HIPAA Compliance Requirements for a Disorders of Consciousness Program

Which disorders of consciousness programs must comply with HIPAA?

HIPAA compliance depends on the organization’s role, not on whether it serves people with disorders of consciousness. A program must follow the HIPAA Rules if it is part of a covered entity—such as a health care provider that conducts certain standard transactions electronically—or operates as a business associate handling protected health information (PHI) for a covered entity.

For example, a disorders of consciousness program operated by a hospital or rehabilitation provider may fall under the provider’s HIPAA obligations. A provider that does not conduct covered electronic transactions may not be a covered entity on that basis alone. Determine the status of the organization and any separate legal entities rather than assuming every program has the same obligations. See HHS guidance on covered entities and business associates.

A vendor or other organization that creates, receives, maintains, or transmits PHI for a covered entity may be a business associate. The covered entity generally must have a written business associate agreement (BAA) or other permitted written arrangement that sets out the vendor’s responsibilities for protecting PHI. The business associate also has direct obligations under certain HIPAA provisions.

How does HIPAA define and protect patient information?

The HIPAA Privacy Rule protects individually identifiable health information held or transmitted by a covered entity or its business associate, whether it is electronic, on paper, or spoken. Information is identifiable when it relates to a person’s health or health care and identifies the person—or could reasonably be used to identify them. In a disorders of consciousness program, a patient’s diagnosis, clinical observations, imaging, treatment plan, or care notes may be PHI when linked to identifying information.

The HIPAA Security Rule applies specifically to electronic protected health information (ePHI). It requires covered entities and business associates to protect the confidentiality, integrity, and availability of ePHI. Paper and oral information remains subject to the Privacy Rule even though it is not ePHI. See HHS’s Summary of the HIPAA Privacy Rule and HHS’s Summary of the HIPAA Security Rule.

When may a program use or disclose protected health information?

A covered program may generally use or disclose PHI without a separate authorization for treatment, payment, and health care operations. Other disclosures may be permitted or required by law, but the program should confirm that the applicable HIPAA conditions are met. When the Privacy Rule’s minimum-necessary standard applies, the program must limit the information used or disclosed to what is reasonably needed for the purpose; that standard does not apply to every type of disclosure, including certain treatment disclosures.

A program may share relevant information with family members or other people involved in a patient’s care when the patient agrees, does not object after having an opportunity to do so, or—if the patient is incapacitated or unavailable—the provider determines using professional judgment that sharing is in the patient’s best interests. The disclosure should be limited to information relevant to that person’s involvement. A relative is not automatically the patient’s personal representative: that status generally depends on authority under applicable law. See HHS guidance on family access to PHI.

For uses or disclosures that are not otherwise permitted or required, the program generally needs the patient’s valid written authorization. If a vendor performs a covered service involving PHI, the program should assess whether the vendor is a business associate and whether a BAA is required.

What safeguards protect electronic protected health information?

The HIPAA Security Rule requires administrative, physical, and technical safeguards for ePHI. It does not prescribe one identical set of technologies for every program. A program must select and maintain reasonable and appropriate measures in light of its risks, size, resources, and technical environment.

• Administrative safeguards: Conduct and document a risk analysis; manage identified risks; assign security responsibility; train workforce members on security policies; control workforce access; and maintain procedures for security incidents and emergencies.
• Physical safeguards: Control access to facilities and systems, protect workstations and devices, and manage electronic media that stores or carries ePHI.
• Technical safeguards: Use appropriate access controls, authentication, audit controls, integrity protections, and transmission security to help prevent unauthorized access, changes, or disclosures.

These are examples of safeguards, not a substitute for assessing the program’s actual systems and risks. HHS explains the requirements and the risk-analysis process in its Security Rule summary and risk-analysis guidance.

What patient rights and privacy notices must programs provide?

Most covered health care providers and health plans must provide a Notice of Privacy Practices (NPP) explaining how PHI may be used or disclosed, the individual’s privacy rights, the covered entity’s duties, and how to raise a question or complaint. The notice must be in plain language, made available to people who ask for it, and posted on the entity’s website when the website provides information about its customer services or benefits. See HHS guidance on the Notice of Privacy Practices.

