HIPAA Compliance Requirements for Mohs Micrographic Surgery Practices

HIPAA compliance requirements for Mohs micrographic surgery practices cover the safeguards used to protect patient information, as well as clinical documentation and billing practices that support appropriate care. If your practice is a HIPAA covered entity or business associate, build a documented security program around the electronic protected health information (ePHI) you create, receive, maintain, or transmit—and address the clinical and Medicare requirements that apply to your services.

What HIPAA security program must a Mohs practice maintain?

A HIPAA security program should be based on a documented Security Risk Analysis (SRA) and risk-management process. Your SRA should identify where ePHI is stored or used, the threats and vulnerabilities that could affect it, and the safeguards needed to protect its confidentiality, integrity, and availability. HHS explains that the Security Rule does not prescribe a single risk-analysis method or a fixed schedule; practices should revisit the analysis as their environment, technology, or risks change. See HHS guidance on risk analysis.

Document the policies and procedures that put your safeguards into practice. A program commonly addresses workforce access, security awareness and training, security incidents, regular review of system activity, and contingency planning. The contingency plan includes required data-backup, disaster-recovery, and emergency-mode procedures. The HHS summary of the Security Rule describes these safeguards and related requirements.

Train workforce members on the security and privacy policies relevant to their duties, keep appropriate records, and apply sanctions when staff violate practice policies. HIPAA does not establish a universal annual certificate-renewal requirement; training should follow the rules and the practice’s own policies, including any employer-specific training schedule. A training certificate documents completion of a course—it does not, by itself, establish that the organization is HIPAA compliant.

How should staff access and handle electronic protected health information?

Use role-based access control (RBAC) so each workforce member can access the information and systems needed for their work, rather than giving everyone broad access. Assign unique user IDs, remove or change access promptly when a person’s role changes or employment ends, and review access periodically. The Security Rule requires access controls, including an emergency access procedure for obtaining necessary ePHI during an emergency.

Teach staff to protect patient information in routine clinic workflows: verify the intended recipient before sending records, use approved secure communication methods, keep screens and printed documents from public view, and avoid shared accounts. Apply the minimum-necessary standard where it applies; it does not apply to disclosures to, or requests by, a health care provider for treatment. HHS summarizes the Privacy Rule’s minimum-necessary and safeguard requirements.

Give staff a clear reporting route for suspected loss, unauthorized access, misdirected messages, or other security incidents. They should promptly alert the practice’s designated privacy or security contact and preserve relevant details rather than investigating or deciding on their own whether a reportable breach occurred. The practice should assess and document the incident, take steps to limit harm, and follow applicable notification rules.

Which systems and patient data require safeguards?

Include all ePHI the practice creates, receives, maintains, or transmits in its SRA, regardless of where it resides. In a Mohs practice, that may include the electronic health record, scheduling and billing systems, pathology and specimen-mapping records, clinical photographs, patient portals, email, messaging, workstations, printers, connected devices, portable media, and backup systems. HHS notes that risk analysis should cover ePHI across all electronic media and systems—not just the main EHR. See HHS’s scope guidance for risk analysis.

Also account for vendors and service providers that handle ePHI for the practice. A cloud provider that creates, receives, maintains, or transmits ePHI on the practice’s behalf generally meets HIPAA’s business-associate definition, so the practice should have an appropriate business associate agreement (BAA) and include the service in its risk-management process. See HHS guidance on cloud computing and HIPAA.

HIPAA Privacy Rule safeguards also apply to protected health information in paper and oral form. Protect paper charts, printed labels, specimen records, and conversations through appropriate physical and administrative safeguards, not only through computer security. HHS describes safeguards for protected health information in different forms.

What should Mohs procedure documentation include?

Clinical records should explain what was treated and how the procedure was performed. Medicare billing guidance calls for the record to identify the lesion’s location, number, and size; the number of stages performed; and the number of specimens per stage. Operative and pathology documentation should support that accepted Mohs technique was used and show the physician’s surgical and histologic work. See the CMS Mohs Micrographic Surgery billing and coding article.

