HIPAA Policy Checklist for Organ Procurement Disclosures

Permitted Uses and Disclosures of PHI

Scope and legal basis

As a HIPAA Covered Entity, you may disclose Protected Health Information (PHI) to an Organ Procurement Organization (OPO) and to tissue or eye banks for the purpose of facilitating organ, eye, or tissue donation and transplantation. These disclosures do not require an authorization from the patient or the patient’s personal representative when they are made solely to evaluate and support donation and transplantation.

What you may disclose

Share only the PHI reasonably necessary for donation screening, matching, and placement—such as age, relevant diagnoses, lab results, hemodynamic status, serology, and imaging impressions. Avoid extraneous details (for example, unrelated behavioral health notes or full medical records) unless they are directly pertinent to donation suitability or safety.

Identity verification and secure channels

Before any disclosure, verify the requestor’s affiliation with the OPO, tissue bank, or eye bank. Use secure channels (encrypted phone, secure email, or approved portals) and document the verification step, the specific PHI elements disclosed, and the purpose of the disclosure.

Emergency PHI Disclosure

Time-sensitive cases may require immediate handoffs to prevent missed donor opportunities. You may make an Emergency PHI Disclosure to an OPO when delay would materially impede donation evaluation or organ placement, provided you still apply the Minimum Necessary Rule and document the rationale for urgency.

Accounting of disclosures

Disclosures to OPOs and banks are generally subject to accounting. Record the date, recipient, brief description of PHI, and purpose so you can provide an accounting of disclosures upon request within required timeframes.

Minimum Necessary Standard Compliance

Operationalize the Minimum Necessary Rule

Translate the Minimum Necessary Standard into role-based procedures. Define who on your care team may disclose PHI to an OPO and what fields they may release during each stage of evaluation. Limit access to designated workforce members trained on organ procurement workflows.

Stage-based data minimization

• Initial referral: demographics, current clinical status, ventilator settings, key labs, primary diagnosis.
• Suitability screening: targeted history, infectious risk factors, serology, imaging summaries.
• Placement and logistics: blood type, HLA/compatibility data, relevant timelines, and contact details.

When a full record is requested, require documented justification showing why narrower disclosure is insufficient for donation decisions.

Safeguards and redaction

Maintain templated referral forms that pre-populate only necessary fields. When sharing documents, remove nonessential pages or redact sensitive sections that are not donation-relevant. Periodically audit referrals to confirm ongoing adherence to the Minimum Necessary Rule.

Agreements with Tissue and Eye Banks

Clarify the bank’s role

Confirm whether the tissue or eye bank is receiving PHI as an authorized recipient for procurement activities or providing services on your behalf. If the bank acts on your behalf (for example, data processing unrelated to procurement), a Business Associate Agreement (BAA) is likely required. If it receives PHI solely to facilitate donation and transplantation, a BAA is generally not required for that purpose.

Memoranda of understanding (MOUs)

Use MOUs to set expectations for permitted uses, security safeguards, breach reporting timelines, data retention and destruction, and contact points. MOUs complement, but do not replace, a BAA when the bank is your business associate for other functions.

Verification and secure exchange

Adopt a shared verification protocol with banks (call-back numbers, unique IDs) and specify approved secure exchange methods. Require confirmation of receipt for sensitive data and maintain a log of transmissions.

Organ Procurement Notification Protocols

Triggers and timing

Establish clear triggers for OPO notification (for example, imminent death criteria, ventilated deaths, clinical indicators). Notify your OPO promptly according to your policy to allow timely evaluation and family approach planning.

First-call content

During the initial notification, share the minimum PHI needed: patient initials or ID, age, sex, primary illness/injury, current vitals and support, key lab values, and contraindications noted. Confirm the OPO contact, document the call, and schedule updates as the case evolves.

Coordination and escalation

Define who coordinates ongoing information requests, time windows for lab and imaging updates, and how to escalate after-hours or when decision-makers are unavailable. Re-verify identity if the contact person changes.

