HIPAA Compliance Requirements for Cleft Lip and Palate Teams

What HIPAA requires of cleft lip and palate teams

Care for cleft lip and palate may involve surgeons, pediatricians, dentists, orthodontists, speech-language pathologists, audiologists, nurses, and other professionals. When those professionals handle identifiable information about a patient’s care, such as surgical notes, imaging, dental records, or speech evaluations, the information may be protected health information (PHI).

HIPAA applies to covered entities, including certain health care providers that conduct specified transactions electronically, and to business associates that handle PHI on a covered entity’s behalf. A multidisciplinary team is not automatically one HIPAA entity: each organization should determine its role and responsibilities. See HHS guidance on covered entities and business associates.

The HIPAA Privacy Rule governs permitted uses and disclosures of PHI and patient rights. The HIPAA Security Rule requires covered entities and business associates to protect electronic PHI with reasonable and appropriate administrative, physical, and technical safeguards. Teams should put these requirements into practice through clear policies, workforce training, appropriate access controls, and procedures for sharing and protecting records. See the HHS Summary of the HIPAA Privacy Rule and HHS Summary of the HIPAA Security Rule.

HIPAA is a federal baseline. State law and other applicable requirements may impose additional protections or affect who may authorize care or access a child’s records, so teams should check the rules that apply to their patients and locations.

When care coordination permits sharing protected health information

The Privacy Rule generally allows a covered health care provider to use or disclose PHI for treatment without the patient’s authorization. For example, a provider may share relevant records with another provider who needs them to evaluate or treat the patient. This treatment coordination disclosure can support communication among cleft-care team members, including when they work for separate organizations. See HHS guidance on disclosures for treatment.

A team label or referral alone does not make every recipient a treatment provider. Before sharing, confirm that the recipient is involved in the patient’s care and that the disclosure is for treatment. Use a secure, approved channel and follow organizational policies for identity verification and documentation.

The minimum necessary standard generally does not apply to disclosures to, or requests by, a health care provider for treatment. That exception does not eliminate the need for sensible access controls or secure handling. For other purposes, such as payment or health care operations, covered entities generally must limit PHI to what is reasonably necessary. See HHS guidance on the minimum necessary standard.

Not every person supporting a cleft-care service is a treatment provider. Staff and workforce members should access records only as allowed by their role and applicable policies. If a proposed disclosure is not for treatment and is not otherwise permitted by HIPAA or another law, the team may need a valid patient authorization.

How to obtain and document patient authorization

HIPAA authorization is different from informal consent. Covered entities may choose to obtain consent for treatment, payment, or health care operations, but authorization is generally required for uses or disclosures that the Privacy Rule does not otherwise permit. A consent form alone is not a substitute for a valid authorization when HIPAA requires one. See HHS guidance distinguishing consent from authorization.

A valid authorization must contain required elements, including a meaningful description of the information, who may disclose it, who may receive it, the purpose, and an expiration date or event. It must also include the individual’s signature and date, information about revocation, and required statements about conditioning treatment or payment. Keep the signed authorization and document the disclosure in accordance with applicable policies and recordkeeping requirements. See HHS authorization FAQs.

Patients can generally revoke an authorization in writing, subject to the limits for actions already taken in reliance on it. Teams should have a process to record revocations and stop future disclosures covered by the authorization. HIPAA generally does not require notarization or a witness signature for an authorization.

Some information has special rules. For example, psychotherapy notes maintained separately from the medical record generally require authorization for disclosure, even for treatment, with limited exceptions. Cleft lip and palate care teams should also verify who may act for a child or other patient who cannot make decisions. A parent is generally a minor’s personal representative, but exceptions and state law can affect authority and access. See HHS guidance on psychotherapy notes and HHS guidance on personal representatives and minors.

What safeguards protect records shared across team members

The HIPAA Security Rule requires reasonable and appropriate safeguards for electronic PHI, guided by the organization’s risks and circumstances. Teams should assess where electronic records are created, received, maintained, and transmitted, then implement and periodically review safeguards that protect their confidentiality, integrity, and availability. See HHS guidance on Security Rule risk analysis.

