HIPAA Compliance Guide for Plastic Surgery and Breast Reconstruction Practices

Which HIPAA rules and patient rights apply to plastic surgery practices?

Plastic surgery practices that qualify as HIPAA covered entities must follow the Privacy, Security, and Breach Notification Rules. A health care provider is generally a covered entity if it transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as electronic billing. A vendor that handles protected health information (PHI) on a covered entity’s behalf may be a business associate and have its own HIPAA obligations. HHS guidance on covered entities and business associates

The Privacy Rule protects individually identifiable health information in any form—not just electronic records. It limits how a practice may use or disclose PHI, while allowing many uses for treatment, payment, and health care operations. For certain purposes, the minimum necessary standard calls for reasonable limits on the PHI used, disclosed, or requested; it does not apply to provider disclosures for treatment.

Patients have rights that include requesting access to and copies of their records, asking for an amendment, receiving a notice of privacy practices, requesting certain restrictions or confidential communications, and seeking an accounting of certain disclosures. A practice must respond to requests under the applicable rules, but not every requested restriction must be accepted. HHS overview of individual rights under HIPAA

HIPAA establishes a federal baseline. Practices should also check applicable state law and any additional contractual or accreditation requirements relevant to their services.

How should practices conduct an ePHI risk analysis and implement safeguards?

The HIPAA Security Rule requires a documented, accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). Treat the HIPAA Security Rule risk analysis as an ongoing management process—not a one-time checklist. HHS explains that it is foundational to selecting safeguards and managing risks. HHS guidance on Security Rule risk analysis

Map where ePHI is created, received, maintained, or transmitted. For a plastic surgery practice, that may include the electronic health record, clinical photography equipment, staff phones, image storage, patient portals, email, referral workflows, billing systems, cloud services, and backups. Identify who can access each system, likely threats and vulnerabilities, existing controls, and the potential effect of unauthorized access, alteration, loss, or downtime.

Document how you assess risk and prioritize corrective actions. Assign an owner and target date to each action, then record what was completed and what remains. Revisit the analysis when systems, vendors, workflows, or the practice environment change. HIPAA does not prescribe one specific assessment tool or a single set of technologies for every practice.

Use the analysis to select reasonable and appropriate administrative, physical, and technical safeguards. Depending on the practice’s circumstances, examples may include role-based access, individual user accounts, audit-log review, secure workstation and device practices, physical controls for camera and storage areas, staff procedures, backups, and protections for data sent over networks. Encryption is an important safeguard to assess, but the Security Rule’s implementation specifications and the practice’s risk analysis should guide how safeguards are applied. HHS summary of the HIPAA Security Rule

How can practices protect clinical photos and videos?

Clinical images and videos can be PHI when they are identifiable and relate to a patient’s care. A face is not the only possible identifier: an image may be linked to the patient through the medical record, a caption, metadata, or distinctive features. HHS lists full-face photographs and comparable images among the identifiers that must be removed under the Safe Harbor de-identification method. Removing a name or cropping a face does not, by itself, establish that an image is de-identified. HHS guidance on HIPAA de-identification

Build an approved workflow for capturing, transferring, storing, accessing, and disposing of clinical images. For example, use practice-managed equipment and approved systems; transfer images to the designated clinical record or secure repository; limit access to staff who need it; and review device settings for unintended cloud backups or automatic sharing. These are practical safeguards to evaluate through the practice’s risk analysis, not a claim that HIPAA mandates one particular camera or storage product.

Keep clinical documentation separate from promotional use. Before using an identifiable patient image or video in marketing—such as on a website, social media, or an advertisement—obtain a valid HIPAA authorization when required. The authorization should clearly describe the information and purpose, identify who may use or receive it, and explain how the patient may revoke it. Do not treat consent to photography for clinical care as automatic permission to publish the image for marketing. HHS guidance on Privacy Rule marketing requirements 45 CFR § 164.508 on authorizations

What workforce policies and training support HIPAA compliance?

Assign privacy and security responsibilities, and maintain written policies that reflect how your practice actually handles PHI and ePHI. Address access and role changes, patient requests, clinical photography, approved communications, remote work, record disposal, incident escalation, and vendor use. Set procedures for investigating noncompliance and applying appropriate sanctions.

Train workforce members on the policies relevant to their jobs. HIPAA requires training as necessary and appropriate for staff functions, including training new workforce members within a reasonable period and retraining affected staff after a material policy change. The Security Rule also requires a security awareness and training program. Document that training was provided. HHS audit protocol describing workforce training requirements

HIPAA does not establish a universal annual training or certificate-renewal requirement for every workforce member. A practice may set a more frequent schedule in its own policies or to address its risks. A training completion certificate documents participation in a course; it does not, by itself, establish that the organization is HIPAA compliant or replace training on employer-specific procedures.

What should business associate agreements include?

