HIPAA Compliance Guide for Focused Ultrasound Centers

Which focused ultrasound centers must comply with HIPAA?

HIPAA does not automatically apply to every facility that provides focused ultrasound. A center is a covered entity if it is a health care provider that conducts certain standard transactions electronically—such as submitting electronic claims—or if it is a health plan or health care clearinghouse. The transactions may be conducted by the center itself or on its behalf. HHS guidance on who must comply explains these categories.

Accordingly, a focused ultrasound center providing clinical care and billing electronically may be a covered entity. A center operating as part of a hospital or health system should also determine which organization is the covered entity and how the relevant functions are organized. A center’s research activities alone do not determine its status; its role and the way it handles health information matter.

A center may also be a business associate when it handles protected health information (PHI) on behalf of a covered entity. Vendors that host patient records, support clinical systems, or perform billing may also be business associates, depending on their services and access to PHI. HHS guidance on business associates describes these relationships.

How does HIPAA protect patient information in all forms?

The HIPAA Privacy Rule protects identifiable health information held or transmitted by covered entities and their business associates, whether it is electronic, written, or spoken. That can include referrals, treatment plans, ultrasound images linked to a patient, billing records, and conversations about care. When this information is electronic, it is electronic protected health information (ePHI), which is also subject to the Security Rule. HHS’s explanation of protected health information describes the information the Privacy Rule covers.

The Privacy Rule limits how covered entities and business associates may use and disclose PHI, while allowing certain uses for treatment, payment, and health care operations. Staff should follow the center’s access and disclosure policies and use or disclose only the information permitted for the task. The Security Rule separately requires reasonable and appropriate safeguards for ePHI.

What privacy practices should centers establish?

Covered centers should establish clear written privacy procedures, train workforce members as necessary and appropriate for their roles, and designate a HIPAA privacy officer responsible for developing and implementing privacy policies. Training should explain how staff handle patient information in practice, including during scheduling, treatment planning, image review, billing, and communications. These requirements are addressed in 45 CFR § 164.530.

Most covered health care providers must give patients a Notice of Privacy Practices (NPP). It should explain how the center may use and disclose PHI, patients’ rights, the center’s privacy duties, and how to raise a concern. Providers with a direct treatment relationship generally provide the notice by the first service date and make a good-faith effort to obtain written acknowledgment of receipt; that acknowledgment is not the same as consent to every use of information. HHS guidance on the NPP describes notice requirements.

Set procedures for verifying identity before disclosing records, discussing care where conversations cannot be overheard, securely handling paper documents, and directing privacy questions or complaints to the appropriate staff member. Make the NPP available on the center’s website if it has a website that provides information about its services.

What administrative, physical, and technical safeguards protect ePHI?

The Security Rule requires covered entities and business associates to use reasonable and appropriate administrative, physical, and technical Security Rule safeguards to protect ePHI. The measures should fit the center’s size, systems, and risks; the Rule does not prescribe a single technology checklist for every organization. HHS’s Security Rule summary explains the standards and their flexible, risk-based approach.

• Administrative safeguards: Conduct and document risk analysis; assign security responsibilities; set workforce access and training procedures; plan for emergencies and backups; respond to security incidents; and periodically evaluate safeguards as systems or risks change.
• Physical safeguards: Control access to facilities and equipment, secure workstations that display patient information, and manage devices and media throughout their use, movement, reuse, and disposal.
• Technical safeguards: Use appropriate controls for user access, authentication, audit activity, and the transmission of ePHI. For example, limit access to authorized staff who need it for their work, and review system activity for suspicious access.

For a focused ultrasound center, include the systems and devices that create, store, or transmit patient-linked treatment plans and images in the risk assessment. Safeguards should account for those workflows as well as the electronic health record, billing systems, email, and backup services.

How should centers manage business associate agreements and security incidents?

Before allowing a business associate to create, receive, maintain, or transmit PHI on the center’s behalf, the covered entity generally needs a written business associate agreement (BAA). The BAA should define permitted uses and disclosures, require appropriate safeguards, require reporting of impermissible uses and security incidents, address support for patient access and amendment requests, flow relevant protections down to subcontractors, and specify what happens to PHI when the arrangement ends. HHS’s BAA provisions outline required contract terms.