• Administrative safeguards: Assign security responsibilities, train workforce members, establish access and incident-response procedures, and review risks and safeguards.
• Physical safeguards: Protect workstations, devices, paper records, and facilities from unauthorized access or exposure.
• Technical safeguards: Use appropriate access controls, authentication, audit controls, integrity protections, and transmission security.

For shared electronic records, give users access appropriate to their responsibilities, remove or revise access when roles change, and use systems that support secure communication and review of access activity. HIPAA does not prescribe one specific technology for every team. If a team uses email or another open network, it must assess the risks and apply protections appropriate to the transmission. HHS explains that email is not categorically prohibited, but ePHI must be adequately protected. See HHS guidance on sending ePHI by email.

How business associate agreements apply to external providers

A business associate agreement (BAA) is generally required when an outside person or organization performs a service on behalf of a covered entity that involves creating, receiving, maintaining, or transmitting PHI. Common examples can include vendors providing billing, transcription, data-management, or cloud-hosting services. The written agreement must set permitted and required uses of PHI and require appropriate safeguards.

An outside clinician who receives PHI to treat a patient is not automatically the cleft team’s business associate. HIPAA expressly excludes treatment disclosures to a health care provider from the business associate requirements. A BAA may still be needed if that provider performs a separate service on the team’s behalf involving PHI. See HHS guidance on provider-to-provider disclosures and HHS business associate FAQs.

Check the actual service and relationship rather than relying only on a vendor’s label or a general assurance of “HIPAA compliance.” If a vendor stores or processes electronic PHI for the team, confirm whether a BAA is required and assess the vendor arrangement as part of the organization’s security risk management. See HHS cloud-computing guidance.

How to handle disclosures and patient access requests

Before a non-routine disclosure, identify its purpose, confirm that HIPAA or another applicable law permits it, verify the recipient, and determine whether authorization is required. Use the appropriate minimum necessary procedures when that standard applies. For treatment disclosures to health care providers, the standard does not apply, but teams should still follow safeguards and policies designed to prevent misdirected or unauthorized sharing.

Patients generally have a right to inspect and obtain copies of PHI in a covered entity’s designated record set, subject to limited exceptions. A covered entity generally must act on an access request within 30 calendar days. If it cannot meet that deadline, it may take one additional 30-day period if it gives the patient a written explanation and the expected completion date within the initial period. See HHS guidance on access-request deadlines.

For cleft-care teams treating children, verify whether the requester is the patient’s personal representative under applicable federal and state law. A patient may also direct a covered entity in a signed written request to send records to a designated person. Keep a clear process for receiving, routing, and responding to requests, including records maintained by a business associate. See HHS guidance on medical records and access rights.

In short, cleft lip and palate teams can usually share PHI with providers for treatment without authorization, but must use authorization when a disclosure is not otherwise permitted. Determine whether an outside organization is a business associate, protect records with risk-based safeguards, and respond to patient access requests within HIPAA’s deadlines.

FAQs.

Can cleft-team members share protected health information for treatment?

Generally, yes. HIPAA permits covered providers to share PHI with other health care providers for treatment without patient authorization. The team should confirm that the recipient is involved in care and use appropriate safeguards for the information shared.

When is patient authorization required to share cleft-care records?

Authorization is generally required when a use or disclosure is not otherwise permitted by the HIPAA Privacy Rule or another applicable law. Special rules apply to certain information, including psychotherapy notes. State law may also affect disclosures, particularly when a patient is a minor.

Does a cleft-team practice need a business associate agreement with an outside provider?

Not just because the outside provider receives records to treat the patient. HIPAA excludes provider-to-provider treatment disclosures from the business associate requirements. A BAA may be needed if the outside provider performs a separate service on the practice’s behalf that involves PHI.

What safeguards apply to electronic cleft-care records?

The HIPAA Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards for electronic PHI. Depending on the organization’s risk analysis, these can include access controls, authentication, audit controls, physical protection of devices and workstations, and safeguards for electronic transmissions.