HIPAA Compliance Guide for Therapeutic Drug Monitoring Labs

What HIPAA requires of therapeutic drug monitoring labs

HIPAA does not automatically cover every laboratory simply because it performs therapeutic drug monitoring (TDM). A lab is a covered entity if it meets HIPAA’s definition of a health care provider and electronically conducts a transaction for which HHS has adopted a standard, such as certain electronic billing transactions. A provider may also meet this test when a billing service or other third party conducts the transaction on its behalf. HHS’s Summary of the HIPAA Privacy Rule explains which providers are covered entities.

When a TDM lab is a covered entity, the HIPAA Privacy Rule governs how it uses and discloses protected health information (PHI), while the HIPAA Security Rule requires safeguards for electronic protected health information (ePHI). HIPAA also gives individuals certain rights to access their health information. A lab’s specific obligations depend on its role, the information it handles, and the activities it performs.

Start by documenting which workflows involve identifiable patient information: orders, specimen labels, assay data, results, reports, billing, and communications with clinicians. The Security Rule requires a risk analysis covering ePHI the organization creates, receives, maintains, or transmits, followed by reasonable and appropriate measures to address identified risks. HHS guidance on Security Rule risk analysis describes this requirement.

How to safeguard protected health information in TDM workflows

Map where PHI and ePHI move—from ordering and accessioning through testing, review, reporting, storage, and disposal. Use the results of your risk analysis to choose safeguards suited to those workflows and document decisions, responsibilities, and review processes.

Access control safeguards should give workforce members and system accounts access appropriate to their duties. For example, restrict result entry, review, release, and administrative functions to authorized roles; remove access when it is no longer needed; and review access when job responsibilities change. The Security Rule also includes requirements concerning audit controls, authentication, integrity, and transmission security. 45 CFR § 164.312 sets out the technical safeguard standards.

Protect paper records and physical work areas as well as electronic systems. Train workforce members on lab-specific privacy and security procedures, including identity verification, handling misdirected reports, secure communications, and escalation of suspected incidents. HIPAA requires appropriate safeguards; the particular measures should reflect the organization’s risk analysis rather than rely on a one-size-fits-all checklist.

Apply the minimum necessary standard to uses, disclosures, and requests for PHI when it applies. It generally calls for reasonable limits on information used or shared for a particular purpose, but it does not apply to disclosures to or requests by a health care provider for treatment purposes, among other exceptions. HHS guidance on the minimum necessary requirement describes the rule and its exceptions.

When a business associate agreement is required

A business associate agreement (BAA) is generally required when a covered entity engages a person or organization outside its workforce to perform certain functions or services on its behalf that involve PHI. Examples can include billing, data analysis, or operating a system that maintains ePHI for the lab. The written contract must establish permitted uses and disclosures and require appropriate safeguards, among other terms. HHS’s sample BAA provisions list key contract requirements.

A BAA is not required merely because one health care provider discloses PHI to another provider for treatment. HHS specifically explains that a physician may disclose PHI to a clinical laboratory for an individual’s treatment without a BAA, and that a hospital lab may disclose PHI to a reference lab for treatment without one. HHS’s Business Associate FAQs describe these exceptions.

Assess each relationship by what the parties actually do, not just by the contract’s title. A lab may be acting as a treating provider in one arrangement and performing a separate service on behalf of another covered entity in another. If the relationship involves a covered function or service on behalf of the other entity and PHI, determine whether a BAA is required and ensure any relevant subcontractors are covered by appropriate agreements.

How to manage patient access and disclosure requests

A covered lab generally must provide individuals access to PHI in its designated record set, subject to limited exceptions. This can include completed TDM test reports and other records the lab maintains and uses to make decisions about individuals. HHS explains that a lab must generally act on an access request within 30 calendar days; one extension of up to 30 additional days may be available if the lab provides the required written notice within the initial period. HHS’s Right to Access and Research guidance discusses clinical laboratory records and timing.

Establish a process to receive and verify requests, identify responsive records, review any applicable exceptions, and provide access in the requested form and format when readily producible. A lab does not have to interpret results as part of providing access; patients can be referred to their ordering or treating clinician for clinical interpretation. HHS guidance on access to clinical laboratory reports explains this distinction.

Labs may generally share TDM results with the prescribing clinician for treatment without obtaining the patient’s HIPAA authorization, provided the disclosure is otherwise permitted and appropriately directed. The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment purposes. HHS guidance on treatment disclosures explains the rule.