Maintain an up-to-date list of vendors and assess whether their actual services involve PHI. A vendor’s label or a contract alone does not determine whether it is a business associate. For example, a cloud provider that maintains ePHI on a covered entity’s behalf may be a business associate even if the information is encrypted and the provider lacks the decryption key. HHS cloud-computing guidance explains this point.

Have a response process for suspected or known incidents: report concerns promptly, contain and investigate them, mitigate harm where practicable, document findings, and assess whether an incident constitutes a breach of unsecured PHI. A BAA may set a shorter reporting period than the HIPAA outer limit, so staff should follow the agreement’s requirements.

What are the breach notification deadlines?

For a breach of unsecured PHI, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The notice should explain what happened, the types of information involved, steps individuals can take to protect themselves, what the center is doing in response, and how to contact it. HHS’s Breach Notification Rule guidance describes the notification requirements.

The center must also notify the HHS Secretary. For a breach affecting 500 or more individuals, it must report without unreasonable delay and within 60 days of discovery. For a breach affecting fewer than 500 individuals, it may report annually, no later than 60 days after the end of the calendar year in which the breach was discovered. Breaches affecting more than 500 residents of a state or jurisdiction also require notice to prominent media outlets serving that area.

A business associate that discovers a breach must notify the covered entity without unreasonable delay and no later than 60 days after discovery. The covered entity remains responsible for ensuring individuals receive required notice, though it may delegate the delivery of notices to the business associate. The 60-day limit is an outside deadline, not a reason to delay notification when the facts are known.

How can patients access records, request corrections, and file complaints?

Patients may request access to PHI in a designated record set, such as medical and billing records. A covered entity generally must act on an access request within 30 calendar days. It may take one additional 30-day extension if it gives the patient written notice of the reason for the delay and the expected response date within the initial 30-day period. The center remains responsible for the deadline when a business associate holds records on its behalf. HHS access-timing guidance provides further detail.

Patients may request an amendment if they believe information in their record is inaccurate or incomplete. A center generally must act on the request within 60 days, with one possible 30-day extension if it gives the patient written notice explaining the delay. If the center denies the request, the patient may submit a statement of disagreement for the record. HHS information about medical records and corrections explains these rights.

Patients can raise concerns through the center’s complaint process, described in its NPP, or submit a complaint to the HHS Office for Civil Rights (OCR). OCR complaints generally must be filed within 180 days of when the person knew or should have known about the alleged violation, though OCR may extend the period for good cause. HIPAA prohibits retaliation for filing a complaint. HHS instructions for filing a privacy or security complaint explain how to submit one.

FAQs.

Does HIPAA apply to every focused ultrasound center?

No. A center is covered if it meets the definition of a covered entity—for example, as a health care provider conducting certain standard transactions electronically. A center may also have HIPAA obligations as a business associate handling PHI on behalf of a covered entity. The center’s specific role and transactions determine whether HIPAA applies.

What must a business associate agreement require?

A BAA must define permitted uses and disclosures of PHI, require appropriate safeguards and incident reporting, address subcontractors, support the covered entity’s patient-rights duties, and set terms for returning or destroying PHI when feasible at the end of the arrangement. It must also include other applicable terms under the HIPAA Rules.

How soon must a center notify patients after discovering a breach?

For a breach of unsecured PHI, the center must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. That deadline is a maximum, not a standard waiting period.

Can patients request corrections to their medical records?

Yes. Patients can request an amendment to information they believe is inaccurate or incomplete. The center must respond within the applicable timeframe; if it denies the request, the patient may submit a statement of disagreement for the record.

Focused ultrasound centers can strengthen HIPAA compliance by confirming their covered-entity or business-associate role, protecting PHI in every form, applying risk-based safeguards to ePHI, managing vendors through appropriate BAAs, responding promptly to incidents, and supporting patients’ rights.