HIPAA Compliance Guide for Multidisciplinary ALS Clinics

Multidisciplinary ALS clinics bring professionals together to coordinate care, but each conversation, record, and digital exchange still needs appropriate privacy and security protections. If your clinic is a HIPAA covered entity, its policies should support timely treatment while safeguarding protected health information (PHI), including electronic protected health information (ePHI).

HIPAA’s requirements apply to covered entities and business associates, not automatically to every organization that provides health services. A health care provider is generally a covered entity if it conducts certain transactions electronically. See the HHS summary of the HIPAA Privacy Rule for details.

What HIPAA privacy policies and workforce training should ALS clinics maintain?

Maintain written privacy policies and procedures that reflect how your clinic actually handles PHI. Assign responsibility to a privacy official, establish a contact for privacy complaints, and provide patients with the required Notice of Privacy Practices when applicable. The clinic’s procedures should cover appropriate uses and disclosures, patient rights, records handling, complaints, and sanctions for workforce violations.

Train workforce members on the policies relevant to their roles. For example, clinicians, schedulers, interpreters, clinic coordinators, and staff managing records may need different guidance on access, disclosures, and communications. HIPAA calls for training that is necessary and appropriate to employees’ functions, including training new workforce members within a reasonable period and addressing material policy changes that affect their work. The rule does not establish a universal annual certificate-renewal requirement. Review the training provisions in 45 CFR § 164.530 and HHS guidance on Privacy Rule responsibilities for providers.

Keep documentation of your policies, training, workforce designations, and actions taken when a privacy concern is reported. Tailor these materials to the clinic’s workflows rather than relying only on generic training: an ALS clinic may need clear procedures for team discussions, caregiver communications, shared workspaces, and access to records across disciplines.

How can multidisciplinary teams share patient information for treatment and care coordination?

The HIPAA Privacy Rule generally permits covered providers to use and disclose PHI for treatment, including consultation and care coordination with other providers, without obtaining the patient’s written authorization. This can support communication among the clinicians involved in an ALS patient’s care. See HHS guidance on treatment, payment, and health care operations disclosures.

The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment purposes. That exception does not mean every team member should automatically receive unrestricted access. Use role-based access control and clinic policies to ensure workforce access fits each person’s responsibilities, while enabling providers to obtain the information needed for treatment. HHS explains both the treatment exception and role-based access in its guidance on the uses and disclosures for treatment, payment, and health care operations.

Separate treatment disclosures from other activities. Research, marketing, or disclosures for purposes not otherwise permitted by the Privacy Rule may require a valid authorization or another applicable legal basis. Also check state law and other applicable rules, which may provide additional protections.

Care partners and family members are not automatically entitled to a patient’s full record. When a patient is present and has decision-making capacity, a provider may share information directly relevant to that person’s involvement in the patient’s care if the patient agrees, does not object when given the opportunity, or the provider reasonably infers that the patient does not object. See the HHS guidance on communicating with family, friends, and others involved in care.

What safeguards protect electronic protected health information in ALS clinics?

The HIPAA Security Rule requires covered entities and business associates to use reasonable and appropriate administrative, physical, and technical safeguards to protect ePHI’s confidentiality, integrity, and availability. Start with a documented risk analysis covering where the clinic creates, receives, maintains, and transmits ePHI—including electronic health records, mobile devices, messaging systems, and remote access. Use the results to select, implement, and periodically review safeguards. HHS summarizes these obligations in its Security Rule guidance.

• Administrative safeguards: Assign security responsibilities, conduct and update risk analysis, train workforce members on security procedures, and establish processes to manage and respond to security incidents.
• Physical safeguards: Control access to facilities and devices, secure workstations and records, and prevent screens or conversations from being exposed to people without a work-related need.
• Technical safeguards: Use appropriate access controls, unique user identification, audit controls, authentication, and transmission security. Review access when staff roles change or end.

Encryption is an important security measure to assess as part of your risk analysis; HIPAA does not prescribe one technology for every clinic. Consider how devices are protected when used off-site, how access is removed when a worker leaves, and how the clinic can restore ePHI if systems become unavailable. The Security Rule is designed to be scalable, so safeguards should reflect the clinic’s circumstances and risks.

How should ALS clinics manage business associate agreements?

Determine whether each vendor or service provider is a business associate by looking at what it does with PHI on the clinic’s behalf. Vendors that create, receive, maintain, or transmit PHI to provide services may include certain cloud or electronic-record providers, billing services, and transcription services. A business associate agreement (BAA) is generally required before a covered entity permits a business associate to handle PHI, subject to applicable exceptions.

