HIPAA Compliance Guide for HIV PrEP Clinics

Which HIV PrEP clinics must comply with HIPAA?

A clinic must comply with HIPAA if it is a HIPAA covered entity—for example, a health care provider that conducts certain standard health care transactions electronically. Billing a health plan electronically for services is a common example. A clinic may also be part of a larger covered organization, such as a hospital or health system, whose HIPAA obligations apply to its operations.

Not every organization that provides PrEP is automatically a covered entity. A provider that does not conduct HIPAA-standard electronic transactions may not meet the provider definition of a covered entity on that basis alone. But other laws, contracts, funding conditions, or the clinic’s relationship with a covered organization may still impose privacy obligations. Check the clinic’s actual structure and transaction practices rather than relying on its name or size. HHS guidance on who must comply with HIPAA explains which providers are covered entities.

Covered entities remain responsible for protecting information when they use vendors to perform services. A vendor that meets HIPAA’s business associate definition may also have direct obligations under the HIPAA Rules. HHS guidance on covered entities and business associates describes these relationships.

What HIV-related information qualifies as protected health information?

Protected health information (PHI) is individually identifiable health information held or transmitted by a covered entity or its business associate, in any form. It includes information related to a person’s health, care, or payment for care when the person is identified—or could reasonably be identified—from the information. HHS guidance on protected health information and de-identification explains the definition.

For a PrEP clinic, identifiable records may include a person’s PrEP use, medication and refill history, HIV or other test results, sexual history, STI care, risk assessment, appointment details, messages, and billing information. PrEP use does not mean a person has HIV; however, a record linking a person to PrEP care can still be PHI because it relates to health care.

Information can be PHI even if it is not stored in a formal medical chart. A questionnaire response, email, paper intake form, or conversation may qualify when it contains identifiable health information in the clinic’s possession or is handled on its behalf. Information that has been properly de-identified under HIPAA is treated differently, but removing a name alone may not be enough if other details could identify the person.

When may PrEP clinics use or disclose protected health information?

HIPAA generally permits covered providers to use PHI for treatment, payment, and certain health care operations without obtaining an individual’s authorization, subject to the Privacy Rule’s requirements. A clinic may, for example, share relevant information with another provider involved in a patient’s treatment. HHS guidance on treatment, payment, and health care operations explains when these disclosures are allowed.

The minimum necessary standard generally requires covered entities to make reasonable efforts to limit PHI used, disclosed, or requested to what is needed for the intended purpose. It does not apply to disclosures to, or requests by, a health care provider for treatment purposes. For other routine disclosures, use role-based access and established procedures; review non-routine requests according to the clinic’s policies. HHS guidance on the minimum necessary standard describes the rule and its exceptions.

HIPAA also permits certain disclosures to public health authorities legally authorized to receive information for specified public health activities, including disease reporting and surveillance. Whether a particular HIV-related event must be reported—and what information is required—depends on applicable law. HIPAA permits some disclosures for public health purposes; it does not, by itself, require every such disclosure. HHS guidance on disclosures for public health activities explains the federal permission.

For disclosures that HIPAA does not permit or require, a clinic generally needs a valid authorization or another applicable legal basis. Do not treat a notice of privacy practices as a substitute for an authorization when one is required.

How can clinics safeguard PrEP records and prevent incidental disclosures?

An incidental disclosure is a secondary disclosure that occurs as a by-product of an otherwise permitted use or disclosure. HIPAA allows certain incidental disclosures when the clinic uses reasonable safeguards and applies the minimum necessary standard where it applies. The rule does not require eliminating every possible risk, but it does not excuse a disclosure that results from an impermissible underlying practice. HHS guidance on incidental uses and disclosures explains these conditions.

Practical safeguards can reduce the chance that someone will learn why a person is seeking care. For example, ask patients which contact methods and messages are safe; use discreet appointment reminders; avoid displaying visible intake forms or appointment lists; and hold conversations where others cannot readily overhear them. Train staff to confirm who they are speaking with before discussing patient details.

Apply safeguards to both digital and paper workflows. Limit access to patient records by job role, lock screens when unattended, keep printed forms out of public view, and securely dispose of records and media. These measures should reflect the clinic’s circumstances and be included in written policies and workforce training.

What should clinics require from vendors and cloud questionnaire tools?

Determine what a vendor actually does with questionnaire data before sending it any patient information. If a vendor creates, receives, maintains, or transmits PHI on the clinic’s behalf, it may be a business associate. When a cloud service provider handles electronic protected health information (ePHI) for a covered entity, a HIPAA-compliant business associate agreement is generally required—even if the provider stores only encrypted data. HHS guidance on HIPAA and cloud computing explains the cloud provider’s role.

