HIPAA Compliance Guide for Primary Immunodeficiency Clinics

Primary immunodeficiency clinics handle sensitive information across diagnosis, treatment, laboratory testing, and ongoing care. If your clinic is a HIPAA covered entity, you must protect electronic protected health information (ePHI) with safeguards appropriate to your operations and risks—not simply rely on a generic checklist. The HIPAA Security Rule requires covered entities and business associates to protect ePHI’s confidentiality, integrity, and availability using administrative, physical, and technical safeguards. HHS overview of the Security Rule

What does the HIPAA Security Rule require from primary immunodeficiency clinics?

The Security Rule applies to ePHI your clinic creates, receives, maintains, or transmits. Depending on how your clinic operates, that may include electronic records for diagnoses, lab results, treatment plans, infusion visits, billing, and communications with patients or care partners. The requirements apply to the information, not just the systems on your clinic’s premises.

Your clinic must implement reasonable and appropriate administrative, physical, and technical safeguards. In practice, that means managing security risks, controlling access, protecting devices and work areas, preparing for system disruptions, and reviewing activity in systems that contain ePHI. The safeguards should reflect your clinic’s size, capabilities, technology, and assessed risks. HHS summary of the Security Rule currently in effect

Some implementation specifications are required; others are “addressable.” Addressable does not mean automatically optional: assess whether the specification is reasonable and appropriate for your clinic. If it is, implement it. If it is not, document your decision and whether an appropriate alternative safeguard is needed. HHS explanation of required and addressable specifications

HHS has also published proposed cybersecurity changes to the Security Rule. A proposal is not itself a current requirement; clinics should distinguish proposed changes from the rule in effect. HHS Security Rule history and current overview

How should clinics conduct and document an ePHI risk analysis?

A HIPAA Security Rule risk analysis must assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI your clinic holds. HHS does not prescribe one required method or format, but the analysis must be accurate, thorough, and specific to your environment. HHS guidance on risk analysis

Start by identifying where ePHI is created, received, stored, accessed, and transmitted. Map the systems and workflows involved, including any vendors or business associates that handle ePHI for the clinic. Then document reasonably anticipated threats and vulnerabilities, existing safeguards, and the likelihood and potential impact of identified risks.

Use the findings to assign risk levels and plan corrective actions. Record who is responsible, what changes are needed, and how your clinic will track completion. Keep the analysis and related decisions with your security documentation; the Security Rule requires documentation but does not mandate a particular template. HHS risk-analysis steps and documentation guidance

Revisit the analysis when meaningful changes affect your security environment—for example, when introducing a new record system, changing a vendor, adding a new way to exchange patient information, or responding to a security incident. HIPAA does not set one universal annual schedule; HHS says review frequency varies with the organization and circumstances, and the risk-analysis process should be ongoing. HHS guidance on periodic review and updates

Which clinic information systems and workflows need protection?

Include every system and workflow that creates, receives, maintains, or transmits ePHI—not only the electronic health record. For a primary immunodeficiency clinic, examples may include scheduling and billing applications, laboratory interfaces, patient portals, email and messaging tools, telehealth platforms, and systems used to coordinate treatment or communicate with outside providers.

Account for information on workstations, servers, mobile devices, removable media, and networked systems, as well as services hosted or supported by vendors. A cloud service that maintains ePHI on the clinic’s behalf may make its provider a business associate. Clinics should determine whether a business associate agreement is required and address the vendor relationship in their risk analysis. HHS guidance on cloud computing and HIPAA

Review physical and operational workflows as well as software. Consider how staff access records during visits, handle printed documents, discuss patient information, use devices outside the clinic, and restore access after a disruption. Physical safeguards apply to electronic information systems and related equipment whether they are located onsite or elsewhere. HHS explanation of physical safeguards

How can role-based access controls safeguard patient information?

Role-based access control is a practical way to give workforce members access appropriate to their job responsibilities. Define roles for clinical, laboratory, billing, scheduling, and administrative work, then configure systems so users can access the information and functions they need to perform those duties.

HIPAA requires technical policies and procedures that allow only authorized people or software to access ePHI. The Rule does not require clinics to use a particular product or a formally named role-based access control model. Unique user identification, suitable authentication, and review of access logs can help put access policies into practice. HHS summary of technical safeguards

Review access when responsibilities change and promptly adjust it when a workforce member leaves. Periodically check user accounts and audit logs for access that no longer fits the person’s role or appears unusual. The Privacy Rule’s minimum necessary standard generally calls for reasonable limits on uses and disclosures of PHI, while recognizing exceptions, including certain disclosures to or requests by a health care provider for treatment. HHS guidance on the minimum necessary requirement

What workforce training and sanctions support HIPAA compliance?

