HIPAA Compliance Requirements for Hereditary Cancer Risk Assessment Clinics

Hereditary cancer risk assessments can involve genetic test results, family medical history, and other sensitive health details. When that information is protected health information (PHI), clinics covered by HIPAA must handle it under the HIPAA Privacy Rule, the Security Rule, and the Breach Notification Rule. The rules apply based on the clinic’s role and activities—not simply because it collects genetic information.

When does HIPAA apply to genetic information in hereditary cancer risk assessments?

Genetic information is protected by the HIPAA Privacy Rule when it is individually identifiable health information maintained or transmitted by a covered entity or its business associate. A clinic’s identifiable test results, risk assessments, and family-history details may therefore be PHI. Genetic data that is not individually identifiable, or is held by an organization that is neither a covered entity nor a business associate, is not automatically protected by HIPAA, though other privacy laws may apply. See HHS guidance on genetic information and HIPAA.

HIPAA does not mean a clinic needs a separate patient authorization for every use of genetic PHI. The Privacy Rule permits certain uses and disclosures without authorization, including for treatment, payment, and health care operations, subject to applicable limits. Other uses or disclosures generally require a valid authorization unless another HIPAA permission or requirement applies. HHS explains permitted treatment, payment, and health care operations uses.

Which clinics and organizations are covered entities or business associates?

A hereditary cancer risk clinic may be a covered entity if it is a health care provider that conducts certain standard electronic transactions, such as submitting electronic claims. HIPAA also covers health plans and health care clearinghouses. A clinic’s size or specialty alone does not determine its status; its functions and transactions matter. See HHS’s summary of the HIPAA Privacy Rule.

A business associate is generally an organization or person that performs services or functions for a covered entity involving PHI. Depending on their role, vendors providing cloud storage, billing, data analytics, or other services on a clinic’s behalf may be business associates. A separate laboratory providing its own health care services is not automatically a business associate just because it receives patient information; assess the actual relationship and services. When a business associate relationship exists, the parties generally need a business associate agreement that addresses permitted uses, safeguards, and reporting responsibilities. See the HHS business associate guidance.

How can clinics manage permitted uses and disclosures of genetic health information?

Clinics may generally use PHI to provide and coordinate care, consult with other providers, process payment, and conduct permitted health care operations without obtaining a separate HIPAA authorization. For example, a clinic may share relevant risk-assessment information with a specialist involved in the patient’s care. The disclosure must still follow applicable HIPAA requirements and the clinic’s notice of privacy practices. HHS describes these permitted uses and disclosures.

For purposes not otherwise permitted or required—such as many disclosures to an employer, life insurer, or unrelated third party—the clinic generally needs the patient’s valid written authorization. A general consent to care is not a substitute for an authorization when HIPAA requires one. Clinics should also assess whether state law imposes stricter protections or additional consent rules for genetic information.

HIPAA separately prohibits health plans from using or disclosing genetic information for underwriting purposes, subject to the rule’s specific scope and exceptions. Clinics should not assume that this prohibition applies identically to every type of insurer or every organization that handles genetic data. See 45 C.F.R. § 164.502.

What privacy safeguards, policies, and workforce training are required?

Covered clinics must develop and follow written privacy policies and procedures, designate a privacy official, provide a way for patients to raise privacy complaints, and apply appropriate safeguards to PHI. These measures should address the clinic’s actual operations, including how staff collect, discuss, store, send, and dispose of genetic records. The clinic must also provide a notice of privacy practices describing its privacy practices and patient rights. See HHS’s overview of Privacy Rule administrative requirements.

Clinics must train workforce members on relevant privacy policies and procedures as necessary and appropriate for their roles. Training is required for new workforce members within a reasonable period and when a material policy change affects their work; the clinic must document that training. HIPAA does not establish a universal annual training or certificate-renewal requirement. A training completion certificate documents a person’s training; it does not certify that the clinic as an organization is HIPAA compliant. Clinics should also provide any employer-specific training required by their own policies. See 45 C.F.R. § 164.530.

