HIPAA Compliance Requirements for Neurocognitive and Memory Assessment Clinics

How Does HIPAA Apply to Neurocognitive and Memory Assessment Clinics?

HIPAA applies to a clinic based on its legal role and activities—not because it offers neurocognitive testing or memory care. A clinic is generally a covered entity if it is a health care provider that electronically conducts a transaction for which HHS has adopted a standard, such as submitting health care claims electronically. The HHS overview of covered entities explains this test.

A clinic that does not meet the covered-entity definition may still have HIPAA obligations if it performs services involving protected health information (PHI) on behalf of a covered entity as a business associate. Covered entities and business associates must protect PHI as required by the HIPAA rules. The Privacy Rule covers PHI in different forms; the Security Rule specifically protects electronic protected health information (ePHI).

For a memory clinic, PHI may include patient identifiers connected with assessment results, diagnoses, treatment plans, billing, or care coordination. Determine your covered entity status from how the clinic operates and handles HIPAA-standard transactions, rather than relying on the clinic’s name, specialty, payment model, or the sensitivity of its assessments alone.

What Privacy Rights and Notices Must Clinics Provide to Patients?

A covered clinic must give patients a Notice of Privacy Practices (NPP) describing how it may use and disclose PHI, its privacy duties, and how patients can exercise their rights. For a direct-treatment provider, the notice generally must be provided no later than the first service; the clinic must make a good-faith effort to obtain written acknowledgment of receipt, subject to applicable exceptions. If the clinic has a website describing its services, it must post the notice there. See the HIPAA NPP regulation and the HHS model notice for health care providers.

The notice should explain how patients can ask to inspect or obtain copies of their records, request amendments, request confidential communications, and request restrictions on certain uses or disclosures. It should also explain the right to receive an accounting of certain disclosures, file a privacy complaint, and designate a personal representative when authorized by applicable law. These rights have limits, and a clinic generally does not have to agree to every requested restriction. A family member is not automatically entitled to a patient’s assessment results simply because they are involved in the patient’s care.

Providing the NPP is not a substitute for obtaining a written authorization when the Privacy Rule requires one. Clinics should make the notice accessible and ensure staff can direct patients or their authorized representatives to the right process for making requests.

Which Written Policies and Workforce Training Are Required?

Covered clinics need written privacy and security policies that reflect their actual workflows. Assign responsibility for privacy and security administration, set access and disclosure procedures, establish complaint and incident processes, and document workforce sanctions for policy violations. HIPAA requires workforce training appropriate to employees’ roles and responsibilities; it does not set a universal annual training or certificate-renewal schedule. The HHS overview of provider responsibilities describes the flexible, practice-specific approach.

Training should address the situations staff encounter—for example, verifying a requester’s identity, handling assessment reports, communicating with family members, using patient portals, and reporting a suspected privacy or security incident. Train new workforce members and update training when policies, systems, or job duties change so staff understand the procedures that apply to their work.

Under the Security Rule, clinics must also document their security policies, procedures, and required assessments. Required documentation generally must be retained for six years from its creation or the date it was last in effect, whichever is later. See the Security Rule documentation requirements.

How Should Clinics Secure Electronic Protected Health Information?

The Security Rule requires clinics to protect the confidentiality, integrity, and availability of ePHI through administrative, physical, and technical safeguards. An electronic protected health information risk analysis is a core step: identify where ePHI is created, received, maintained, or transmitted; assess threats and vulnerabilities; and use the results to select and document risk-management measures. See HHS guidance on Security Rule risk analysis.

• HIPAA administrative safeguards: Assign security responsibility, manage workforce access, train staff on security awareness, respond to incidents, plan for emergencies, and evaluate safeguards.
• HIPAA physical safeguards: Control physical access to facilities and equipment, set rules for workstation use, and manage devices and media that store ePHI.
• HIPAA technical safeguards: Use access controls, audit controls, integrity protections, authentication, and transmission security to protect electronic systems and data.

