HIPAA Compliance Requirements for a Hereditary Angioedema Center

When Does a Hereditary Angioedema Center Qualify as a HIPAA Covered Entity?

A hereditary angioedema (HAE) center is not automatically a HIPAA covered entity just because it provides medical care or keeps patient records. Under the covered entity definition, a center is covered if it is a health plan, a health care clearinghouse, or a health care provider that conducts certain standard health care transactions electronically. These transactions include electronic claims and eligibility inquiries. A provider may qualify whether it conducts transactions itself or uses a billing service to do so. HHS guidance on covered entities and business associates.

Sending an email or using electronic records alone does not make a provider a covered entity; the relevant question is whether the provider conducts an electronic transaction for which HHS has adopted a standard. If the center is not a covered entity, it may still have HIPAA duties if it performs services involving protected health information (PHI) on behalf of a covered entity as a business associate. Other federal or state privacy requirements may also apply.

How HIPAA Applies to HAE Patient Records and Treatment Disclosures

When HAE records identify a patient, information about the patient’s diagnosis, symptoms, treatment, medications, family history, tests, or payment for care will generally be PHI if held or transmitted by a covered entity or its business associate. Electronic versions of that information are electronic protected health information, or ePHI. HIPAA protections apply to PHI in electronic, paper, and oral form—not only to electronic records. HHS guidance on protected health information.

A covered HAE center may generally use or disclose PHI for treatment, payment, and its own health care operations without obtaining a patient’s HIPAA authorization. For example, the center may share relevant records with another provider for treatment, or submit information needed to process a claim. A disclosure for a purpose not otherwise permitted or required by the Privacy Rule generally requires a valid written authorization. An authorization is more specific than general consent and must meet HIPAA’s requirements. HHS guidance on treatment, payment, and health care operations; HHS explanation of consent and authorization.

The minimum necessary standard generally requires reasonable efforts to limit PHI uses, disclosures, and requests to what is needed for the purpose. It does not apply to disclosures to, or requests by, a health care provider for treatment, disclosures to the patient, or uses and disclosures made pursuant to an individual’s authorization, among other exceptions. For payment and operations, the center should use policies and role-based access to limit information appropriately. HHS guidance on the minimum necessary requirement.

What Safeguards Protect Electronic Protected Health Information?

The HIPAA Security Rule requires covered entities and business associates to protect ePHI’s confidentiality, integrity, and availability using administrative, physical, and technical safeguards. The rule is flexible: safeguards should be reasonable and appropriate to the organization’s size, systems, and risks, rather than based on a one-size-fits-all checklist. HHS summary of the HIPAA Security Rule.

• Administrative safeguards: Assign security responsibility, manage workforce access, address security incidents, train the workforce, maintain contingency plans, and perform a HIPAA Security Rule risk analysis.
• Physical safeguards: Control access to facilities and workstations, and manage devices and media that can store or access ePHI.
• Technical safeguards: Use appropriate access controls and technical measures to protect ePHI in information systems and during transmission.

A HIPAA Security Rule risk analysis must be accurate and thorough. The center should identify where ePHI is created, received, maintained, or transmitted; identify reasonably anticipated threats and vulnerabilities; assess existing security measures; and consider the likelihood and potential impact of risks to ePHI. The findings should inform risk management decisions and be documented. HHS guidance on conducting a risk analysis.

Which Workforce Policies and Training Are Required?

A covered center must establish and implement written privacy policies and procedures, designate a privacy official, and train workforce members on the policies relevant to their duties. Workforce members may include employees, volunteers, trainees, and others whose conduct is under the center’s direct control. The center must also apply appropriate sanctions when workforce members violate its privacy policies or the Privacy Rule. HHS summary of the HIPAA Privacy Rule.

The Security Rule also requires security awareness and training for workforce members, with policies and procedures that address ePHI access and security. Training should reflect each person’s role—for example, how clinicians handle records and messages, how administrative staff manage disclosures, and how staff report suspected phishing or misdirected information. HIPAA does not establish a universal federal requirement for every employee to renew a training certificate annually; centers should follow applicable rules, their own policies, and any employer-specific training requirements. HHS Security Rule guidance.

How Should HAE Centers Manage Business Associate Agreements and Incidents?

A vendor or other organization may be a business associate if it creates, receives, maintains, or transmits PHI while performing services for a covered center. Examples can include billing services, practice-management providers, and cloud service providers that handle ePHI on the center’s behalf. Before sharing PHI for such services, the center generally must have a written business associate agreement (BAA) or other compliant written arrangement. Business associates may also have direct obligations under HIPAA. HHS guidance on business associates.

A BAA should address the business associate’s permitted uses and disclosures of PHI, required safeguards, reporting of incidents or breaches, and applicable obligations for subcontractors. The center should identify which vendors handle PHI, confirm that the contract fits the services being provided, and maintain a process for reviewing and updating agreements when services or data flows change. For cloud services that create, receive, maintain, or transmit ePHI on the center’s behalf, HHS says the cloud service provider is generally a business associate even when the data is encrypted and the provider does not hold the decryption key. HHS guidance on HIPAA and cloud computing.

Not every security incident is automatically a reportable breach. The center should have a process to identify and respond to suspected or known incidents, mitigate harmful effects where practicable, and document the incident and its outcome. If PHI may have been accessed or disclosed impermissibly, the center should promptly investigate and determine whether breach notification is required.

What Steps Are Required to Assess and Report a Breach?

An impermissible use or disclosure of PHI is generally presumed to be a breach unless an applicable exception applies or the covered entity or business associate documents a risk assessment showing a low probability that the PHI was compromised. The HIPAA breach risk assessment must consider at least four factors:

• The nature and extent of the PHI involved, including identifiers and the likelihood of re-identification.
• The unauthorized person who used the PHI or received the disclosure.
• Whether the PHI was actually acquired or viewed.
• The extent to which the risk to the PHI was mitigated.

Document the facts gathered, the analysis, the conclusion, and any notification decisions. If the incident involves unsecured PHI and is a reportable breach, affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. This 60-day breach notification deadline is a maximum, not a standard waiting period. A business associate must notify the covered entity under the applicable HIPAA rule and contract; a BAA may require faster notice. HHS Breach Notification Rule guidance.

Covered entities must also notify HHS. For a breach affecting 500 or more individuals, notice to HHS is due without unreasonable delay and within 60 days after discovery; breaches affecting fewer than 500 individuals may generally be reported to HHS annually, within 60 days after the end of the calendar year in which they were discovered. A breach affecting more than 500 residents of a state or jurisdiction may also require notice to prominent media serving that area. HHS guidance on breach notification deadlines and reporting.

What HIPAA Exceptions and Limits Should Centers Consider?

HIPAA permits certain disclosures without an individual’s authorization, including disclosures for treatment, payment, and health care operations, as well as certain disclosures required by law or allowed for public health and other specified public-interest purposes. These permissions have conditions; a center should confirm that a particular disclosure fits the applicable rule and document it as appropriate. HHS summary of permitted uses and disclosures.

HIPAA also defines exceptions to the breach definition, including certain good-faith, unintentional access within a person’s authority and certain inadvertent disclosures between people authorized to access PHI, when the required conditions are met. The center should assess the facts rather than assume an incident qualifies for an exception. Properly de-identified information is not PHI under the Privacy Rule, but simply removing a patient’s name may not be enough to meet HIPAA’s de-identification standard. HHS breach guidance; HHS de-identification guidance.

HIPAA is a federal baseline, not necessarily the only privacy rule that applies. State law may provide stronger protections or additional patient rights, and applicable more stringent state requirements may take precedence. Because HAE centers may handle sensitive diagnostic and family information, they should check the laws and contracts relevant to their patients, services, and locations. HHS guidance on HIPAA and state laws.

In summary, an HAE center’s HIPAA obligations depend on its covered entity or business associate status, how it uses and shares patient information, and the systems that handle ePHI. Clear policies, role-appropriate training, a documented risk analysis, suitable business associate agreements, and a practiced incident-response process help the center protect records and meet its notification duties.

FAQs

Does every hereditary angioedema center have to comply with HIPAA?

No. An HAE center generally must comply if it is a health care provider that conducts certain standard transactions electronically, a health plan, or a health care clearinghouse. A center that does not meet a covered entity definition may still have HIPAA obligations if it acts as a business associate for a covered entity. HHS guidance on covered entities and business associates.

When is written authorization required to disclose HAE patient information?

A covered center generally needs a valid written authorization when a use or disclosure is not otherwise permitted or required by the Privacy Rule. Authorization is generally not required for disclosures for treatment, payment, or health care operations that meet HIPAA’s requirements, such as sharing information with another provider for treatment. HHS explanation of consent and authorization.

How soon must an HAE center notify patients after discovering a breach?

For a reportable breach of unsecured PHI, the center must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The deadline is a maximum; the center should not wait if it can provide required notice sooner. HHS Breach Notification Rule guidance.

What must a HIPAA risk analysis assess?

A Security Rule risk analysis must assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. It should identify where ePHI is stored, received, maintained, or transmitted; consider reasonably anticipated threats and vulnerabilities; assess existing safeguards; and evaluate the likelihood and potential impact of risks. HHS guidance on conducting a risk analysis.