HIPAA Compliance Guide for Freestanding Cancer Hospitals

Which HIPAA rules apply to freestanding cancer hospitals?

A freestanding cancer hospital is not exempt from HIPAA because it specializes in cancer care or operates independently. A hospital is generally a HIPAA covered entity if it provides health care and conducts certain standard electronic transactions—such as electronic claims transactions—directly or through a billing service. The HIPAA rules then govern the hospital’s protected health information (PHI), including information in paper, electronic, and oral form. See the HHS Summary of the HIPAA Privacy Rule.

The main requirements come from the HIPAA Privacy, Security, and Breach Notification Rules. The Privacy Rule addresses uses and disclosures of PHI and individual rights; the Security Rule requires safeguards for electronic protected health information (ePHI); and the Breach Notification Rules set notification duties after a breach of unsecured PHI. The hospital remains responsible for its obligations when vendors perform services involving PHI on its behalf.

HIPAA is a federal baseline, not a substitute for checking other laws that may apply to a hospital’s records or operations. Hospitals should assess applicable state privacy laws and any other relevant federal requirements with qualified legal counsel.

How should hospitals protect patient rights and respond to privacy requests?

Give patients a clear, accurate Notice of Privacy Practices (NPP) describing how the hospital may use and disclose PHI, their rights, the hospital’s privacy duties, and how to ask questions or submit a complaint. Keep the notice consistent with actual practices and revise and distribute it when a material change requires an update. HHS explains the Notice of Privacy Practices requirements.

Maintain a documented process for patients to request access to PHI in a designated record set, request an amendment, or ask for an accounting of certain disclosures. In general, a hospital must act on an access request within 30 calendar days. It may take one additional 30-day period when it provides the patient, within the initial period, a written explanation of the delay and the expected response date. The deadline applies even when a business associate holds the records. See HHS guidance on timely responses to access requests.

Patients may also request restrictions on some uses or disclosures and confidential communications through an alternative method or at an alternative location. A hospital generally need not agree to a requested restriction, but it must follow restrictions it accepts; it must accommodate reasonable requests for confidential communications. Train staff to route requests promptly, verify the requester’s authority, track deadlines, and document decisions. See HHS guidance on treatment, payment, and health care operations.

What administrative, physical, and technical safeguards protect ePHI?

The HIPAA Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI. A hospital’s HIPAA Security Rule risk analysis should identify where ePHI is created, received, maintained, and transmitted; assess threats and vulnerabilities; and guide risk-management decisions. Repeat and update the analysis as systems, services, facilities, and threats change. See HHS’s Summary of the HIPAA Security Rule and Guidance on Risk Analysis.

• Administrative safeguards: Assign a security official; authorize and supervise workforce access; train staff; apply appropriate sanctions; manage security incidents; and maintain contingency plans, including data backup, disaster recovery, and emergency operations procedures.
• Physical safeguards: Control access to facilities and systems, protect workstations from unauthorized use or viewing, and manage devices and media that store or transmit ePHI, including secure disposal and reuse.
• Technical safeguards: Use access controls, unique user identification, audit controls, integrity protections, and authentication. Evaluate encryption for ePHI at rest and in transit as part of the security program.

Some Security Rule implementation specifications are designated as addressable specifications, not automatically optional. The hospital must assess whether each is reasonable and appropriate; if it is not, document the rationale and implement an equivalent alternative when reasonable and appropriate. HHS explains this distinction in its guidance on required and addressable specifications.

How should cancer hospitals manage permitted uses, disclosures, and business associates?

Use or disclose PHI for treatment, payment, and health care operations when permitted by the Privacy Rule and consistent with the hospital’s NPP. For example, clinicians may share information needed to coordinate cancer treatment with another provider. The minimum necessary standard generally applies to many uses, disclosures, and requests for payment and health care operations, but it does not apply to provider-to-provider disclosures for treatment. See HHS guidance on permitted treatment, payment, and health care operations and the minimum necessary requirement.