A written BAA should define permitted uses and disclosures, require appropriate safeguards, require reporting of impermissible uses or disclosures and security incidents, and address subcontractors that handle PHI. It should also cover access to or return or destruction of PHI when the relationship ends, as applicable. Review HHS’s business associate contract provisions.

Do not assume that a vendor’s claim of being “HIPAA compliant” replaces a BAA or the clinic’s own review. Check the service arrangement, the information involved, how the vendor will use it, and what the agreement says about safeguards, incident reporting, subcontractors, and termination. A provider receiving information from the clinic to treat a patient is not automatically a business associate simply because information is shared; the parties’ roles and the purpose of the disclosure matter.

What steps should clinics take after a security incident or breach?

Make sure workforce members know how to report a suspected incident promptly to the clinic’s privacy or security contact. Follow a documented response process to contain the issue, preserve relevant information, investigate what happened, identify the PHI and people affected, and take steps to reduce potential harm. Record the response and decisions, including the basis for determining whether the incident is a reportable breach.

An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity or business associate documents that there is a low probability the PHI was compromised, based on the required risk assessment, or an applicable exception applies. If a reportable breach is established, the breach notification rule generally requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery. Additional reporting duties can apply: breaches affecting 500 or more individuals require notice to HHS within that timeframe, while breaches affecting fewer than 500 individuals may be reported to HHS annually; a breach affecting more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area. Consult the HHS Breach Notification Rule guidance for requirements and exceptions.

When a business associate discovers a breach, it must notify the covered entity without unreasonable delay and no later than 60 days after discovery. A clinic’s BAA can set a shorter reporting deadline and clarify how the parties will cooperate. The covered entity remains responsible for ensuring required notifications are made, even when the incident occurred at a business associate.

How do HIPAA requirements apply during multidisciplinary ALS visits?

During an in-person visit, HIPAA applies to spoken discussions and visible information as well as paper and electronic records. Multidisciplinary ALS teams may include professionals such as neurologists, nurses, rehabilitation therapists, respiratory therapists, speech-language pathologists, dietitians, and social workers, depending on the clinic. The ALS Association’s description of multidisciplinary ALS clinic teams lists examples of participating disciplines.

Before discussing PHI in front of a caregiver or other visitor, ask the patient about their preference when practicable. Share information with a care partner only as allowed by the Privacy Rule, and limit the disclosure to information directly relevant to that person’s involvement. Give patients a private opportunity to raise concerns, and avoid exposing records, screens, or conversations to others in waiting or shared areas. HHS’s guidance for family and other care-partner discussions explains when those disclosures are permitted.

For team huddles and handoffs, establish who is participating in treatment, use approved communication channels, and confirm recipients before sending records or messages. Maintain access controls for staff and clinicians according to their roles, while ensuring providers involved in treatment can obtain information needed to coordinate care.

In practice, a sound HIPAA program combines clear privacy policies and role-appropriate training, treatment-focused information sharing, risk-based safeguards for ePHI, appropriate BAAs, and a prepared incident-response process. Apply those practices consistently across the team and throughout each ALS visit.

FAQs

Can ALS care team members share patient information without written authorization?

Generally, covered health care providers may share PHI with other providers for treatment, including consultation and care coordination, without written authorization. The minimum necessary standard does not apply to disclosures to or requests by providers for treatment purposes. However, other disclosures—such as sharing with a care partner—must meet the applicable Privacy Rule conditions, and state law may impose additional requirements. See HHS guidance on treatment disclosures.

What safeguards should clinics use when sharing information by email or fax?

Use reasonable safeguards suited to the communication method. Confirm email addresses and fax numbers, use approved systems, limit unintended exposure, and take appropriate steps to protect ePHI during transmission. HIPAA permits treatment-related communications by email or fax when reasonable safeguards are applied. See HHS guidance on sharing information by fax, email, or phone.

Which vendors need a business associate agreement?

A BAA is generally needed when a vendor performs a service or function on behalf of a covered entity and creates, receives, maintains, or transmits PHI as part of that work. This may include certain cloud, billing, or transcription services. Assess the actual arrangement, including subcontractors and applicable exceptions, rather than relying on a vendor’s marketing language. See HHS guidance on business associate contracts.

When must an ALS clinic notify patients about a data breach?

If an incident is a reportable breach of unsecured PHI, the covered entity generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery. The clinic must assess the incident and determine whether an exception applies or whether it can demonstrate a low probability that the PHI was compromised. See the HHS Breach Notification Rule guidance for related reporting duties and exceptions.