Business associate agreements should be in place where required and should set out the business associate’s permitted uses and disclosures, safeguards, and breach-reporting duties. The agreement does not transfer away the clinic’s responsibility for meeting its own HIPAA obligations. See the HHS guidance on business associate responsibilities and patient rights.

How does the minimum necessary standard apply to genetic information?

For uses, disclosures, and requests to which the minimum necessary standard applies, clinics must make reasonable efforts to limit PHI to what is needed for the intended purpose. That may mean limiting routine access to genetic test results and risk assessments according to workforce roles, and reviewing non-routine disclosures individually under established criteria. HHS’s minimum necessary guidance explains that the standard generally does not apply to disclosures to, or requests by, a health care provider for treatment.

The treatment exception does not eliminate the need for sensible safeguards or role-based access within the clinic. Staff should access genetic information only as needed for their duties, and disclosures for payment or health care operations should be limited as required. The standard also does not apply to certain other situations, including disclosures to the individual and disclosures made pursuant to a valid authorization.

What Security Rule and breach notification duties apply to electronic genetic records?

The HIPAA Security Rule applies to electronic protected health information (ePHI), including electronic genetic test results and risk-assessment records held by a covered clinic or business associate. It requires appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI. Clinics must conduct and document a risk analysis, address identified risks, and review and update security measures as needed. See the HHS Security Rule overview and HHS risk analysis guidance.

If unsecured PHI is breached, the Breach Notification Rule generally requires the covered entity to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting 500 or more individuals also must be reported to the Secretary of HHS within that timeframe; smaller breaches must be reported annually, within 60 days after the end of the calendar year in which they were discovered. A business associate must notify the covered entity of a breach, without unreasonable delay and no later than 60 days after discovery; its agreement may require faster notice. The clinic must assess the event under the rule and document its response. See HHS’s HIPAA Breach Notification Rule guidance.

What rights do patients have to access and correct their health records?

Patients generally have the right to inspect or obtain copies of PHI in a covered clinic’s designated record set, subject to limited exceptions. This can include genetic test information held by the clinic or its business associate. HHS specifically explains that access to a clinical laboratory’s genetic testing records may include the completed test report and the full gene variant information generated by the test. See HHS guidance on access to genetic testing information.

A covered entity generally must act on an access request within 30 days. It may take one additional 30-day extension if it gives the patient a timely written explanation and the expected completion date. Patients may also request an amendment to PHI in a designated record set. The clinic generally must respond within 60 days, with one additional 30-day extension under specified conditions; it may deny a request for a permitted reason, such as when it determines the record is accurate and complete. See 45 C.F.R. § 164.524 and 45 C.F.R. § 164.526.

In practice, HIPAA compliance for hereditary cancer risk assessment clinics depends on identifying which records are PHI, determining whether the clinic is a covered entity or business associate, limiting uses and disclosures appropriately, protecting ePHI, responding to breaches, and honoring patient rights. Clear policies and role-appropriate workforce training help put those duties into day-to-day practice.

FAQs.

Is individually identifiable genetic information protected health information under HIPAA?

Yes, when it is individually identifiable health information maintained or transmitted by a HIPAA covered entity or its business associate. Genetic information held outside that context is not automatically protected by HIPAA, though other laws may apply.

When can a clinic disclose genetic information without patient authorization?

A covered clinic may generally use or disclose genetic PHI without authorization for treatment, payment, and health care operations, and in other circumstances permitted or required by the Privacy Rule. Disclosures for purposes not otherwise permitted or required generally need a valid authorization.

Does the minimum necessary standard apply to disclosures for treatment?

Generally, no. The standard does not apply to a disclosure to, or request by, a health care provider for treatment. It may apply to other uses, disclosures, and requests, such as those for payment or health care operations.

What rights do patients have to access or correct genetic health records?

Patients generally may access PHI in a designated record set, which can include genetic test information, and request an amendment to information they believe is inaccurate or incomplete. A clinic may deny an amendment request for a permitted reason, but must follow HIPAA’s response and review procedures.