HIPAA Compliance Requirements for Personal Emergency Response System Providers

Determine Whether HIPAA Applies

A personal emergency response system (PERS) provider is not automatically subject to HIPAA simply because its equipment or services relate to health or emergencies. HIPAA generally applies when an organization is a covered entity or performs certain services on behalf of a covered entity or business associate involving protected health information (PHI).

Consider how your service is offered and what information you handle. If a customer buys a system directly for personal use and you do not perform services on behalf of a healthcare provider or health plan, your business may not be a HIPAA business associate for that arrangement. Other federal or state privacy requirements may still apply.

Your role may be different when a healthcare provider, health plan, or another business associate engages you to provide monitoring, response coordination, data hosting, or related services that involve PHI. Map the information your system collects, receives, stores, and shares—including alerts, location details, health information, and contact records—and identify whose behalf you are acting on. This business associate determination should reflect actual workflows, not just how your service is marketed.

Establish Business Associate Status

You may be a business associate when you perform a function or service for a covered entity that involves creating, receiving, maintaining, or transmitting PHI. For example, a provider may engage a PERS company to receive alerts tied to patient records and coordinate responses under the provider’s instructions.

Do not assume that handling health-related information alone makes you a business associate. The relationship and purpose matter: determine whether you are acting on behalf of a covered entity or another business associate, or instead providing a service directly to an individual for personal use.

Document your business associate determination for each service arrangement. Identify the parties, the services performed, the PHI involved, and the information flows between your organization, the customer, monitoring personnel, emergency responders, and technology vendors. Revisit the determination when your services, contracts, or data practices change.

Execute Business Associate Agreements

If you are a business associate, enter into a written business associate agreement (BAA) with the covered entity before handling PHI on its behalf. The agreement should describe the services and establish which uses and disclosures of PHI are permitted or required. It should also require you to safeguard the information, report impermissible uses and disclosures and security incidents, and support the covered entity’s applicable duties regarding individual rights.

Address practical responsibilities clearly. Specify how quickly you must report an incident, how the parties will investigate and respond, how PHI will be returned or destroyed when the arrangement ends when feasible, and what happens if either party materially breaches the agreement. A BAA does not replace your responsibility to follow applicable HIPAA requirements.

If a subcontractor creates, receives, maintains, or transmits PHI on your behalf, put a subcontractor agreement in place before sharing the information. The subcontractor agreement must impose applicable privacy and security restrictions on the subcontractor, and you remain responsible for managing the relationship and addressing known material violations.

Safeguard Protected Health Information

Protect PHI in every form, including information in call recordings, dispatch notes, customer records, device histories, and communications with caregivers or emergency personnel. Limit workforce access to people who need the information for their assigned responsibilities, and train staff on confidentiality, secure handling, and how to recognize and report an incident.

Use administrative, physical, and technical safeguards appropriate to your operations. Maintain written policies and procedures, control access to facilities and records, securely dispose of information when it is no longer needed, and establish a process for investigating and reporting suspected unauthorized access or disclosure. Your agreements and procedures should work together so staff know when and how they may use PHI.

HIPAA compliance is an ongoing responsibility. Review risks as services, systems, and vendor relationships change, and keep documentation of your decisions, safeguards, and incident response activities.

Secure Electronic Protected Health Information

Electronic protected health information (ePHI) includes PHI that your systems create, receive, maintain, or transmit electronically. The HIPAA Security Rule calls for safeguards that protect the confidentiality, integrity, and availability of ePHI. Start with a risk analysis that identifies where ePHI resides, how it moves through your systems, who can access it, and what threats could compromise it.

Use security measures suited to those risks, such as access controls, unique user identification, authentication, audit controls, secure transmission, backups, and incident response procedures. Consider the full PERS service path: devices, monitoring platforms, mobile applications, call centers, cloud services, and connections to healthcare or emergency response organizations.

Encryption is an important safeguard, but HIPAA treats encryption as an addressable implementation specification—not as a blanket exemption from compliance. Assess whether encryption is reasonable and appropriate in your environment. If it is not, document the determination and implement an appropriate alternative when required to meet the applicable standard. Encryption does not remove other HIPAA responsibilities, such as risk analysis, access management, workforce training, or incident response.

Limit Permitted Uses and Disclosures

Use or disclose PHI only as permitted by the BAA or required by law. Do not use PHI for unrelated purposes, such as marketing or independent analytics, unless the arrangement and applicable HIPAA requirements authorize that use. When a disclosure is permitted, limit the information shared to what is appropriate for the purpose and follow the covered entity’s instructions.

Emergency circumstances do not create a general permission for a business associate to disclose PHI however it chooses. A PERS provider should follow the BAA, the covered entity’s directions, and applicable HIPAA permissions. For example, a covered entity may be able to disclose PHI for treatment without an individual’s authorization; a business associate may transmit information as authorized to support that activity. If an individual is unavailable or incapacitated, certain limited disclosures to people involved in the individual’s care may be allowed when the covered entity makes the required professional judgment.

When an emergency involves a serious and imminent threat, HIPAA may permit a disclosure to someone reasonably able to lessen or prevent the threat, subject to applicable conditions. In practice, establish procedures in advance for escalation, verify the recipient where feasible, disclose only information relevant to the emergency, and document the action. A business associate should not make an independent disclosure unless the BAA or another applicable legal permission allows it.

In summary, PERS providers should determine their role for each service, use a BAA and subcontractor agreements when required, protect PHI and ePHI through documented safeguards, and share information only within the limits of the agreement and applicable permissions.

FAQs

When is a personal emergency response system provider a HIPAA business associate?

A PERS provider is generally a business associate when it performs a service on behalf of a covered entity or another business associate that involves creating, receiving, maintaining, or transmitting PHI. Whether the provider is a business associate depends on the relationship and the services performed, not simply on whether its technology handles health-related information.

What must a business associate agreement cover?

A BAA must establish permitted and required uses and disclosures of PHI, require appropriate safeguards, address reporting of impermissible uses, disclosures, and security incidents, and impose applicable restrictions on subcontractors. It should also address support for relevant individual-rights obligations and the return or destruction of PHI when the arrangement ends, when feasible.

Does encrypting electronic PHI exempt a provider from HIPAA requirements?

No. Encryption does not exempt a provider from HIPAA. The provider must still meet applicable privacy, security, and breach-notification obligations. Encryption is an addressable Security Rule implementation specification, so the provider must assess whether it is reasonable and appropriate, document its decision, and use appropriate alternatives when required.

When can a provider disclose PHI during an emergency without individual authorization?

A provider acting as a business associate may disclose PHI only as allowed by its BAA or as otherwise required or permitted by law. Depending on the circumstances, HIPAA may permit disclosures supporting treatment, certain limited disclosures when an individual is incapacitated, or disclosures to help prevent or lessen a serious and imminent threat. The provider should follow its agreement and established escalation procedures, share only relevant information, and document the disclosure.