Business Associate Agreements Requirements

When a BAA is required

A Business Associate Agreement is required when an OPO, tissue bank, eye bank, or other vendor uses or discloses PHI to perform services or functions on your behalf that fall outside the permitted recipient role for organ procurement. No BAA is generally needed when an OPO receives PHI solely to facilitate donation and transplantation.

Core BAA clauses

• Permitted and required uses/disclosures aligned with your instructions and the Minimum Necessary Rule.
• Administrative, physical, and technical safeguards to protect PHI, including Security Rule compliance for ePHI.
• Prompt breach reporting, mitigation duties, and cooperation in notifications.
• Flow-down obligations to subcontractors handling PHI.
• Right to audit, termination for cause, and PHI return or destruction at end of the engagement where feasible.

Practical scenarios

If an OPO hosts your donor referral portal or analyzes your internal data for quality improvement, a BAA is likely required. If the OPO simply receives your referral information to evaluate a potential donor, it typically is not your business associate for that activity.

Disclosure to Public Health Authorities

When disclosure is allowed or required

Public Health Disclosure of PHI is permitted to authorized public health authorities for reportable conditions, infectious disease investigations, or tracking and recall of biologics. When donation evaluation reveals reportable infections or exposures, disclose to the appropriate authority per law and policy.

Apply minimum necessary and document

Disclose only what the authority needs for its mandate, document the legal basis (for example, reportable condition), record the recipient, and retain related correspondence. Coordinate content and timing with the OPO to avoid duplication or inconsistencies.

Documentation and Training for HIPAA Compliance

Policy artifacts and records to maintain

• Current policies covering OPO notifications, Minimum Necessary Rule application, verification procedures, and secure transmission standards.
• Disclosure logs for OPOs, tissue and eye banks, and public health authorities, retained per record-keeping requirements.
• Executed Business Associate Agreements and MOUs, with version control and renewal dates.
• Risk analyses, security configurations for ePHI exchange, and incident/breach reports.

Training program essentials

Provide role-based training for clinicians, coordinators, and health information staff that includes trigger recognition, exactly what PHI to share at each step, Emergency PHI Disclosure parameters, secure channel use, and documentation. Reinforce with drills and quick-reference job aids.

Auditing and continuous improvement

Audit a sample of cases quarterly for minimum necessary compliance, timeliness of OPO notification, and completeness of logs. Review findings with stakeholders and update workflows, forms, and access controls accordingly.

Conclusion

By defining permitted disclosures, operationalizing the Minimum Necessary Rule, aligning agreements with each partner’s role, standardizing notification protocols, and strengthening documentation and training, you can enable timely organ procurement while safeguarding PHI and meeting HIPAA obligations.

FAQs

What PHI disclosures are permitted for organ procurement under HIPAA?

You may disclose PHI without authorization to an Organ Procurement Organization and to tissue or eye banks when the purpose is to evaluate, facilitate, or coordinate organ, eye, or tissue donation and transplantation. Share only donation-relevant details (for example, clinical status, labs, infectious risk factors) using secure, verified channels, and record the disclosure.

How does the Minimum Necessary Standard apply to OPO disclosures?

The Minimum Necessary Standard applies to disclosures for procurement activities. Limit PHI to what the OPO or bank needs at that specific stage—initial referral, suitability screening, or placement. Use templated forms, redaction, and role-based permissions to enforce data minimization and audit your logs to confirm compliance.

When are Business Associate Agreements required for OPOs?

A Business Associate Agreement is required when an OPO (or a tissue/eye bank) performs services on your behalf that involve PHI beyond its role as a permitted recipient for donation. If the entity simply receives PHI to carry out procurement and transplantation, a BAA is generally not required for that activity. When in doubt, document the role and functions and execute a BAA for any service performed on your behalf.

What documentation is needed for HIPAA compliance in organ procurement?

Maintain policies for permitted uses and disclosures, minimum necessary procedures, identity verification, and secure transmissions; disclosure logs; executed Business Associate Agreements and MOUs; staff training records; risk analyses and security settings for ePHI exchange; and incident or breach reports. Retain records per your retention schedule and be prepared to provide an accounting of disclosures upon request.