For uses or disclosures that are not otherwise permitted or required, obtain a valid patient authorization when the Privacy Rule requires one. Pay particular attention to activities such as marketing, research, and disclosures outside the care team; the applicable rule depends on the purpose and circumstances. Keep records of the basis for significant disclosures and make sure staff understand when authorization or another legal permission is needed.

Identify vendors that create, receive, maintain, or transmit PHI on the hospital’s behalf. When the vendor qualifies as a business associate, put a business associate agreement (BAA) in place before the work begins. The agreement should define permitted uses and disclosures, require safeguards and incident reporting, address subcontractors, and support the hospital’s duties to respond to patient rights requests. See HHS guidance on business associates and BAAs.

What steps should a hospital take after a breach of unsecured PHI?

Act promptly to contain the incident, protect patient care and affected systems, preserve relevant records, and investigate what happened. Determine what PHI was involved, whose information was affected, who received or accessed it, whether it was actually acquired or viewed, and what steps reduced the risk. An impermissible use or disclosure is generally presumed to be a breach unless an exception applies or the hospital documents a risk assessment showing a low probability that the PHI was compromised. See the HHS Breach Notification Rule guidance.

For a reportable breach of unsecured PHI, notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. If the breach affects 500 or more individuals, notify HHS within that same deadline and provide notice to prominent media serving the affected state or jurisdiction. For breaches affecting fewer than 500 individuals, the hospital may report to HHS annually, no later than 60 days after the end of the calendar year in which the breach was discovered. The hospital must also maintain documentation showing that required notices were sent or why notice was not required.

Set procedures for assessing incidents, assigning notification decisions, preparing clear patient notices, coordinating with business associates, and documenting mitigation. A business associate must notify the covered entity of a breach under the applicable rules and its agreement; the hospital should not wait until the end of its investigation to begin assessing notification deadlines.

What HIPAA compliance responsibilities apply to 340B-eligible freestanding cancer hospitals?

HIPAA compliance and 340B eligibility are separate matters: meeting HIPAA requirements does not establish eligibility for the 340B Drug Pricing Program. HRSA describes freestanding cancer hospitals as a distinct 340B hospital category and sets eligibility criteria that include qualifying nonprofit or government-related status and, generally, a disproportionate share adjustment percentage greater than 11.75% on the most recently filed cost report, or eligibility under a separate qualifying indigent-care calculation. Review HRSA’s current freestanding cancer hospital eligibility criteria before applying.

Eligible hospitals must register and remain eligible under the hospital classification they select. HRSA’s program requirements also include annual recertification, accurate registration records, controls to prevent diversion of 340B drugs to ineligible patients and duplicate discounts, and auditable records. Participating freestanding cancer hospitals are also subject to the 340B group purchasing organization prohibition for covered outpatient drugs. See HRSA’s 340B Program Requirements and hospital registration instructions.

When 340B pharmacy operations involve PHI, apply HIPAA protections to those workflows and assess whether pharmacies, technology providers, or other vendors are business associates requiring a BAA. In short, a freestanding cancer hospital must manage HIPAA privacy and security obligations alongside—not instead of—separate HRSA eligibility and program requirements.

FAQs

Are freestanding cancer hospitals covered entities under HIPAA?

Usually, if the hospital is a health care provider that conducts standard HIPAA electronic transactions, such as claims transactions, directly or through a third party. Its freestanding status or cancer specialty does not by itself exempt it. See HHS’s explanation of covered entities.

What safeguards does the HIPAA Security Rule require for ePHI?

It requires reasonable and appropriate administrative, physical, and technical safeguards. These include a risk analysis and risk management, workforce and access controls, physical protections for facilities and devices, technical controls, and contingency planning. Specific measures should reflect the hospital’s risks and circumstances.

When must a freestanding cancer hospital notify patients of a HIPAA breach?

For a reportable breach of unsecured PHI, the hospital must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Additional HHS and media notices may also be required depending on how many people were affected.

Does HIPAA compliance determine eligibility for the 340B Drug Pricing Program?

No. HIPAA and 340B are separate programs. HIPAA governs privacy and security obligations for PHI; HRSA’s 340B eligibility criteria and program requirements determine whether a hospital may participate.