HIPAA Compliance Guide for Long COVID Recovery Clinics

What HIPAA requirements apply to Long COVID recovery clinics?

HIPAA requirements depend on an organization’s role, not its specialty. A Long COVID recovery clinic is generally a HIPAA-covered provider if it conducts certain standard electronic transactions, such as electronic billing. A vendor or other organization that handles protected health information (PHI) for a covered clinic may be a business associate and have its own HIPAA obligations. Clinics should confirm their status and consider other applicable federal and state privacy requirements. HHS guidance on who must comply with HIPAA

The HIPAA Privacy Rule governs permitted uses and disclosures of PHI and gives patients rights concerning their records. The HIPAA Security Rule requires covered entities and business associates to protect electronic PHI (ePHI) with appropriate safeguards. The Breach Notification Rule sets notification duties when a breach of unsecured PHI occurs.

Clinics should identify where PHI is created, received, maintained, and transmitted; assign staff privacy and security responsibilities; and maintain written policies and procedures. If a service provider handles PHI on the clinic’s behalf, determine whether it is a business associate and, when required, put a business associate agreement (BAA) in place. A BAA documents the business associate’s responsibilities for protecting PHI. HHS guidance on business associates and BAAs

A documented risk analysis is a key Security Rule requirement. Use it to identify risks to ePHI and guide reasonable safeguards for the clinic’s systems, workforce, devices, and vendors. HIPAA calls for an ongoing compliance process, not a one-time checklist. HHS explanation of risk analysis and risk management

How should clinics document Long COVID assessments and care?

HIPAA does not prescribe a Long COVID-specific clinical note template. It regulates privacy, security, and patient rights; clinical documentation should also follow applicable professional standards, payer requirements, and state law. A useful record can make the care plan understandable across visits and disciplines without including unrelated details.

For each assessment, consider recording the patient’s reported symptoms and timeline, changes in daily function, relevant medical history, medications, examination findings, test results, clinical assessment, and the plan. For follow-up, document what has changed, the patient’s response to care, outstanding concerns, and next steps. Clearly distinguish patient-reported information from clinician observations or test findings.

Long COVID care may involve several clinicians over time. Make records easy for authorized members of the care team to interpret: identify the responsible clinician, date entries, document referrals and follow-up plans, and record relevant communications. These are practical documentation approaches, not a special HIPAA-mandated Long COVID format.

How can multidisciplinary teams share protected health information?

HIPAA generally permits health care providers to share PHI with other providers for treatment, including care coordination and referrals, without obtaining the patient’s authorization. The Privacy Rule’s minimum necessary standard does not apply to disclosures to or requests by a health care provider for treatment. Other rules or state laws may impose additional limits in particular circumstances.

Even when the treatment exception applies, clinics can reduce unnecessary exposure by setting role-based access, using individual accounts, and reviewing who can see records. For disclosures that are subject to the minimum necessary standard—such as many operational uses—limit PHI to what is reasonably needed for the purpose.

Use secure, approved channels for team communications and referrals. Before sharing with a vendor that handles PHI on the clinic’s behalf, determine whether a BAA is required and document the arrangement. HIPAA permits treatment-related sharing between providers; it does not mean every person or organization involved in a patient’s life can access the record.

What safeguards are needed for telehealth and referrals?

Telehealth visits, messages, recordings, and related ePHI need safeguards appropriate to the technology and the clinic’s risk analysis. Review the platform and devices used, who can access information, how it is transmitted or stored, and whether recordings or transcripts are created. Avoid recording visits unless there is a clear need, and protect any resulting files.

If a telehealth technology vendor creates, receives, maintains, or transmits PHI on the clinic’s behalf as a business associate, the clinic generally needs a BAA with that vendor. HIPAA does not require a BAA with a telecommunications provider acting only as a conduit with transient access, so assess the vendor’s actual role rather than relying only on a product label. HHS guidance on HIPAA and audio-only telehealth

Practical safeguards include using private spaces, verifying identities, restricting access to authorized users, and using secure communications suited to the risk. Build a clear process for sending referrals and related records to the receiving provider. HIPAA generally allows provider-to-provider disclosures for treatment without patient authorization, but confirm the recipient and purpose, and account for any stricter applicable law. HHS telehealth privacy and security recommendations

How should clinics manage patient access and self-referrals?

Under HIPAA, individuals generally have the right to inspect or obtain a copy of PHI in a designated record set. A covered clinic must act on an access request within 30 calendar days. If it cannot meet that deadline, it may take one additional 30-day extension, provided it gives the patient written notice within the initial period explaining the delay and the expected completion date. HHS guidance on access-request timelines

Give patients a clear way to submit access requests and verify identity using a reasonable process. Track requests and deadlines, including when records are held by a business associate; the clinic remains responsible for meeting the applicable response timeline. HIPAA’s minimum necessary standard does not limit a patient’s access to their own PHI.

HIPAA does not set a clinic’s clinical eligibility rules or determine whether it must accept a self-referral. Clinics can explain their intake, referral, and payer processes clearly. If a patient asks the clinic to obtain records from another provider, follow the clinic’s identity and authorization procedures where applicable; providers may generally share records with each other for treatment without an authorization.

How can clinics support shared decision-making while protecting privacy?

Ask patients how they want to participate in decisions and who, if anyone, they want involved. When a patient is present and has capacity to make health care decisions, a provider may discuss information directly relevant to a family member’s or other person’s involvement in care if the patient agrees or has an opportunity to object and does not object. A clinic may choose to document the patient’s preferences as a practical step, even though HIPAA does not generally require documenting that agreement or lack of objection. HHS guidance on communicating with family and others involved in care

For broader disclosures to a person or organization outside routine care, follow the applicable authorization process unless another HIPAA permission applies. Check for patient restrictions and any stricter state or federal confidentiality rules. In multidisciplinary visits, clarify who is present and their role, and share only what is appropriate to the purpose.

Strong Long COVID clinic practices connect clear documentation, thoughtful team coordination, patient access, and safeguards matched to actual risks. Review these processes regularly so privacy protections support—not obstruct—shared decisions and continuity of care.

FAQs

Does HIPAA apply to every Long COVID recovery clinic?

No. HIPAA generally applies to covered entities, including providers that conduct certain standard electronic transactions, and to business associates that handle PHI on behalf of covered entities. A clinic’s HIPAA status depends on its activities and relationships, not simply on providing Long COVID care. Other privacy laws may also apply.

Can Long COVID clinics share patient records with specialists?

Generally, yes. HIPAA permits providers to share PHI with other providers for treatment, including referrals and care coordination, without patient authorization. Certain specially protected information or other applicable laws may require additional steps.

What HIPAA safeguards apply to Long COVID telehealth visits?

Covered clinics must protect ePHI using appropriate administrative, physical, and technical safeguards informed by a risk analysis. Use technology and workflows that protect communications and stored data, restrict access to authorized users, and address privacy in the settings where visits occur. If a technology vendor acts as a business associate, a BAA is generally required.

When must a Long COVID clinic notify patients of a data breach?

When a breach of unsecured PHI occurs, a covered clinic generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. HIPAA defines breach and includes exceptions; clinics should assess incidents under the Breach Notification Rule and follow its applicable notice and reporting requirements. HHS Breach Notification Rule guidance