HIPAA Compliance Requirements for Tourette Syndrome and Tic Disorder Clinics

HIPAA does not set separate privacy rules for Tourette syndrome or tic disorder clinics. The requirements that apply depend on the clinic’s role and how it handles protected health information (PHI), including electronic PHI (ePHI). The sections below outline the main duties clinics may need to meet.

When Is a Tourette or Tic Disorder Clinic a HIPAA-Covered Entity?

A clinic is generally a HIPAA-covered entity if it is a health care provider that conducts certain standard transactions electronically—for example, submitting electronic insurance claims or checking benefit eligibility. This applies regardless of the clinic’s size, and it can apply when a billing service or another third party conducts the transactions on the clinic’s behalf. HHS guidance on covered entities

Using electronic tools such as email does not, by itself, make a provider a covered entity. The relevant question is whether the clinic transmits health information electronically in connection with a transaction for which HHS has adopted a standard. HHS Privacy Rule overview

In practice, a clinic that bills health plans electronically will often meet the covered-entity test. A clinic should assess its own transactions rather than assume that its specialty, size, or use of electronic records determines its status.

What Privacy Rule Duties Apply to Patient Records and Communications?

The HIPAA Privacy Rule governs how covered clinics use and disclose PHI and gives patients rights concerning their health information. A clinic may generally use or disclose PHI for treatment, payment, and health care operations as permitted by the Rule, and it must give patients a Notice of Privacy Practices explaining its privacy practices and certain rights. HHS Privacy Rule overview

The minimum necessary standard generally requires reasonable steps to limit uses, disclosures, and requests for PHI to what is needed for the purpose. It does not apply to disclosures to, or requests by, a health care provider for treatment purposes, or to disclosures to the patient who is the subject of the information. Clinics should establish role-appropriate access and procedures for non-routine disclosures. HHS minimum necessary guidance

HIPAA permits a clinic to share information directly relevant to a family member’s or other person’s involvement in a patient’s care or payment for care when the patient agrees or has an opportunity to object and does not. If the patient is unavailable or cannot make health care decisions, a provider may share relevant information when professional judgment indicates that doing so is in the patient’s best interest. HHS guidance on family and friends

Which Security Rule Safeguards Protect Electronic PHI?

The HIPAA Security Rule requires covered clinics to protect ePHI’s confidentiality, integrity, and availability through reasonable and appropriate administrative, physical, and technical safeguards. A documented risk analysis should identify where ePHI is created, received, maintained, or transmitted, and assess potential risks and vulnerabilities so the clinic can select and manage safeguards. HHS Security Rule overview HHS risk analysis guidance

Examples of safeguards include workforce security policies and security training; controls on physical access to workstations and facilities; and technical measures such as access control, audit controls, authentication, and transmission security. The appropriate measures depend on the clinic’s circumstances and risk analysis; HIPAA does not prescribe a single security setup for every practice. HHS Security Rule overview

How Should Clinics Manage Business Associates and Written Agreements?

A vendor that creates, receives, maintains, or transmits PHI on a clinic’s behalf may be a business associate. Examples can include a billing service or a vendor providing services that involve access to PHI. When a business associate relationship applies, the clinic generally must obtain written assurances through a business associate agreement (BAA) or other written arrangement that meets HIPAA requirements. HHS business associate guidance

The agreement should describe permitted and required uses of PHI, require appropriate safeguards, address reporting of impermissible uses or disclosures and breaches, and require the business associate to impose applicable protections on subcontractors that handle PHI. A BAA does not replace the clinic’s responsibility to maintain its own HIPAA policies and safeguards. HHS sample BAA provisions

What Are the HIPAA Breach Assessment and Notification Deadlines?

An impermissible use or disclosure of PHI is generally presumed to be a breach unless an exception applies or the clinic demonstrates, through a risk assessment, a low probability that the PHI was compromised. The assessment considers the information involved, who received or used it, whether it was actually acquired or viewed, and how the risk was mitigated. HHS Breach Notification Rule guidance

After discovering a breach of unsecured PHI, a covered clinic must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting 500 or more individuals must also be reported to HHS without unreasonable delay and within that 60-day period. For breaches affecting fewer than 500 individuals, the clinic may report to HHS annually, no later than 60 days after the end of the calendar year in which the breaches were discovered. HHS breach notification requirements

If a breach occurs at or through a business associate, that business associate must notify the covered clinic under the applicable requirements. Clinics should have written procedures for assessing incidents, documenting decisions, and meeting applicable notification duties. HHS Breach Notification Rule guidance

How Can Clinics Provide Patient Access and Protect Privacy in Treatment Areas?

Patients generally have a right to inspect or obtain copies of PHI about them in a designated record set, which can include medical, billing, and other records used to make decisions about them. A clinic must act on an access request within 30 calendar days. If it needs more time, it may take one additional 30-day period by giving the patient a written explanation and the expected completion date within the initial 30 days. HHS guidance on access to designated record sets HHS access response deadlines

In waiting rooms and treatment areas, clinics can use practical safeguards such as speaking quietly about patient information, positioning screens to limit casual viewing, and avoiding unnecessary discussion of patient details in public areas. HIPAA allows certain incidental disclosures when they result from an otherwise permitted use or disclosure and the clinic has applied reasonable safeguards and the minimum necessary standard where applicable. HHS guidance on incidental uses and disclosures

In short, clinics should determine whether they are covered entities, protect PHI through privacy and security safeguards, manage business associate relationships in writing, respond to patient access requests, and follow breach notification requirements when applicable.

FAQs.

Does every Tourette syndrome clinic have to comply with HIPAA?

No. A clinic is generally covered as a health care provider when it conducts certain standard health care transactions electronically, directly or through another party. Using email alone does not make a provider a covered entity. HHS guidance on covered entities

Can a clinic share information with a patient’s family member?

Yes, in some circumstances. A clinic may share information directly relevant to the family member’s involvement in the patient’s care or payment for care when the patient agrees or has an opportunity to object and does not. If the patient is unavailable or lacks decision-making capacity, the clinic may share relevant information when professional judgment indicates it is in the patient’s best interest. HHS guidance on family and friends

How quickly must a clinic notify patients after a breach of unsecured PHI?

The clinic must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. HHS Breach Notification Rule guidance

Can patients request access to their medical records?

Yes. Patients generally may request access to PHI about them in a designated record set. The clinic must act on the request within 30 calendar days, with one additional 30-day period permitted if it provides the required written notice within the initial period. HHS guidance on patient access HHS access response deadlines