HIPAA Compliance Requirements for Cord Blood Banking Companies

When does HIPAA apply to a cord blood banking company?

HIPAA does not automatically apply to every cord blood bank simply because it collects, stores, or handles health-related information. The HIPAA Rules apply to covered entities—health plans, health care clearinghouses, and certain health care providers—and to business associates that perform covered functions or services for them. A health care provider is generally covered when it transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as certain electronic billing transactions. HHS guidance on covered entities and business associates

Whether a bank qualifies depends on what it actually does, whom it serves, and how it handles information. For example, a bank that furnishes health care services and conducts a standard electronic transaction may need to assess whether it meets the HIPAA covered entity definition. A bank that does not meet either the covered-entity or business-associate definition is not subject to the HIPAA Rules solely because its records contain health information. Other privacy, consumer-protection, contractual, or state-law duties may still apply.

How covered entity and business associate status is determined

Start by mapping the organization’s services and relationships. Determine whether the bank is a health care provider that conducts standard electronic transactions, a health plan, or a health care clearinghouse. Then identify whether it creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity or another business associate. These facts—not the company’s name or industry label—help establish its HIPAA role. HHS Business Associates guidance

A cord blood bank may be a business associate if, for example, it handles identifiable health information while performing services for a covered hospital or other covered provider. In that arrangement, the covered entity generally must have a written HIPAA business associate agreement (BAA) that describes permitted uses and disclosures and requires appropriate safeguards. Business associates also have direct obligations under certain HIPAA provisions. HHS guidance on business associate agreements

Review each relationship separately. A bank’s role may differ depending on whether it serves a family directly, provides services for a hospital, or uses a vendor to host records. If the bank is a business associate, vendors that handle PHI on its behalf may be subcontractor business associates and may require written agreements as well.

What protected health information must cord blood banks safeguard?

PHI is individually identifiable health information held or transmitted by a covered entity or business associate, subject to HIPAA’s definitions and exclusions. In a cord blood context, records may include a donor’s or mother’s identity linked to health history, screening or testing results, collection details, or other health information. A record is not necessarily HIPAA-protected merely because it identifies a donor: the organization’s HIPAA status and the context in which it created, received, or maintains the record matter. HHS guidance on PHI and de-identification

When HIPAA applies, the bank should identify PHI across paper files, electronic records, laboratory and collection systems, communications, backups, and vendor platforms. HIPAA’s Privacy Rule generally requires covered entities to limit uses, disclosures, and requests for PHI to the minimum necessary for the purpose, with exceptions including disclosures for treatment and disclosures to the individual. HHS Summary of the HIPAA Privacy Rule

Properly de-identified information is not PHI under the Privacy Rule. HHS recognizes two methods: removing specified identifiers under the Safe Harbor method or obtaining an expert determination that the risk of identification is very small. Merely replacing a name with a code may not be enough if the person can still be identified from the remaining information. HHS de-identification guidance

Which uses and disclosures require written authorization?

A covered entity generally must obtain an individual’s valid written authorization for a use or disclosure of PHI that is not otherwise permitted or required by the Privacy Rule. The authorization must describe the information and purpose, identify the persons or classes of persons authorized to disclose and receive it, include an expiration date or event, and explain the individual’s right to revoke it, among other required elements. HHS Summary of the HIPAA Privacy Rule

For a cord blood bank, authorization may be needed before sharing identifiable donor information for a purpose such as certain research, marketing, or disclosure to an outside recipient when no HIPAA permission applies. Research disclosures can sometimes occur without individual authorization when the Privacy Rule’s specific conditions are met, such as an applicable waiver or a limited data set accompanied by a data use agreement. A BAA by itself does not authorize every disclosure; the use or disclosure must also be permitted by the Privacy Rule and the agreement. HHS HIPAA and Research guidance

Do not treat all information sharing alike. Uses and disclosures for treatment, payment, or health care operations may be permitted without authorization when the Privacy Rule’s requirements are met; other permissions and exceptions also exist. Check the purpose, recipient, applicable permission, and any more protective state-law or contractual rule before disclosing identifiable donor information. HHS Privacy Rule overview

Administrative, physical, and technical safeguards for electronic PHI

Covered entities and business associates subject to the Security Rule must protect electronic protected health information (ePHI) through reasonable and appropriate administrative, physical, and technical safeguards. The Rule is designed to scale to an organization’s size, capabilities, systems, and risks; it does not prescribe one universal technology package. HHS Summary of the HIPAA Security Rule

