HIPAA Compliance Requirements for an Inpatient Hospice House

HIPAA compliance for an inpatient hospice house involves more than protecting electronic charts. If the organization is a covered entity, it must protect patient information, respect privacy rights, train and oversee its workforce, manage vendors that handle protected health information (PHI), and respond appropriately to breaches. The exact safeguards should reflect the hospice’s services, systems, staffing, and risks.

Determine Covered-Entity Status

An inpatient hospice house is generally a health care provider. It is a HIPAA covered entity if it transmits health information electronically in connection with a transaction for which HHS has adopted a standard. Examples of HIPAA covered electronic transactions include electronic claims and eligibility inquiries. The hospice can meet this test by conducting the transaction itself or through a billing service or another party acting on its behalf. Sending ordinary email alone does not make a provider a covered entity.

Check how the hospice bills, verifies coverage, and conducts other standard transactions, including through any parent organization or outside vendor. A hospice that does not meet the provider test may still have HIPAA obligations in another role, such as a business associate. Document the analysis and revisit it if the organization changes its billing or operational arrangements.

Provide Privacy Notices and Patient Rights

Give patients a Notice of Privacy Practices (NPP) that explains how the hospice may use and disclose PHI, its privacy duties, patients’ rights, and how to ask questions or file a complaint. The notice should reflect the hospice’s actual practices and explain when written authorization is needed for uses or disclosures not otherwise permitted by HIPAA. Provide the notice as required, display it where patients can readily see it, and make it available upon request. If the hospice has a website, post it there.

For patients receiving care directly from the hospice, make a good-faith effort to obtain a written Notice of Privacy Practices acknowledgment showing receipt. A patient does not have to sign, and refusing to sign does not cancel the hospice’s ability to use or disclose information as HIPAA permits. If a patient declines, document the refusal; an emergency treatment situation is an exception to the request requirement. The acknowledgment records receipt, not consent to additional uses or disclosures.

Train staff to route requests about records, confidential communications, restrictions, and complaints to the appropriate person. In hospice settings, staff should also follow the patient’s preferences and applicable rules when discussing care with family members or other people involved in care.

Implement Administrative Physical and Technical Safeguards

The HIPAA Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards for electronic protected health information (ePHI). The hospice must protect ePHI’s confidentiality, integrity, and availability, guard against reasonably anticipated threats and impermissible access, and ensure workforce compliance. Safeguards should be based on a documented risk analysis and tailored to the organization’s size, systems, and risks—not copied from a generic checklist.

• Administrative safeguards: Assign security responsibilities, assess risks, manage identified risks, train workforce members, and establish procedures for reporting and responding to security incidents.
• Physical safeguards: Control access to facilities and work areas where systems are used; protect workstations and devices; and manage the movement, reuse, and disposal of equipment and electronic media.
• Technical safeguards: Use access controls, audit mechanisms, authentication, protections for data integrity, and transmission security suited to the hospice’s systems and risks.

For an inpatient hospice house, consider how visitors, shared work areas, bedside devices, handoffs, and after-hours access could expose ePHI. Practical electronic protected health information safeguards may include screen locks, secure messaging, encrypted connections, monitored access logs, and a process for promptly disabling accounts when staff leave or change roles. HIPAA calls for appropriate safeguards; it does not prescribe one universal technology for every organization.

Protect Records and Limit Workforce Access

Protect PHI in every form—electronic, paper, and spoken—against unauthorized access or disclosure. Store paper charts and printed reports securely, retrieve them promptly from shared areas, and dispose of them so patient information cannot be read by unauthorized people. Remind staff to avoid discussing a patient’s condition where visitors or other patients can overhear.

Apply the minimum necessary standard to most uses, disclosures, and requests for PHI: limit information to what is reasonably needed for the purpose. Establish role-based access controls so workforce members can access the records and functions needed for their duties, and review permissions when responsibilities change. The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment purposes; do not let it obstruct appropriate care coordination.

Execute Business Associate Agreements

Before allowing a vendor or other service provider to handle PHI on the hospice’s behalf, determine whether the relationship makes it a business associate. This may include providers of billing, cloud-hosting, records, or technology services when their work involves PHI. A written business associate agreement (BAA) is generally required when a business associate performs covered functions or services involving PHI for the hospice.

The BAA should define permitted and required uses and disclosures, require appropriate safeguards, address reporting of impermissible uses or disclosures and breaches, and require relevant subcontractors to protect PHI as well. It should also address the return or destruction of PHI when the relationship ends, where feasible. Keep an inventory of business associates, signed agreements, and the services each vendor provides.

Respond to Breaches of Unsecured PHI

Have a written process for receiving, escalating, investigating, documenting, and mitigating suspected incidents. An impermissible use or disclosure of PHI is generally presumed to be a breach unless the hospice establishes an applicable exception or demonstrates, through a risk assessment, a low probability that the PHI was compromised. HIPAA breach notification requirements apply to breaches involving unsecured PHI; encryption or destruction meeting HHS guidance can render information secured for this purpose.

For a breach requiring notice, notify affected individuals without unreasonable delay and no later than 60 days after discovery. Notice must describe the breach and information involved, steps people can take to protect themselves, the hospice’s response, and how to contact it. A breach affecting 500 or more individuals must also be reported to HHS without unreasonable delay and within 60 days; breaches affecting fewer than 500 individuals may be reported to HHS annually, no later than 60 days after the end of the calendar year in which they were discovered. If more than 500 residents of a state or jurisdiction are affected, notice to prominent media outlets in that area is also required.

If a breach occurs at or through a business associate, that business associate must notify the hospice without unreasonable delay and no later than 60 days after discovery. The hospice remains responsible for ensuring affected individuals receive any required notice. Document the investigation, risk assessment, notifications, and any decision that notification was not required.

In practice, an inpatient hospice house should regularly confirm its covered-entity status, keep its notice and patient-rights processes current, assess and manage security risks, limit access appropriately, maintain BAAs, and prepare to meet breach notification deadlines.

FAQs

When is an inpatient hospice house considered a HIPAA covered entity?

It is generally a covered entity if it is a health care provider that transmits health information electronically in connection with a HIPAA-standard transaction, such as submitting electronic claims. This can include transactions handled by a billing service on the hospice’s behalf.

What must a hospice include in its Notice of Privacy Practices?

The notice must explain permitted uses and disclosures of PHI, the hospice’s privacy duties, patients’ privacy rights, and how to contact the hospice or file a complaint. It should also explain when authorization is needed for other uses or disclosures and reflect the hospice’s practices.

How should an inpatient hospice house secure electronic protected health information?

It should conduct a risk analysis and implement appropriate administrative, physical, and technical safeguards. Depending on its systems and risks, measures may include role-based access controls, authentication, audit logging, protected devices and work areas, secure transmission, workforce training, and a process for managing security incidents.

When must a hospice notify patients about a breach of unsecured PHI?

When a breach requires notification, the hospice must notify affected individuals without unreasonable delay and no later than 60 days after discovering it. Separate HHS and media notification requirements may also apply, depending on how many people were affected and where they reside.