HIPAA Compliance Guide for Tongue-Tie and Frenotomy Clinics

Tongue-tie and frenotomy clinics handle sensitive information in patient records, referral communications, billing systems, and clinical photographs. A practical HIPAA program helps you protect that information across the full care process—not just inside the exam room.

What HIPAA requires of tongue-tie and frenotomy clinics

A clinic’s specialty does not by itself determine whether HIPAA applies. A healthcare provider is generally a HIPAA covered entity if it conducts certain standard electronic transactions, such as submitting claims electronically. Covered entities must follow applicable HIPAA rules for protected health information (PHI). The HHS overview of covered entities explains which providers fall within the rules.

The HIPAA Privacy Rule governs how covered clinics use and disclose PHI, while the HIPAA Security Rule establishes safeguards for electronic protected health information (ePHI). The HIPAA Breach Notification Rule addresses notice after certain breaches of unsecured PHI. These rules apply to information handled in clinical notes, intake forms, patient images, billing records, email, and other systems.

For routine care, the Privacy Rule generally permits a clinic to use or disclose PHI for treatment, payment, and healthcare operations without a separate patient authorization, subject to applicable limits and safeguards. Disclosures for other purposes may require authorization or another permitted basis. Review the HHS guidance on treatment, payment, and healthcare operations.

HIPAA compliance is an ongoing organizational responsibility, not a certificate or a one-time staff training event. Establish written policies, assign responsibility for privacy and security, train your workforce on clinic procedures, and revisit safeguards as workflows and technology change.

How to conduct a HIPAA risk analysis for clinical workflows

The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough risk analysis of potential risks and vulnerabilities to ePHI. For a frenotomy clinic, that means looking at how information moves through actual clinical workflows—not only reviewing the electronic health record. See the HHS risk analysis guidance and the current eCFR administrative safeguards requirements.

1. Map where ePHI is created, received, stored, and transmitted. Include scheduling and intake tools, the EHR, clinical photographs, referrals, billing, email, text messaging, telehealth, backups, and staff devices used for clinic work.
2. Identify threats and vulnerabilities. Consider misdirected messages, unauthorized access, lost devices, weak passwords, phishing, ransomware, unattended screens, and vendors’ access to records or images.
3. Assess likelihood and potential impact. Consider what information could be exposed or changed, how many patients may be affected, and the effect on confidentiality, integrity, and availability of the ePHI.
4. Record gaps and choose risk-management measures. Assign owners and target dates for actions such as revising access permissions, improving device controls, or changing how images are transferred.
5. Reassess when workflows or systems change. A new photo-storage service, messaging platform, or vendor can change the clinic’s risk profile and should prompt review.

Document the analysis and decisions. HIPAA does not prescribe one universal tool or checklist for every clinic; the analysis should reflect the clinic’s size, systems, workforce, and actual information flows.

How to protect patient records and electronic health information

The HIPAA Security Rule calls for administrative, physical, and technical safeguards that protect the confidentiality, integrity, and availability of ePHI. Use the risk analysis to select and document measures appropriate to your clinic. The HHS Security Rule summary explains the safeguard framework.

• Administrative safeguards: Assign security responsibilities, maintain written procedures, train workforce members, limit access according to job duties, and establish processes for reporting and addressing incident-response procedures.
• Physical safeguards: Secure rooms and workstations where records are accessed, prevent unauthorized viewing of screens, control access to devices, and dispose of media and paper records securely.
• Technical safeguards: Use individual user accounts, appropriate access controls, and mechanisms to track system activity. Consider secure transmission, backups, and device protections as part of your risk-management plan.

Do not treat a particular technology as a substitute for a risk analysis. For example, encryption is an important safeguard to assess, but the Security Rule’s implementation specifications distinguish required and addressable measures; addressable does not mean optional without assessment and documentation. The applicable technical requirements are set out in the eCFR technical safeguards provisions.

Apply these protections to images as well as text records. Store clinical photo content in an approved, access-controlled location, connect it to the correct patient record, and avoid saving or sending it through personal devices or consumer apps unless the clinic has assessed and approved the workflow.