Practical measures may include unique user accounts, role-based access, screen locks, secure backups, audit-log review, and protected transmission of patient records. Consider encryption and multifactor authentication as part of the clinic’s risk analysis. The Security Rule allows flexibility in how safeguards are implemented; addressable specifications must be assessed and implemented when reasonable and appropriate, or the clinic must document why an alternative measure is appropriate. HHS summarizes the Security Rule safeguards.

The risk analysis is not a one-time form. Review it and the clinic’s safeguards as circumstances require, including when systems, vendors, workflows, or risks change. HIPAA does not prescribe a fixed annual interval for every clinic. HHS explains that the frequency depends on the organization and its environment in its risk analysis and risk management guidance.

What Must Business Associate Agreements Include?

A clinic that is a covered entity generally needs a written business associate agreement (BAA) before a business associate creates, receives, maintains, or transmits PHI on its behalf. Depending on the service, business associates may include billing or transcription vendors and providers of systems that handle patient information. A vendor’s label or promise of security does not replace the required agreement.

The BAA must set out permitted and required uses and disclosures of PHI, require appropriate safeguards, and require the business associate to report impermissible uses or disclosures and breaches of unsecured PHI. It must also address relevant patient-rights requests, HHS access to records for compliance review, subcontractors’ obligations, and return or destruction of PHI when the agreement ends if feasible. The agreement must provide for appropriate termination consequences for material violations. See HHS’s required BAA provisions.

Not every service relationship requires a BAA. For example, a provider receiving records from another provider for treatment is not automatically that provider’s business associate. Review the parties’ actual functions and information flows before deciding whether an agreement is required.

How Should Clinics Respond to a Breach of Unsecured PHI?

When a clinic suspects an impermissible use or disclosure, it should promptly contain the incident, preserve relevant evidence, identify the information and individuals involved, and document its assessment. An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an exception applies or the clinic demonstrates, through a documented risk assessment, a low probability that the PHI was compromised. The HHS Breach Notification Rule guidance describes the assessment and notification requirements.

If notification is required, the clinic must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. It must notify HHS; for breaches affecting fewer than 500 individuals, HHS reporting may generally be submitted annually, by 60 days after the end of the calendar year in which the breach was discovered. If more than 500 residents of a state or jurisdiction are affected, the clinic must also notify prominent media outlets serving that area. A business associate must notify the covered clinic of a breach without unreasonable delay and no later than 60 days after discovery, though the BAA may require faster reporting.

Patient notices generally describe what happened, the types of information involved, steps patients can take to protect themselves, the clinic’s response, and contact information. Keep records showing that required notices were sent or documenting why notice was not required. In short, clinics should determine their HIPAA role, provide and follow privacy procedures, protect ePHI with risk-based safeguards, govern vendor access through BAAs, and respond to incidents under the Breach Notification Rule.

FAQs

Are neurocognitive assessment clinics covered entities under HIPAA?

They may be. A clinic is generally a covered entity if it is a health care provider that electronically conducts a HIPAA-standard transaction, such as an electronic health care claim. A clinic may also have HIPAA obligations as a business associate if it handles PHI for a covered entity. The clinic’s specialty alone does not determine its status.

What privacy rights must a memory clinic explain to patients?

Its Notice of Privacy Practices should explain how patients can access or obtain copies of their records, request amendments, request confidential communications or certain restrictions, receive an accounting of certain disclosures, and file a complaint. It should also explain how authorized personal representatives may exercise rights. Some rights have exceptions or limits.

How often should a clinic review its ePHI risk analysis and safeguards?

HIPAA does not specify one review interval for every clinic. The clinic should maintain an ongoing risk-analysis process and reassess safeguards when needed, including after relevant changes to technology, operations, vendors, or identified risks. The appropriate frequency depends on the clinic’s environment and circumstances.

When must a clinic notify patients about a breach of unsecured PHI?

If the incident is a reportable breach, the clinic must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering it. A business associate must notify the covered clinic within its applicable reporting period, which cannot exceed 60 days after discovery; the clinic’s BAA may set a shorter deadline.