HIPAA Compliance Guide for Hospital Risk Management Offices

How should hospitals conduct an ePHI security risk analysis?

Start with an accurate, thorough assessment of risks and vulnerabilities to the confidentiality, integrity, and availability of all electronic protected health information (ePHI) the hospital creates, receives, maintains, or transmits. The Security Rule risk analysis should cover the full environment—not only the electronic health record—including clinical and administrative systems, medical devices, workforce endpoints, removable media, connected services, and vendor systems handling ePHI. HHS guidance on Security Rule risk analysis explains the required scope.

Build and maintain an inventory of where ePHI resides and how it moves between systems, departments, facilities, and business associates. Identify reasonably anticipated threats and vulnerabilities, review existing protections, and assess the likelihood and potential impact of each risk. Use those findings to prioritize corrective actions, assign owners, set target dates, and document decisions and residual risks.

HIPAA does not prescribe one assessment format or a fixed schedule for repeating the analysis. Treat it as an ongoing process: revisit it when changes such as a new system, facility, vendor, security incident, or operational model could affect ePHI. HHS says organizations should update risk analysis and management as needed in response to changes in their environment. HHS risk analysis guidance.

Which administrative, physical, and technical safeguards reduce identified risks?

Choose safeguards based on your documented risks and the hospital’s operating environment. HIPAA requires administrative, physical, and technical safeguards that are reasonable and appropriate to protect ePHI; the right mix will reflect the systems, threats, and workflows identified in the risk analysis. HHS’s summary of the HIPAA Security Rule.

• Administrative safeguards: Establish a security management process, assign security responsibility, manage workforce access, train staff, respond to security incidents, prepare contingency plans, and evaluate the security program. Maintain policies for access authorization, workforce changes, backups, disaster recovery, and emergency operations.
• Physical safeguards: Limit and validate access to facilities, protect workstations from unauthorized use, and control the receipt, movement, reuse, and disposal of devices and media containing ePHI.
• Technical safeguards: Use role-appropriate access controls, unique user identification, authentication, audit controls, integrity protections, and transmission security. Evaluate encryption and automatic logoff in light of the hospital’s risks and requirements.

Some implementation specifications are labeled “addressable.” That does not make them automatically optional: assess whether each is reasonable and appropriate, implement it when it is, or document the rationale for an alternative or for not implementing it when appropriate. HHS guidance on required and addressable specifications.

How can hospitals assess and document HIPAA compliance?

Use a recurring compliance review to compare current practices with applicable Security Rule standards and implementation specifications. Include technical and nontechnical evaluation, review the risk analysis and risk-management plan, and check whether safeguards are operating as intended. HHS describes HIPAA compliance as an ongoing process rather than a one-time goal. HHS guidance on assessing Security Rule compliance.

Keep written policies and procedures, required assessments, and records of actions and activities required by the Security Rule. The six-year retention period for this required Security Rule documentation runs from its creation or the date it was last in effect, whichever is later. The Privacy Rule has its own documentation requirements with a similar six-year period. This is not a general HIPAA requirement to retain every medical record for six years; medical-record retention may instead depend on state law and other applicable rules. HHS’s Security Rule documentation summary and HHS’s Privacy Rule summary.

For practical oversight, maintain an evidence repository with current policies, risk analyses, training records, evaluation results, remediation plans, business associate agreements, and breach determinations. Record who approved key decisions, when controls were reviewed, and how identified gaps were addressed. Apply any longer retention period required by state law, contracts, or other applicable obligations.

What workforce training and sanctions policies are required?

Under the Security Rule, hospitals must implement a security awareness and training program for all workforce members, including management. The Privacy Rule also requires training on privacy policies and procedures as necessary and appropriate for each person’s functions. Tailor instruction to job duties—for example, clinical documentation, patient access, device handling, incident escalation, or vendor management—and provide relevant updates when workflows or risks change. HHS’s HIPAA audit protocol identifies the applicable workforce training requirements.

HIPAA requires appropriate sanctions for workforce members who fail to comply with applicable security policies and procedures. Set out a consistent process for investigating and documenting violations, applying proportionate consequences, and escalating serious or repeated misconduct. Maintain training and sanction records as required documentation.

HIPAA does not establish a universal annual training or annual certificate-renewal requirement. A completion certificate can document participation in a particular course, but it does not by itself establish that the hospital is HIPAA compliant or that an employee understands hospital-specific policies. HHS Security Rule guidance.

How should hospitals vet business associates and manage agreements?

Identify vendors and subcontractors that create, receive, maintain, or transmit PHI on the hospital’s behalf, then determine whether a business associate relationship exists. Before allowing a business associate to handle ePHI, obtain satisfactory assurances through a written agreement or other arrangement that meets HIPAA requirements. Evaluate the vendor’s services, access to information, security controls, incident response, and relevant subcontractor arrangements as part of the hospital’s risk-management process.

