an applicable exception or a risk assessment shows a low probability that the PHI was compromised. The HHS HIPAA Breach Notification Rule guidance describes the assessment and notification requirements.

If notification is required, the covered clinic must notify affected individuals without unreasonable delay and no later than 60 days after discovery. It must notify HHS as well: breaches affecting 500 or more individuals are reported without unreasonable delay and within 60 days, while breaches affecting fewer than 500 individuals may be reported annually, no later than 60 days after the end of the calendar year in which they were discovered. A breach affecting more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area.

A business associate must notify the covered clinic of a breach at or by the business associate under the applicable agreement and HIPAA rules; the clinic remains responsible for ensuring required individual notifications are made, though it may delegate the task. Keep records of the investigation, risk assessment, mitigation, and notifications—or of the basis for determining that notice was not required. The HHS breach-reporting instructions provide details on reporting to the Secretary.

How can multidisciplinary teams coordinate assessments while protecting privacy?

FASD assessments may involve clinicians from different disciplines and, with appropriate permission, caregivers, schools, or community providers. Establish in advance which team members are part of the clinic’s workforce, which are independent providers, and which are business associates. Use role-based access and agreed procedures for sharing records so team members can find the information they need without making the full record broadly available.

For provider-to-provider treatment coordination, HIPAA generally permits relevant disclosures without a separate authorization. For school or social-service coordination that is not a treatment disclosure, verify whether the patient’s authorization or another specific legal permission is needed. Document permissions, recipient roles, and any limits on the information shared. Apply the minimum necessary standard when it applies, while recognizing its exception for treatment disclosures between providers.

Clear responsibilities, secure communication channels, and state-law review help multidisciplinary teams coordinate care while respecting the patient’s privacy and the limits on access to assessment records.

FAQs.

Are FASD clinics covered entities under HIPAA?

Some are. An FASD clinic is generally a covered entity if it is a health care provider that conducts certain standard transactions electronically, such as electronic health plan billing. The clinic’s name or specialty alone does not determine its status. See the HHS explanation of covered entities.

Can an FASD clinic share assessment results with a school or social service agency?

It depends on the purpose and applicable legal permission. A provider may generally disclose PHI to another provider for treatment without authorization, but sharing results with a school for educational planning or with a social service agency may require a valid patient or personal-representative authorization unless another HIPAA permission applies. State confidentiality laws may impose additional requirements.

What must an FASD clinic do after a breach of unsecured PHI?

The clinic should contain and investigate the incident, assess whether it is a reportable breach, mitigate harm, and document its findings. If notification is required, notify affected individuals without unreasonable delay and within 60 days of discovery, and report to HHS according to the number of people affected. Additional media notice is required for a breach affecting more than 500 residents of a state or jurisdiction. Follow the HHS breach notification guidance.

Do state laws provide additional confidentiality protections for FASD records?

They may, but the rules depend on the state and the circumstances. State law can provide stronger privacy rights or address issues such as minor consent, parental access, mandatory reporting, and school disclosures. FASD records do not automatically receive a special confidentiality status under HIPAA; clinics should check applicable state law.