HIPAA Compliance Requirements for a Peritoneal Surface Malignancy Program

What PHI does a peritoneal surface malignancy program need to protect?

A program that is a HIPAA covered entity must protect individually identifiable health information it holds or transmits in any form—electronic, paper, or oral. Protected health information (PHI) includes information that relates to a person’s health, care, or payment for care and identifies them, or could reasonably be used to identify them. HHS’s Summary of the HIPAA Privacy Rule explains the scope of PHI.

For a peritoneal surface malignancy program, PHI may include a patient’s diagnosis, pathology, imaging, operative and chemotherapy records, treatment plan, appointments, referrals, and billing details when linked to identifying information. The same protections apply to conversations and records about a patient’s evaluation, treatment, and follow-up—not only to information labeled “confidential.”

Electronic protected health information (ePHI) includes PHI created, received, maintained, or transmitted electronically, such as information in the electronic health record, imaging systems, scheduling and billing software, secure messages, and backups. The Security Rule requires appropriate safeguards for ePHI; the Privacy Rule protects PHI in all forms. HHS’s overview of the HIPAA Security Rule describes this distinction.

How should workforce access follow the minimum necessary standard?

Set access according to job duties and the information needed for those duties. For example, scheduling staff may need contact and appointment information, while clinicians coordinating a patient’s care may need relevant clinical records. Use role-based permissions, unique user accounts, timely access changes when responsibilities shift, and periodic reviews to reduce unnecessary access.

The minimum necessary standard generally requires reasonable efforts to limit uses, disclosures, and requests for PHI to what is needed for the intended purpose. However, HIPAA expressly exempts disclosures to, and requests by, a health care provider for treatment purposes from this standard. HHS notes that a hospital may allow clinicians involved in treatment access to a complete medical record when needed. This does not eliminate the value of appropriate workforce access policies and safeguards. HHS guidance on the minimum necessary requirement explains the rule and its exceptions.

Train workforce members on the program’s own access and privacy procedures, including how to handle records for multidisciplinary tumor boards, referrals, research requests, and communications with outside clinicians. Treatment access does not automatically authorize access for unrelated purposes, such as curiosity or personal reasons.

What administrative, technical, and physical safeguards protect ePHI?

The HIPAA Security Rule requires appropriate administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of ePHI. It is flexible: safeguards should reflect the organization’s size, systems, capabilities, and risks. HHS’s Security Rule overview describes the general requirements.

• Administrative safeguards: Conduct and document a security risk analysis; manage identified risks; assign security responsibilities; maintain workforce security and training procedures; respond to security incidents; and plan for backups and emergencies.
• Technical safeguards: Use access controls and authentication, review system activity through audit controls, protect ePHI from improper alteration or destruction, and safeguard ePHI transmitted over electronic networks.
• Physical safeguards: Control access to facilities and workstations; establish rules for workstation use and security; and manage devices and media, including their movement, reuse, and disposal.

These are categories of safeguards, not a one-size-fits-all checklist of products. Document why selected measures are reasonable for the risks identified, address gaps, and reassess as systems and workflows change. HHS guidance on Security Rule risk analysis provides further direction.

How should the program assess and document a suspected breach?

Promptly route suspected loss, misdirected communications, unauthorized access, or other impermissible uses or disclosures to the organization’s privacy or security lead. Preserve relevant records, including access logs and communications; limit further exposure; and follow the organization’s incident-response procedures. A suspected event is not automatically a reportable breach, but it should be assessed and documented.

An impermissible use or disclosure of PHI is generally presumed to be a breach unless an exception applies or the organization demonstrates, through a risk assessment, a low probability that the PHI was compromised. The breach risk assessment must consider at least the nature and extent of the PHI and the likelihood of re-identification, who used or received it, whether it was actually acquired or viewed, and the extent to which risk was mitigated. HHS’s Breach Notification Rule guidance describes the presumption, exceptions, and assessment factors.

Record the facts, assessment, mitigation, decision, and any required notifications. If the organization determines notification is not required, document the basis, such as the risk assessment or an applicable exception. Keep incident documentation under the organization’s retention and compliance procedures.

What breach notification deadlines apply to affected individuals and regulators?

For a breach of unsecured PHI, affected individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. Notice generally must describe what happened and the information involved, explain steps individuals can take, summarize the organization’s investigation and mitigation, and provide contact information. HHS’s notification guidance summarizes required notices and timelines.

For breaches affecting 500 or more individuals, the covered entity must notify the HHS Secretary without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting fewer than 500 individuals, the covered entity may report to HHS on an annual basis, but no later than 60 days after the end of the calendar year in which the breach was discovered. HHS’s breach-reporting instructions explain the reporting thresholds and deadlines.

These are outer limits, not a reason to delay. Coordinate promptly with the organization’s privacy officer, legal counsel, and relevant leadership so the investigation and any required notices proceed without unreasonable delay.

When are business associate agreements and media notifications required?

A business associate agreement is generally required when a vendor or other person or organization performs a covered function or service involving PHI on behalf of the covered entity. Examples may include certain cloud, billing, transcription, or data-support providers, depending on what they do and how they handle PHI. The agreement must address permitted uses and disclosures, safeguards, incident and breach reporting, and applicable subcontractor requirements. HHS guidance on business associates explains when these relationships and agreements apply.

If a business associate discovers a breach of unsecured PHI, it must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The agreement may require a shorter reporting period and should clarify what information the business associate must provide to support the covered entity’s investigation and notifications.

A covered entity must notify prominent media outlets serving a state or jurisdiction when a breach of unsecured PHI affects more than 500 residents of that state or jurisdiction. The media notice is due without unreasonable delay and no later than 60 calendar days after discovery. This threshold is based on residents of the state or jurisdiction, not simply the total number of people affected across all locations. HHS’s Breach Notification Rule guidance explains media-notification requirements.

In short, a program should protect PHI in every form, give workforce members appropriate access, maintain safeguards suited to its risks, document incident decisions, and meet any applicable notification deadlines.

FAQs.

Can treatment staff access a patient’s full medical record when needed?

Yes. HIPAA exempts provider requests for, and disclosures to providers of, PHI for treatment from the minimum necessary standard. HHS explains that clinicians involved in treatment may be given access to the full record when needed. The organization should still maintain appropriate access controls and policies for its workforce.

What factors determine whether an impermissible disclosure is a reportable breach?

An impermissible use or disclosure is generally presumed to be a breach unless an exception applies or a documented risk assessment demonstrates a low probability that the PHI was compromised. The assessment considers the nature and extent of the information, who received or used it, whether it was actually acquired or viewed, and how effectively the risk was mitigated.

How soon must affected individuals be notified of a breach?

Without unreasonable delay and, in all cases, no later than 60 calendar days after discovery of a breach of unsecured PHI.

When must a breach be reported to HHS and prominent media outlets?

Report a breach affecting 500 or more individuals to HHS without unreasonable delay and no later than 60 calendar days after discovery. For fewer than 500 individuals, report to HHS no later than 60 days after the end of the calendar year in which the breach was discovered. Notify prominent media outlets serving a state or jurisdiction when the breach affects more than 500 residents of that state or jurisdiction; that notice is also due without unreasonable delay and no later than 60 calendar days after discovery.