For other requests, confirm the requester’s authority and the applicable purpose before disclosing PHI. Apply the minimum necessary standard when required, follow the lab’s policies and any applicable state law, and document the request and response as appropriate.

What to do after a suspected data breach

Promptly contain the incident where feasible, preserve relevant records and system logs, and notify the personnel responsible for privacy and security. Determine what information was involved, whose information may have been affected, how the event occurred, and whether PHI was accessed, acquired, used, or disclosed impermissibly. Document the investigation and risk assessment; do not assume every security incident is a reportable breach.

An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity or business associate establishes a low probability that the PHI was compromised through the required risk assessment, or an exception applies. HHS’s Breach Notification Rule guidance describes the breach standard and notification duties.

If the lab is a business associate, notify the covered entity as required by the HIPAA rule and the BAA. HIPAA sets an outside limit of 60 calendar days after discovery for business associate notification, but the BAA may require earlier reporting; follow the applicable contract and escalate promptly so the covered entity can assess its obligations.

If the lab is a covered entity and a breach of unsecured PHI is confirmed, provide required notices without unreasonable delay and no later than 60 calendar days after discovery. The applicable notices may include affected individuals, HHS, and—if the breach affects more than 500 residents of a state or jurisdiction—prominent media outlets serving that area. Breaches affecting fewer than 500 individuals must be reported to HHS within 60 days after the end of the calendar year in which they were discovered. HHS’s notification guidance details the requirements.

How HIPAA applies to electronic lab reports and vendor systems

Electronic TDM reports, patient identifiers, order details, and associated communications may be ePHI when they identify an individual and relate to health or health care. If a covered entity or business associate creates, receives, maintains, or transmits ePHI through a laboratory information system, EHR interface, portal, cloud service, or other vendor system, the Security Rule’s safeguards apply to that ePHI.

Before a vendor handles ePHI on the lab’s behalf, determine whether the vendor is a business associate and, if so, put a BAA in place. HHS states that a cloud service provider that maintains ePHI for a covered entity or business associate is a business associate even if it cannot view the information, and the parties must have a BAA. HHS guidance on HIPAA and cloud computing explains the requirement.

Review interfaces and vendor workflows for access permissions, authentication, audit logging, report routing, transmission protection, retention, backup, and incident escalation. Use the Security Rule risk analysis to identify risks across systems and transmission paths, then implement and periodically review safeguards appropriate to those risks. HHS risk analysis guidance emphasizes that the analysis should cover all ePHI the organization creates, receives, maintains, or transmits.

For a TDM lab, sound HIPAA practices start with determining whether the lab is a covered entity or business associate, then mapping PHI through testing and reporting workflows. Use appropriate safeguards, manage access and requests carefully, formalize vendor relationships when required, and respond promptly to suspected incidents under the applicable breach notification requirements.

FAQs

Are therapeutic drug monitoring labs covered entities under HIPAA?

Some are, but not automatically all. A lab that is a health care provider is generally a HIPAA covered entity if it electronically conducts a transaction for which HHS has adopted a standard, such as certain electronic billing transactions. A third party conducting the transaction on the lab’s behalf may also count. HHS’s covered entities guidance explains the criteria.

When does a TDM lab need a business associate agreement?

A covered lab generally needs a BAA when it engages an outside organization to perform a covered function or service on the lab’s behalf involving PHI, such as maintaining ePHI in a cloud system. A BAA is not required simply to disclose PHI to another health care provider for treatment, including a lab’s treatment-related disclosure to a reference laboratory. HHS’s Business Associate FAQs describe both the general requirement and the treatment exception.

Can a lab share TDM results with a prescribing clinician?

Yes. HIPAA generally permits a covered lab to disclose PHI to a prescribing clinician for treatment without patient authorization, subject to the Privacy Rule and any other applicable laws. The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment purposes. HHS’s treatment disclosure guidance explains this permission.

What should a lab do after discovering a potential HIPAA breach?

Contain the incident where feasible, preserve relevant evidence, notify the responsible privacy and security personnel, and promptly assess what happened and whether unsecured PHI was compromised. Document the assessment and follow the applicable BAA and HIPAA breach notification requirements. If the lab is a covered entity and a breach is confirmed, required notices generally must be provided without unreasonable delay and no later than 60 calendar days after discovery. HHS’s Breach Notification Rule guidance provides the reporting details.