• Administrative safeguards: Assign security responsibility, train and manage workforce access, establish incident-response and contingency procedures, and conduct a documented HIPAA Security Rule risk analysis of potential threats and vulnerabilities to ePHI. Risk analysis is required; security measures should be selected and updated in light of identified risks. HHS risk-analysis guidance
• Physical safeguards: Control access to facilities and systems, secure workstations, and manage devices and media that may contain ePHI. These safeguards apply to electronic information systems whether they are housed on the organization’s premises or elsewhere. HHS guidance on physical safeguards
• Technical safeguards: Use access controls, audit controls, integrity protections, authentication, and transmission-security measures appropriate to the organization’s risk and environment. Encryption is an important security measure to assess, but the Security Rule’s encryption specifications are addressable rather than universally prescriptive; document the organization’s assessment and chosen approach. HHS Security Rule technical safeguards guidance

Document policies, decisions, risk responses, and periodic evaluations. A risk analysis is not a one-time checklist: review it when systems, vendors, workflows, or risks change, and update safeguards as needed. HHS risk-analysis guidance

How to protect donor identity and confidential cord blood records

Build privacy protections into the full record lifecycle: collection, labeling, testing, storage, retrieval, sharing, retention, and disposal. Where operationally appropriate, separate identifying information from specimen or inventory identifiers, restrict access by job role, and establish procedures for verifying a recipient’s identity and authority before releasing records. These are practical safeguards; whether a specific measure is legally required depends on the organization’s HIPAA role, the information, and the applicable standards.

For electronic systems, maintain individual user accounts where appropriate, limit access to authorized personnel, review access logs, and use secure channels for transmitting ePHI. For paper records and physical samples, restrict storage-area access and protect documents from casual viewing or unauthorized removal. Include cloud, laboratory, and storage vendors in the information-flow and risk review; a vendor that creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate may itself be a business associate. HHS guidance on HIPAA and cloud computing

Set written procedures for workforce access, incident reporting, secure disposal, and responding to privacy requests. If HIPAA applies, follow the applicable Privacy, Security, and Breach Notification Rule requirements; also check state privacy and genetic-information laws, which may impose separate or stricter duties.

How HIPAA differs from FDA and other cord blood requirements

HIPAA and FDA requirements address different issues. HIPAA governs privacy and security of PHI held by covered entities and business associates. FDA requirements for human cells, tissues, and cellular and tissue-based products (HCT/Ps) address matters such as establishment registration and product listing, as applicable, as well as other regulatory requirements tied to the product and its use. FDA explains that establishments manufacturing HCT/Ps may be required to register and list, subject to applicable exceptions. FDA HCT/P establishment registration and listing guidance

Registration or compliance with FDA’s HCT/P rules does not determine whether a bank is a HIPAA covered entity or business associate, and it does not replace HIPAA obligations when those obligations apply. Conversely, HIPAA compliance does not satisfy FDA requirements. Cord blood companies should assess each regulatory framework separately and consider the specific product, activity, business relationships, and applicable federal and state rules.

In summary, cord blood banking companies should first determine their HIPAA role, then identify the PHI they handle and the permissions governing its use and disclosure. If the HIPAA Rules apply, written agreements, risk-based administrative, physical, and technical safeguards, and distinct review of FDA and other legal duties help protect donor information without confusing one regulatory framework for another.

FAQs.

Are cord blood banks automatically covered by HIPAA?

No. A cord blood bank is not automatically covered because of its industry or the sensitivity of its records. HIPAA applies if the organization meets the definition of a covered entity or business associate; the bank’s services, electronic transactions, and relationships with covered entities determine its status. HHS guidance on covered entities and business associates

Can a cord blood bank qualify as a HIPAA business associate?

Yes. A bank may qualify if it performs covered functions or services for a covered entity and handles PHI in doing so. The covered entity generally must establish the required written BAA, and the business associate has direct responsibilities under certain HIPAA provisions. HHS Business Associates guidance

When is written authorization needed to disclose cord blood donor information?

If the information is PHI and the organization is subject to the Privacy Rule, written authorization is generally needed when the proposed use or disclosure is not otherwise permitted or required by HIPAA. Certain treatment, payment, health care operations, research, and other disclosures may be allowed under specific conditions, so assess the purpose and applicable exception before sharing identifiable information. HHS Summary of the HIPAA Privacy Rule

Do FDA cord blood requirements replace HIPAA obligations?

No. FDA requirements and HIPAA address different regulatory responsibilities. FDA registration and listing obligations do not replace HIPAA privacy and security duties when a cord blood company is a covered entity or business associate, and HIPAA compliance does not replace applicable FDA requirements. FDA HCT/P establishment registration and listing guidance