HIPAA Compliance Guide for Respiratory Therapy Staffing Companies

Respiratory therapy staffing companies may handle sensitive patient information while recruiting, placing, and supporting clinicians. Whether HIPAA applies depends on the company’s role and its relationship to healthcare organizations—not simply on the fact that it supplies respiratory therapists.

This guide explains how to assess business associate status, use business associate agreements, protect protected health information, and respond to a breach. Because each staffing arrangement is different, review your contracts and actual workflows to determine which HIPAA duties apply.

Determine Business Associate Status

The HIPAA business associate definition generally covers a person or organization that performs certain functions or services for a covered entity involving protected health information (PHI). A staffing company may be a business associate if, for example, it handles patient information on a hospital’s behalf to coordinate clinician placements, manage access to clinical systems, or perform related administrative services.

Supplying respiratory therapists alone does not automatically make a staffing company a business associate. Consider what the company actually does, whether it creates, receives, maintains, or transmits PHI for a covered entity, and who controls the clinicians’ work. Clinicians who are under a healthcare organization’s direct control may be treated as part of that organization’s workforce for HIPAA purposes, rather than as the staffing agency’s business associate. The agency could still have separate business associate responsibilities if it performs services involving PHI on the organization’s behalf.

Map information flows for each client: identify what information the agency receives, why it receives it, where it is stored, who can access it, and whether the agency acts for the healthcare organization or for its own staffing operations. Do not assume that a contract label settles the question; assess the actual arrangement and seek qualified legal advice when the role is unclear.

Establish Business Associate Agreements

When a staffing company is a business associate, the covered entity generally must obtain satisfactory written assurances through a business associate agreement (BAA) or other written arrangement before allowing the company to handle PHI. If the staffing company uses a subcontractor that will access PHI for the covered work, it generally must obtain the required written assurances from that subcontractor as well.

A BAA should clearly define the permitted and required uses and disclosures of PHI, require the business associate to protect it, and prohibit uses or disclosures beyond those allowed by the agreement or required by law. It should also address reporting impermissible uses, disclosures, security incidents, and breaches of unsecured PHI; subcontractor obligations; assistance with individual rights requests where applicable; access to relevant records for compliance purposes; and return or destruction of PHI when the agreement ends, when feasible.

Make the BAA operational. Assign responsibility for reviewing it, communicate its requirements to recruiters and placed clinicians who may encounter PHI, and align incident-reporting timelines with the client’s requirements. HIPAA sets an outside limit for certain breach notices, but a BAA may require the staffing company to report much sooner.

Safeguard Protected Health Information

PHI is individually identifiable health information handled by a covered entity or business associate in a HIPAA-regulated role. For a respiratory therapy staffing company, it may include patient names linked to treatment details, respiratory-care records, or information visible in clinical systems. Candidate or employee records maintained by the company in its role as an employer are not automatically HIPAA PHI; assess the capacity in which the company created or received the information.

Limit access to people who need PHI for their assigned work. Use role-based permissions, workforce training, maintain written privacy and security procedures, and apply appropriate sanctions when personnel fail to follow them. Use secure processes for interviews, placement coordination, scheduling, and communications so patient information is not included unnecessarily.

Protect paper records and devices as well as digital information. Keep documents out of public view, secure work areas and storage, use approved devices and systems, and establish procedures for returning, securely disposing of, or remotely disabling devices and media that contain PHI. Review safeguards when staffing arrangements, technology, or work locations change.

Limit PHI Uses and Disclosures

Use or disclose PHI only as the BAA, applicable law, or the covered entity’s instructions permit. Collect and share only the information needed for the task. For example, a placement coordinator may need confirmation that a clinician is assigned to a facility and shift, but may not need detailed patient records.

Before sharing information, verify the recipient and the recipient’s authority to receive it. Use approved channels for communications with healthcare clients and clinicians, and avoid sending PHI through personal email, unapproved messaging apps, or public job-posting tools. If a clinician needs patient information to provide care, follow the healthcare organization’s access and communication procedures.

Staffing companies should also check that PHI is not reused for recruitment, marketing, analytics, or other independent purposes unless the use is specifically permitted. When in doubt, pause the disclosure and ask the covered entity’s privacy contact for direction.

Implement Electronic PHI Safeguards

Electronic protected health information (ePHI) includes PHI created, received, maintained, or transmitted electronically. The HIPAA Security Rule calls for reasonable and appropriate administrative, physical, and technical safeguards to protect its confidentiality, integrity, and availability. The specific measures should reflect the company’s systems, risks, and operating environment.

Start with a documented risk analysis of systems that handle ePHI, including staffing platforms, email, file storage, mobile devices, and remote access. Address identified risks through policies, assigned security responsibilities, workforce training, access management, incident response, contingency planning, and periodic evaluation of safeguards.

Use unique user accounts, grant access based on job responsibilities, promptly remove access when it is no longer needed, and review access periodically. Consider multifactor authentication, encryption for stored and transmitted information, secure backups, audit logs, malware protection, and automatic screen locking as part of a risk-based security program. Train users to recognize phishing and to report lost devices, misdirected messages, or suspicious account activity promptly.

Keep written procedures and records of risk analyses, security decisions, training, incidents, and remediation. Confirm that cloud, software, and other service providers that handle ePHI have appropriate contractual protections and safeguards, including a BAA when required.

Meet Breach Notification Requirements

A breach of unsecured PHI generally triggers notification duties unless an applicable exception applies or a documented risk assessment shows a low probability that the PHI was compromised. If a staffing company discovers a potential incident—such as a lost device, unauthorized account access, or a message sent to the wrong recipient—it should promptly contain the incident, preserve relevant evidence, and notify the covered entity according to the BAA and incident response procedures.

Under the HIPAA breach notification rule, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. That is the outside deadline, not a recommended waiting period; the BAA may require earlier notice. The staffing company should provide available details about affected individuals and the incident, then supplement its report as the investigation progresses.

The covered entity is generally responsible for notifying affected individuals and the Department of Health and Human Services, although a BAA may assign notification tasks to the business associate. The company should cooperate with the covered entity’s investigation, help identify and mitigate harm, and document corrective actions. Clear business associate status, a well-maintained BAA, limited PHI handling, and tested safeguards and response procedures form the foundation of a practical compliance program.

FAQs

When is a respiratory therapy staffing company a HIPAA business associate?

A staffing company may be a business associate when it performs services for a covered entity that involve creating, receiving, maintaining, or transmitting PHI on the entity’s behalf. Supplying clinicians by itself does not automatically establish business associate status. The company’s actual duties, access to PHI, and relationship with the healthcare organization determine the analysis.

What should a business associate agreement include?

A BAA should define permitted and required PHI uses and disclosures; require appropriate safeguards; address reporting of security incidents and breaches of unsecured PHI; require applicable protections for subcontractors; support relevant individual rights and compliance duties; provide for access to records as required; and address return or destruction of PHI when the agreement ends, when feasible. It should also specify practical reporting procedures and timelines.

What safeguards must staffing companies use to protect electronic PHI?

Staffing companies that handle ePHI as business associates must use reasonable and appropriate administrative, physical, and technical safeguards. These typically include a risk analysis, workforce training, access controls, secure devices and systems, audit and incident procedures, and protections for stored and transmitted information. The appropriate measures depend on the organization’s risks and circumstances.

How quickly must a staffing company report a breach of unsecured PHI?

A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI. The business associate agreement may require a shorter reporting period, so follow the contract and report promptly rather than waiting until the maximum deadline.