Document the first-stage histology, including the depth of invasion, tumor pattern, and cell morphology, and note perineural invasion or scar tissue if present. For subsequent stages, the record may refer to the first-stage description when the features are unchanged or describe any differences. Keep documentation legible, attributable to the person providing the care, and consistent with the services and codes reported.

These clinical and billing records are distinct from the Security Risk Analysis: HIPAA’s Security Rule governs protection of ePHI, while Medicare and payer policies govern which services qualify for coverage and how they must be documented. Check the applicable Medicare Administrative Contractor (MAC) policy and other payer rules for the practice’s jurisdiction and contracts.

How should medical necessity and treatment options be documented?

For Medicare claims, document why Mohs surgery is reasonable and necessary for the particular lesion. CMS guidance says the record should support why the lesion’s complexity, size, or location makes Mohs appropriate and why a simpler approach, such as standard excision or destruction, is not appropriate. Include relevant history, examination findings, and diagnostic information, such as biopsy results, when applicable.

Document the care options discussed with the patient, including the primary treatment and repair options, and record the clinical reasoning for the selected plan. If a complex repair, flap, graft, or other reconstructive approach is used, explain why it is appropriate. These points reflect CMS documentation guidance for Mohs surgery and should be checked against the LCD and billing article that apply to your Medicare jurisdiction.

How do provider qualifications and billing rules affect compliance?

Medicare coverage policies require the Mohs physician to be trained and skilled in Mohs techniques and pathologic identification, and applicable contractor policies may specify how qualifications must be verified. Medicare’s Mohs coding rules also rely on the Mohs surgeon performing the integrated surgical and pathology services. Because local coverage determinations can differ by jurisdiction, confirm the current requirements for your MAC rather than treating one LCD as a nationwide rule. See the CMS Local Coverage Determination for Mohs Micrographic Surgery.

For Medicare, do not report Mohs surgery codes and surgical pathology codes for the same tissue used to evaluate Mohs margins. CMS identifies that combination as inappropriate. Separate pathology may be reportable for a distinct specimen in certain circumstances, but the record must establish that it is not the same tissue used for Mohs margin evaluation and explain the reason for the separate examination. Consult the current Medicare NCCI Policy Manual and applicable payer instructions before billing.

Good compliance connects the SRA and safeguards to daily practice, while accurate clinical notes support medical necessity, provider qualifications, and Mohs margin evaluation coding. Keep these processes documented, review them when circumstances change, and verify payer-specific requirements.

FAQs

How often should a Mohs practice conduct a HIPAA security risk analysis?

HIPAA does not set a fixed annual interval for the Security Risk Analysis. HHS says the frequency depends on the organization and its circumstances; the analysis should be ongoing and updated when operational, environmental, or technology changes or newly recognized risks make an update necessary. See HHS guidance on risk analysis.

What systems containing patient information must be protected?

Protect all systems and media containing ePHI that the practice creates, receives, maintains, or transmits. This can include the EHR, billing and scheduling tools, pathology records and images, patient communications, workstations, connected devices, cloud services, portable media, and backups. Paper and oral PHI also require appropriate Privacy Rule safeguards.

What should staff do if they suspect a HIPAA breach?

Staff should promptly report the concern through the practice’s incident-reporting process, preserve relevant information, and follow instructions from the designated privacy or security contact. The practice should investigate and document the incident, assess whether it meets the breach definition, mitigate harm where practicable, and make any required notifications. The Breach Notification Rule generally requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery of a breach of unsecured PHI; other reporting timelines depend on the circumstances. See the HHS Breach Notification Rule.

Can Mohs surgery and surgical pathology codes be reported together for the same tissue used in margin evaluation?

No. CMS says reporting Mohs surgery codes and surgical pathology codes for the same tissue used in Mohs margin evaluation is inappropriate. A separate pathology service may be reportable for a distinct specimen in certain circumstances, subject to documentation, the applicable Medicare policy, and payer rules. See the Medicare NCCI Policy Manual and applicable CMS billing guidance.