When patient authorization is needed to share treatment photos

A clinical photo linked to an identifiable patient and their care can be PHI. A clinic should not assume that permission to take a photo for diagnosis or treatment also allows the clinic to post it on a website, social media account, or promotional material.

Using or disclosing identifiable patient photos for marketing generally requires the patient’s prior written HIPAA authorization, unless a specific exception applies. The authorization should describe the information and intended use or disclosure, identify who may use or receive it, and include the other required elements. Consult the HHS marketing guidance and 45 CFR § 164.508.

Keep authorization separate from consent for treatment, make the requested use clear, and follow the rules for a valid authorization, including its expiration and revocation provisions. For a minor, obtain authorization from the person legally authorized to act for the child, consistent with applicable law. State privacy and consent requirements may impose additional rules.

Photos used within permitted treatment or healthcare operations may not require a separate HIPAA authorization, depending on the use and circumstances. If an image is properly de-identified under HIPAA, it is no longer PHI under the Privacy Rule’s de-identification standard; take care that faces, metadata, or surrounding details do not identify the patient.

How business associate agreements apply to clinic vendors

A vendor may be a business associate when it creates, receives, maintains, or transmits PHI on the clinic’s behalf as part of a service. Examples can include an EHR or cloud-storage provider, a billing service, a transcription company, or an IT contractor whose work involves access to PHI. A software vendor that never accesses PHI is not automatically a business associate merely because it sells software. Use the service’s actual access and role to assess the relationship.

Before allowing a business associate to handle PHI, the clinic generally needs a written business associate agreement (BAA) meeting HIPAA requirements. The agreement addresses permitted uses and disclosures, safeguards, incident reporting, and other required responsibilities. A vendor’s statement that it is “HIPAA compliant” does not replace the required agreement or the clinic’s own assessment. See HHS guidance on business associates and its sample BAA provisions.

Review vendor access when services change or end, and confirm that subcontractors handling PHI are addressed through the appropriate agreements. A clinic remains responsible for its own HIPAA obligations when it uses outside services.

How to respond to a suspected breach of patient information

When you suspect that PHI has been accessed, used, or disclosed improperly, act promptly. Follow your incident-response procedures, notify the clinic’s designated privacy or security lead, contain the issue where possible, and preserve relevant records such as access logs, emails, and device information. Avoid deleting evidence or making unsupported assurances before the facts are assessed.

Determine what information was involved, whose information may have been affected, who may have accessed or received it, and what steps can reduce further exposure. Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity or business associate documents a risk assessment showing a low probability that the PHI was compromised, or an applicable exception applies.

If notification is required, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting 500 or more individuals also require notice to HHS within that timeframe; breaches affecting fewer than 500 individuals are reported to HHS annually, within 60 days after the end of the calendar year in which they were discovered. A business associate must notify the covered entity under the applicable rule and agreement. State law or the contract may impose shorter deadlines. Review the HHS Breach Notification Rule guidance.

Document the investigation, risk assessment, response, and any required notices. In short, protect PHI through a documented risk analysis, appropriate safeguards, careful vendor agreements, and a clear response process for suspected incidents.

FAQs

Can a frenotomy clinic share before-and-after photos without patient authorization?

Generally, not when the patient is identifiable and the photos are used for marketing or promotion. Obtain a valid written HIPAA authorization before that use or disclosure, unless a specific exception applies. A treatment-photo consent is not automatically a marketing authorization.

What safeguards protect electronic patient records in a tongue-tie clinic?

Use safeguards appropriate to your risk analysis, including role-based access, individual user accounts, workforce training, secure workstations and devices, monitoring of system activity, and suitable backup and transmission protections. The Security Rule requires administrative, physical, and technical safeguards for ePHI.

Which clinic vendors require a business associate agreement?

Vendors that handle PHI on the clinic’s behalf may require a BAA—for example, an EHR host, cloud-storage provider, billing service, transcription vendor, or IT contractor with access to PHI. A vendor that provides software without access to PHI is not automatically a business associate. Assess the actual service and access involved.

What should a clinic do after discovering a potential HIPAA breach?

Promptly contain the incident where possible, preserve evidence, notify the clinic’s privacy or security lead, investigate what information and patients may be affected, and document the breach risk assessment. If notification is required, follow HIPAA deadlines and any applicable state-law and contract requirements.