Provide workforce security training that reflects your clinic’s policies, systems, and actual work. Cover how to protect ePHI, identify and report suspicious activity, use devices and messaging tools safely, and respond to security incidents. The Security Rule requires a security awareness and training program for all workforce members, including management. HHS audit protocol on security awareness and training

Reinforce training when systems, practices, or threats change, and explain how staff should report suspected incidents. Keep records of training and make sure new and existing workforce members understand the policies relevant to their roles. Employer-specific policy training matters: completing a general course does not establish that a clinic or its workforce complies with every applicable HIPAA requirement.

Maintain and apply appropriate sanctions for workforce members who fail to follow security policies and procedures. Explain the policy to staff and document relevant training and enforcement decisions. HIPAA does not establish a universal federal requirement for an annual training certificate renewal; clinics should set a training schedule based on their policies, workforce needs, and changing risks. HHS Security Rule guidance for small providers, including sanctions

How should clinics respond to a breach of unsecured protected health information?

Establish a written process for reporting, investigating, and documenting suspected incidents. When an incident occurs, act promptly to contain it, preserve relevant evidence, identify the information and individuals affected, and assess whether the event is a breach of unsecured protected health information. An impermissible use or disclosure is generally presumed to be a breach unless the clinic demonstrates a low probability that the PHI was compromised based on the required risk assessment or an exception applies. HHS Breach Notification Rule overview

For the breach assessment, consider the nature and extent of the PHI involved, who received or accessed it, whether it was actually acquired or viewed, and the extent to which the risk was mitigated. Document the investigation and the basis for the notification decision. “Unsecured” PHI is PHI that has not been rendered unusable, unreadable, or indecipherable to unauthorized people using HHS-specified methods. HHS guidance on breach assessments and notification

If notification is required, the clinic must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. Affected individuals generally receive written notice by first-class mail or, if they have agreed, by email. The notice should describe the incident and information involved, steps individuals can take, the clinic’s response, and contact information.

The clinic must also notify the HHS Secretary. For a breach affecting 500 or more individuals, notice is due without unreasonable delay and no later than 60 calendar days after discovery; for a breach affecting fewer than 500 individuals, the clinic may report it annually, no later than 60 days after the end of the calendar year in which it was discovered. If a breach affects more than 500 residents of a state or jurisdiction, media notice is also required. A business associate must notify the covered entity of a breach as required by the Breach Notification Rule. HHS notification requirements and deadlines

How can clinics handle patient requests to access health information?

Patients generally have an individual right of access to PHI about themselves in a designated record set maintained by or for the clinic. A designated record set may include medical and billing records. Make the request process easy to find, explain any clinic procedures for submitting requests, and assign staff to track requests through completion. HHS overview of the individual right of access

Act on a request no later than 30 calendar days after receiving it. If the clinic cannot meet that deadline, it may take one extension of up to 30 additional days if it provides the patient, within the original period, a written explanation and the date by which it will respond. Provide information in the requested form and format when readily producible, or agree with the patient on another permitted format. HHS guidance on access deadlines

Any fee for a copy must be reasonable and cost-based, consistent with HIPAA’s limits. Do not delay access because a patient has an unpaid bill. If the clinic denies access in whole or in part, follow the Privacy Rule’s applicable requirements for written notice and review rights. HHS guidance on fees for copies HHS guidance on unpaid bills and access

Strong compliance depends on an ongoing cycle: identify ePHI and risks, apply safeguards that fit the clinic, train and support the workforce, respond appropriately to incidents, and honor patients’ access rights.

FAQs.

How often should a primary immunodeficiency clinic review its ePHI risk analysis?

HIPAA does not set a universal annual interval. HHS says the risk-analysis process should be ongoing and that review frequency varies by organization and circumstances. Reassess when significant changes, incidents, or new risks may affect ePHI, and document updates. HHS guidance on periodic review

What information systems are included in a clinic’s HIPAA risk analysis?

Include all systems and media that create, receive, maintain, or transmit ePHI, wherever they are located. Depending on clinic operations, that may include electronic health records, laboratory and billing systems, patient portals, email, mobile devices, removable media, networks, and services provided by vendors. HHS risk-analysis guidance on scope

When must a clinic notify patients about a breach of unsecured protected health information?

When notification is required, the clinic must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. Whether an impermissible use or disclosure requires notice depends on the breach assessment and any applicable exception. HHS Breach Notification Rule overview

Can patients request access to their health information from a primary immunodeficiency clinic?

Yes. Patients generally may request access to PHI about themselves in a designated record set maintained by or for the clinic. The clinic generally must act within 30 calendar days, subject to one permitted extension of up to 30 additional days with timely written notice explaining the delay. HHS access-timing guidance