Use a business associate agreement (BAA) when a service provider creates, receives, maintains, or transmits PHI on the practice’s behalf and qualifies as a business associate. Depending on the arrangement, this may include certain cloud-storage, information-technology, billing, or image-hosting providers. Assess the actual service and data flow rather than assuming that every vendor—or no vendor—needs a BAA.

The BAA should set permitted uses and disclosures, require appropriate safeguards, address incident and breach reporting, and require the business associate to bind relevant subcontractors to appropriate protections. It should also cover cooperation with applicable individual-rights requests and the return or destruction of PHI when the relationship ends, subject to the agreement and applicable requirements. The contract should clearly identify how quickly the business associate must report an incident to the practice; a shorter contractual deadline can help the practice investigate and meet its own obligations.

HHS provides a model BAA that can help practices identify common provisions, but it is a sample rather than a required form. A signed BAA does not transfer away the practice’s own HIPAA responsibilities. HHS model business associate agreement

How should practices assess and report a potential breach?

Escalate suspected unauthorized access, loss, misdelivery, or disclosure promptly to the designated privacy or security official. Contain the issue where practical, preserve relevant records and system logs, and document the timeline, information involved, affected individuals, people who accessed or received the information, and mitigation steps. Avoid deleting evidence while trying to remove exposed information.

An impermissible use or disclosure of PHI is generally presumed to be a breach unless the practice documents an applicable exception or demonstrates a low probability that the PHI was compromised. The assessment considers factors including the type of information, who received or used it, whether it was actually viewed or acquired, and what was done to mitigate the risk. HHS Breach Notification Rule guidance

If unsecured PHI was breached, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. A breach affecting 500 or more individuals must be reported to HHS within that period; breaches affecting fewer than 500 may be reported to HHS annually, no later than 60 days after the end of the calendar year in which they were discovered. Additional media notice is required when more than 500 residents of a state or jurisdiction are affected. A business associate must notify the covered entity after discovering a breach; the agreement may require notification sooner than the regulatory outer limit. HHS notification deadlines and requirements

Keep the investigation, risk assessment, notification decisions, notices sent, and remediation records. If notification is not required, document the basis for that decision. State breach-notification laws may also apply.

What should breast reconstruction records document for accreditation reviews?

For a breast center seeking National Accreditation Program for Breast Centers (NAPBC) accreditation, keep the medical record clear enough to show that required reconstruction-related steps occurred. Under the NAPBC 2027 Standards, appropriate patients undergoing mastectomy must be offered a preoperative referral to a reconstructive or plastic surgeon. If the patient is considered inappropriate for referral or declines the offer, document that decision. The record must also document multidisciplinary input obtained before surgery about how reconstruction may affect other treatment modalities. ACS NAPBC 2027 Standards, Standard 5.11

Useful documentation may include the referral offer and its outcome, relevant consultation and patient education, and the multidisciplinary discussion concerning treatment coordination. Distinguish these specific standard requirements from additional details the practice may document to support clinical continuity or its own policies. NAPBC standards specify that compliance is checked through review of selected medical records.

As of November 6, 2026, NAPBC programs must begin implementing the 2027 Standards no later than January 1, 2027. ACS guidance indicates that site visits in 2026 and 2027 review compliance data under the 2024 Standards, while site visits in 2028 and 2029 use the 2027 Standards for the applicable review years. Confirm the standards and review period that apply to your center’s site visit. ACS NAPBC standards and site-visit schedule

In summary, a sound program combines documented risk analysis, safeguards tailored to the practice, careful control of clinical images, workforce procedures, clear vendor agreements, and a prompt, documented response to suspected breaches. For reconstruction programs, maintain records that clearly demonstrate referral offers and multidisciplinary coordination under the standards applicable to the review period.

FAQs

Do clinical photos qualify as protected health information under HIPAA?

They generally qualify when they are identifiable and relate to a patient’s health, care, or payment, or are maintained by a covered entity or business associate in that context. A photo can remain identifiable even if the face or name is absent, particularly when it is linked to a medical record or contains distinctive details.

When is written authorization required to use patient images for marketing?

When a practice uses or discloses identifiable PHI for marketing, HIPAA generally requires a valid authorization unless a specific exception applies. Use a separate, clear authorization for promotional images and videos, and do not assume that clinical photography consent covers publication.

What should a practice do after suspected unauthorized access to PHI?

Promptly alert the privacy or security official, contain the exposure where possible, preserve evidence, and document what happened and what information may have been involved. Assess whether the event is a breach, mitigate harm, and provide any required notices within the applicable deadlines.

What breast reconstruction documentation may accreditation reviewers examine?

For applicable NAPBC standards, reviewers may examine selected medical records for documentation of a preoperative reconstructive or plastic-surgery referral offer to appropriate patients undergoing mastectomy, the reason if a referral was declined or considered inappropriate, and preoperative multidisciplinary input about reconstruction’s effect on other treatment modalities.