A cloud-based sexual-history questionnaire therefore needs closer review if answers, identifiers, appointment details, or other information that identifies a patient are collected or stored for the clinic. A tool that receives only genuinely anonymous responses may present a different HIPAA analysis, but clinics should verify what the tool collects, stores, and transmits—including any linked identifiers—before deciding that no business associate agreement is needed.

When a business associate agreement is required, it should define permitted uses and disclosures, require appropriate safeguards and reporting of impermissible disclosures or security incidents, address subcontractors, and cover return or destruction of PHI when the relationship ends if feasible. Review the vendor’s services, access, security practices, and subcontractors; a signed agreement does not replace the clinic’s own assessment of risks. HHS guidance on business associate contracts lists required contract terms.

Which administrative, physical, and technical safeguards protect electronic health information?

The HIPAA Security Rule requires covered entities and business associates to protect ePHI through administrative, physical, and technical safeguards. The standards are flexible and designed to account for differences in an organization’s size, structure, and risks. HHS’s summary of the HIPAA Security Rule describes the safeguards and their purpose.

• Administrative safeguards: Conduct and document a risk analysis, manage identified risks, assign security responsibility, establish workforce access and training procedures, and prepare for security incidents and service interruptions.
• Physical safeguards: Control access to facilities and devices, secure workstations, and manage the use, movement, reuse, and disposal of electronic media that may contain ePHI.
• Technical safeguards: Use access controls and authentication to limit system access, protect information in transit, and implement audit controls that record and examine activity in systems containing ePHI.

Use measures such as unique user accounts, prompt access removal when roles change, secure remote access, and periodic review of access records as part of a risk-based security program. The Security Rule requires audit controls and regular review of information-system activity; the clinic should determine which logs and review procedures are appropriate for its systems. HHS’s HIPAA audit protocol describes the relevant system-activity and audit-control requirements.

How should clinics account for state and local confidentiality laws?

HIPAA establishes a federal baseline, but it does not displace every state privacy rule. A state law that provides greater privacy protections or rights may apply alongside HIPAA; some laws also govern specific information, such as HIV-related records, or set different rules for minors, consent, disclosures, or reporting. HHS guidance on HIPAA preemption of state laws explains when state requirements may remain in effect.

Do not assume the same rules apply in every jurisdiction. Identify the laws that govern the clinic and its patients, including relevant state and local confidentiality and public health requirements. Pay particular attention to rules that may require additional consent, limit redisclosure, or affect access to a minor’s records. When the interaction between laws is unclear, seek advice from qualified counsel or the relevant public health agency.

In short, a sound compliance program starts by determining whether the clinic is a covered entity, treating identifiable PrEP information as PHI, limiting disclosures to authorized purposes, and protecting records through appropriate safeguards. Clinics should also assess vendors carefully and account for stricter state or local requirements.

FAQs.

Does HIPAA apply to every HIV PrEP clinic?

No. A clinic is subject to HIPAA if it meets the definition of a covered entity or operates within a covered organization; a health care provider generally qualifies when it conducts certain standard transactions electronically. A clinic that does not meet that definition may still have obligations under other laws, contracts, or organizational policies. HHS guidance on who must comply with HIPAA explains the covered-entity test.

Can a PrEP clinic disclose HIV-related information for treatment or public health activities?

HIPAA generally permits disclosures to another provider for treatment without the patient’s authorization. It also permits certain disclosures to public health authorities legally authorized to receive information for specified public health purposes. State reporting requirements and any additional confidentiality protections may affect what a clinic must or may disclose. HHS treatment-disclosure guidance and HHS public health disclosure guidance explain these permissions.

Do cloud-based sexual-history questionnaires require a business associate agreement?

Generally, yes, if the questionnaire vendor creates, receives, maintains, or transmits identifiable patient information on behalf of a covered clinic. A tool that handles only genuinely anonymous responses may not involve PHI, but the clinic should verify what data the tool collects and whether identifiers are linked to responses. HHS cloud-computing guidance explains when a cloud provider is a business associate.

Can state confidentiality laws provide additional protections for PrEP records?

Yes. HIPAA does not preempt state laws that provide greater privacy protections or rights in circumstances covered by the law. State requirements vary, so clinics should identify the rules that apply to their location, patients, and records. HHS guidance on more stringent state privacy laws explains this principle.