HIPAA gives individuals rights that include accessing and obtaining copies of their PHI, requesting an amendment, requesting restrictions on certain uses or disclosures, and asking for confidential communications. The Rule also provides a right to an accounting of certain disclosures. A covered entity generally does not have to agree to every requested restriction, although specific requirements apply in some circumstances. Individuals may also complain to the covered entity or HHS if they believe their rights have been violated.

If a patient cannot exercise these rights, the program should determine whether someone is authorized to act as the patient’s personal representative under applicable law. A family relationship alone does not necessarily establish that authority. HIPAA generally treats an authorized personal representative as the individual for relevant rights, subject to exceptions such as concerns about abuse, neglect, or endangerment.

How must programs respond to a breach of unsecured protected health information?

When a covered entity or business associate discovers an impermissible use or disclosure of PHI, it must assess whether it is a breach under the HIPAA Breach Notification Rule. A breach is generally presumed unless an exception applies or a documented risk assessment shows a low probability that the PHI was compromised. The notification requirements apply to breaches involving unsecured PHI.

A covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. It must also notify HHS. For a breach affecting 500 or more individuals, notice to HHS is due without unreasonable delay and within 60 days; for a breach affecting fewer than 500 individuals, the covered entity may report it annually, no later than 60 days after the end of the calendar year in which it was discovered. A breach affecting more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area.

A business associate that discovers a breach must notify the covered entity without unreasonable delay and no later than 60 days after discovery, subject to any more specific deadline in its BAA. The covered entity remains responsible for ensuring that required individual notifications are made. See HHS’s Breach Notification Rule guidance.

Which additional federal and state laws may apply?

HIPAA may not be the only privacy or confidentiality requirement. If a program is subject to federal substance use disorder confidentiality rules, 42 CFR Part 2 may apply to the relevant records. The Part 2 rules protect records of federally assisted programs that provide substance use disorder diagnosis, treatment, or referral for treatment. The updated rule’s compliance date was February 16, 2026. See HHS’s Part 2 guidance.

If the program conducts or supports human-subjects research, the Common Rule or other research protections may apply depending on the activity and its federal oversight or support. HIPAA also has specific provisions governing research uses and disclosures of PHI. See HHS guidance on HIPAA and research and HHS information about the Common Rule.

State privacy and medical-record laws may provide greater privacy protections or rights than HIPAA, and certain more stringent state provisions may not be preempted. State law may also determine who is authorized to act for an incapacitated patient. Programs should review the requirements for every state in which they operate or provide care. See HHS guidance on more stringent state privacy laws.

In practice, a program should first determine whether it is a covered entity or business associate, then apply the Privacy Rule, Security Rule, and breach notification requirements to the information and activities in its care setting. It should also identify any additional federal or state protections that apply to its patients, records, vendors, and research activities.

FAQs.

Does HIPAA apply to every disorders of consciousness program?

No. HIPAA applies based on the organization’s status as a covered entity or business associate, not simply because it serves people with disorders of consciousness. A health care provider generally qualifies as a covered entity if it conducts certain standard transactions electronically. A program’s relationship to a hospital or other covered entity, and its handling of PHI, may also determine its obligations.

Can a program share patient information with family members?

Sometimes. A program may share information relevant to a family member’s involvement in care when the patient agrees, does not object after an opportunity to do so, or is incapacitated or unavailable and the provider determines that sharing is in the patient’s best interests. A family member does not automatically have full access or personal-representative authority; that authority generally depends on applicable law.

What safeguards must a program use to protect electronic health information?

The HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards for ePHI. The program must assess risks and implement reasonable and appropriate protections, which may include role-based access, workforce training, facility and device protections, authentication, audit controls, and security-incident procedures. The exact safeguards depend on the program’s risk analysis and environment.

When must a program report a breach of unsecured protected health information?

A covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a reportable breach. HHS notice is due within 60 days for breaches affecting 500 or more individuals; breaches affecting fewer than 500 may be reported annually, by 60 days after the calendar year ends. A breach affecting more than 500 residents of a state or jurisdiction also requires media notice. A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery.