HIPAA Compliance Requirements for a Movement Disorders Deep Brain Stimulation Program

Which HIPAA rules apply to a deep brain stimulation program?

HIPAA obligations depend on the legal organization operating the program, not on deep brain stimulation (DBS) as a specialty. A hospital, clinic, or physician practice is generally a covered entity if it furnishes health care and electronically conducts a transaction for which HHS has adopted a standard, such as submitting claims. A department within a covered hospital usually follows the hospital’s HIPAA program rather than qualifying as a separate covered entity. See the HHS overview of covered entities.

The core requirements include the HIPAA Privacy Rule, which governs protected health information (PHI) in any form; the Security Rule, which applies to electronic protected health information (ePHI); and the Breach Notification Rule, which applies to breaches of unsecured PHI. Business associates that handle PHI for the covered organization also have applicable HIPAA obligations. The HHS Privacy Rule summary explains who is covered and what information is protected.

For a DBS program, PHI may include identifiable candidacy assessments, diagnoses, imaging, operative records, programming settings, device-related follow-up, adverse-event reports, billing information, and communications with patients or caregivers. These details are PHI when they relate to a person’s health, care, or payment for care and identify—or could reasonably identify—that person.

How does the Privacy Rule govern patient information and disclosures?

The Privacy Rule generally permits a covered entity to use or disclose PHI when the Rule allows or requires it, or when the patient has provided any authorization the Rule requires. A DBS team may generally use or share relevant information for treatment, payment, and health care operations—for example, coordinating care among clinicians, submitting a claim, or conducting quality improvement—subject to applicable limits and safeguards. See HHS guidance on treatment, payment, and health care operations.

Apply the minimum necessary standard to most uses, disclosures, and requests for PHI used for payment or health care operations. It does not apply to disclosures to, or requests by, a health care provider for treatment purposes. For other uses, the program should use role-based access and limit information to what is needed for the task. The HHS minimum necessary guidance explains this distinction.

Make the organization’s Notice of Privacy Practices available as required, follow its stated practices, and support patient rights such as requesting access to or amendment of information in the designated record set. Route requests, complaints, and proposed disclosures through the organization’s privacy process, especially when information is sought for purposes beyond routine care, payment, or operations. The Privacy Rule summary describes these obligations and patient rights.

What Security Rule safeguards protect electronic protected health information?

The Security Rule requires administrative, physical, and technical safeguards that protect ePHI’s confidentiality, integrity, and availability. The program should work within the covered organization’s documented security program and account for the systems and workflows through which DBS information is created, received, maintained, or transmitted. The HHS Security Rule summary describes the safeguards.

• Administrative safeguards: Conduct and document a risk analysis; manage identified risks; assign security responsibility; authorize workforce access according to role; review system activity; train the workforce on security policies; respond to incidents; and prepare for emergencies that could affect ePHI.
• Physical safeguards: Control access to facilities and systems, protect workstations used to view or manage ePHI, and govern the movement, reuse, and disposal of devices or media containing ePHI.
• Technical safeguards: Use access controls, audit controls, integrity protections, authentication procedures, and transmission security to help prevent unauthorized access, alteration, or disclosure.

The Security Rule includes both required and addressable implementation specifications. “Addressable” does not mean automatically optional: the organization must assess whether the specification is reasonable and appropriate in its environment and, if it is not, document that decision and use an appropriate alternative when reasonable. See the current eCFR administrative safeguards and eCFR technical safeguards.

When are business associate agreements required and what should they cover?

A business associate is generally a person or organization outside the covered entity’s workforce that performs a service or function on the entity’s behalf involving PHI. Depending on its role and access, a vendor that hosts DBS records, supports remote monitoring, provides data analysis, or manages a system containing patient information may be a business associate. A vendor that does not handle PHI on the organization’s behalf is not automatically one. HHS explains the relationship in its business associate guidance.

Before permitting a business associate to create, receive, maintain, or transmit PHI on its behalf, the covered entity generally must obtain satisfactory written assurances through a business associate agreement (BAA) or other permitted written arrangement. A treating clinician or provider receiving information to provide care is not automatically a business associate merely because the parties share PHI for treatment.

The BAA should define permitted and required uses and disclosures; prohibit other uses or disclosures except as allowed by the agreement or law; require appropriate safeguards; require reporting of impermissible uses, disclosures, and security incidents; and address assistance with relevant patient requests and the covered entity’s compliance obligations. It should also require suitable protections for subcontractors and address returning or destroying PHI when the relationship ends, when feasible. HHS provides the required elements in its business associate contract guidance.

How must the program respond to a suspected breach?

Do not assume every alert or security incident is a reportable breach, but promptly route suspected incidents through the organization’s response process. Contain the issue where feasible, preserve relevant records and logs, notify the privacy or security official, and document the investigation, decisions, and mitigation. The Security Rule requires regulated entities to identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and their outcomes. See the HHS Security Rule summary.

An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised through a documented assessment. That assessment considers the nature and extent of the information, who received or used it, whether it was actually acquired or viewed, and the extent of mitigation. The HHS Breach Notification Rule guidance explains the assessment and notification requirements.

For a breach requiring notification, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. It must also notify HHS; for a breach affecting fewer than 500 individuals, reporting to HHS may generally be submitted annually, no later than 60 days after the end of the calendar year in which the breach was discovered. A breach affecting 500 or more residents of a state or jurisdiction also requires notice to prominent media outlets serving that area. See the eCFR individual-notification provision and HHS notification guidance.

What workforce policies, training, and sanctions are required?

Maintain written privacy and security policies that explain permitted access and disclosures, safe handling of paper and electronic records, incident reporting, patient-request procedures, and escalation contacts. The organization should designate a privacy official and a contact for complaints; the Security Rule also requires a designated security official. See the eCFR Privacy Rule administrative requirements and eCFR Security Rule administrative safeguards.

Train workforce members on privacy policies and procedures as appropriate to their functions, and provide security awareness and training. Privacy training is required for new workforce members within a reasonable period after joining and for affected workforce members within a reasonable period after a material policy change; the regulation does not set a universal annual certificate-renewal requirement. Document required training and make sure it reflects employer-specific policies for DBS workflows, systems, and disclosures.

Apply appropriate workforce sanctions when personnel fail to follow privacy or security policies. Procedures should explain how concerns are reported, reviewed, and handled consistently, and the program should document relevant actions. The Security Rule specifically requires a sanction policy, while the Privacy Rule requires appropriate sanctions for workforce members who violate its requirements. See the eCFR Security Rule provision and eCFR Privacy Rule provision.

In short, a DBS program should determine its organization’s covered-entity status, protect PHI under the Privacy Rule, safeguard ePHI under the Security Rule, formalize relevant vendor relationships through BAAs, and follow documented incident-response, training, and sanctions procedures.

FAQs

Does a movement disorders program qualify as a HIPAA covered entity?

Not necessarily as a separate program. Covered-entity status generally depends on whether the legal organization is a health plan, health care clearinghouse, or health care provider that conducts a standard electronic transaction. A DBS service within a covered hospital or clinic generally operates under that organization’s HIPAA program. See the HHS covered-entity overview.

What information from deep brain stimulation care is protected health information?

Identifiable information relating to a patient’s health, care, or payment for care is PHI. For DBS, that can include evaluations, diagnoses, imaging, surgical records, device settings, programming and follow-up notes, and related billing or communications. PHI is protected in electronic, paper, and oral form; ePHI is the electronic form. See the HHS Privacy Rule summary.

When must a program notify patients about a breach?

When the covered entity determines that a breach of unsecured PHI requiring notification occurred, it must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Other notices may also be required, depending on the number of affected individuals and circumstances. See the HHS Breach Notification Rule guidance.

What must a business associate do after a security incident?

A business associate must follow its BAA’s incident-reporting requirements and report security incidents it becomes aware of as specified in the agreement. If it discovers a breach of unsecured PHI, it must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the BAA may set a shorter reporting deadline. See the eCFR business associate notification provision and HHS BAA guidance.