A business associate agreement should define permitted and required uses and disclosures; require appropriate safeguards and Security Rule compliance for ePHI; address reporting of impermissible uses, disclosures, and breaches; and require subcontractors with PHI access to accept applicable restrictions. It should also address access to records for HHS oversight and the return or destruction of PHI at termination when feasible, as well as the hospital’s rights if the agreement is materially violated. HHS’s business associate agreement provisions.

Document approvals, executed agreements, vendor contacts, and the process for reporting and escalating incidents. A contract may set a shorter incident-reporting deadline than HIPAA’s outside limit, so make sure the hospital can investigate and meet its own notification obligations in time.

What steps should hospitals take to assess and report a potential breach?

Use a documented incident-response process to triage suspected or known incidents, contain the issue, preserve relevant evidence, and involve privacy, security, legal, clinical, and communications leaders as appropriate. Determine what information was involved, whose information may have been affected, when the incident was discovered, whether the information was secured, and what mitigation is possible.

Under the Breach Notification Rule, an impermissible use or disclosure of PHI is generally presumed to be a breach unless the hospital establishes an applicable exception or documents a risk assessment demonstrating a low probability that the PHI was compromised. The assessment must consider the nature and extent of the information, who received or used it, whether it was actually acquired or viewed, and the extent to which the risk was mitigated. HHS’s Breach Notification Rule guidance.

For a breach of unsecured PHI requiring notice, notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting more than 500 residents of a state or jurisdiction also require notice to prominent media outlets serving that area; breaches affecting 500 or more individuals must be reported to the Secretary within the same 60-day outside limit. Breaches affecting fewer than 500 individuals may be reported to the Secretary annually, no later than 60 days after the end of the calendar year in which they were discovered. HHS’s breach notification requirements.

If the incident occurred at or through a business associate, coordinate promptly with that organization. A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery, but the agreement may require faster reporting. Document the investigation, risk assessment, notifications or rationale for not notifying, mitigation, and corrective actions.

How should hospitals secure facilities, devices, and audit logs?

Use facility access controls that limit physical access to information systems and the facilities housing them while allowing authorized access. Set visitor procedures, validate access based on role or function, and protect workstations in clinical and public areas from unauthorized viewing or use. The Security Rule also requires policies governing the movement of hardware and electronic media, secure disposal, and removal of ePHI before media are reused. HHS guidance on physical safeguards.

Keep an inventory of devices that can access or store ePHI, including portable and shared equipment. Define controls for assigning, transferring, maintaining, backing up, wiping, and disposing of devices and media. Document exceptions and verify that safeguards are still effective after equipment, staffing, or facility changes.

Implement audit controls that record and support examination of activity in systems containing or using ePHI. Review audit logs, access reports, and security-incident tracking records regularly, and establish escalation procedures for unusual or unauthorized activity. HIPAA requires regular review of information-system activity, but the specific review cadence should be risk-based. Preserve the documentation of required reviews; do not assume the six-year rule automatically applies to every raw technical log. HHS’s audit protocol.

Together, risk-based safeguards, documented reviews, workforce accountability, vendor oversight, and incident readiness help hospitals protect ePHI as an ongoing responsibility rather than a one-time checklist.

FAQs

How often should a hospital review its ePHI security risk analysis?

HIPAA does not set a fixed interval, such as annually, for repeating the risk analysis. Hospitals should maintain an ongoing process and update the analysis when needed, including after material environmental or operational changes, new technology, or a security incident. HHS risk analysis guidance.

What HIPAA documentation must a hospital retain for six years?

Retain required Security Rule policies and procedures and records of actions, activities, and assessments that the rule requires to be documented for six years from creation or the date last in effect, whichever is later. The Privacy Rule also requires six-year retention for its specified documentation, such as privacy policies and procedures, notices, and documented actions or designations. This does not mean HIPAA generally requires hospitals to retain all medical records for six years; other laws may set medical-record retention periods. HHS’s Security Rule summary, HHS’s Privacy Rule summary, and HHS’s medical-record retention FAQ.

When must a hospital notify individuals about a breach of unsecured PHI?

When notification is required, notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. The hospital must also assess whether notice to the Secretary and, when more than 500 residents of a state or jurisdiction are affected, prominent media outlets is required. HHS’s Breach Notification Rule guidance.

What should a hospital business associate agreement address?

It should define permitted and required PHI uses and disclosures; require appropriate safeguards; address incident and breach reporting; require applicable protections for subcontractors; support access to relevant records for HHS oversight; and address return or destruction of PHI at termination when feasible. It should also provide for termination if the business associate materially violates the agreement. HHS’s business associate agreement provisions.