HIPAA Training for Biorepository Specimen Management Teams

What HIPAA requires when handling biorepository specimens

HIPAA applies to covered entities and their business associates—not automatically to every biorepository or research team. When an organization is covered by HIPAA, its Privacy, Security, and Breach Notification obligations apply to protected health information (PHI) it creates, receives, maintains, or transmits. A specimen may be linked to PHI through its label, accession number, linked records, or other information that identifies the donor.

For research use of PHI, the covered entity generally needs an individual’s authorization or a permitted alternative, such as an Institutional Review Board or Privacy Board waiver. A covered entity may also disclose a limited data set for research under a data use agreement; a limited data set remains PHI and has specific restrictions. Review the HHS guidance on HIPAA and research before using or disclosing identifiable specimen information.

HIPAA requires covered entities to train workforce members on relevant policies and procedures as necessary and appropriate for their roles. Follow your organization’s training and specimen-handling policies; a training completion certificate documents training, not organizational HIPAA compliance. Federal HIPAA rules do not establish a universal annual certificate-renewal requirement.

How to protect identifiers on specimen labels and records

Use the identifiers permitted by your approved protocol and institutional procedures. Where possible, use a coded specimen ID on containers and keep the link between that code and the donor’s identity in a separate, access-restricted system. A code does not by itself make information de-identified if the organization can use the link to identify the individual.

Protect paper logs, requisitions, inventory systems, and electronic records as well as the physical label. Avoid displaying donor names or other identifiers where people without a work-related need can see them. For electronic PHI, use individual accounts rather than shared credentials, and follow approved safeguards for access and transmission.

HIPAA’s minimum necessary standard generally requires covered entities to take reasonable steps to limit PHI to what is needed for the purpose. It does not apply to every situation—for example, the standard generally does not apply to a use or disclosure made pursuant to an individual’s authorization.

Who may access protected health information and specimens

Access should be limited to workforce members and other authorized users whose duties require it. Set permissions by role, the information needed for that role, and the conditions under which access is appropriate. For example, a processing technician may need a coded specimen ID and handling instructions without needing the donor’s name or full medical record.

For electronic PHI, HIPAA’s Security Rule requires unique user identification and audit controls. Assign accounts individually, remove or adjust access when responsibilities change, and do not share passwords or logins. See HHS guidance on unique user identification and the minimum necessary standard.

Before providing PHI to a researcher or another organization, confirm the permitted basis for the disclosure and follow your institution’s approval and documentation process. Depending on the circumstances, that may require an authorization for research use, a waiver of authorization, or a data use agreement for a limited data set.

How to receive store transfer and dispose of specimens securely

When receiving specimens, confirm that the shipment and accompanying records are expected, route them through approved staff, and promptly secure any documents or containers displaying identifiers. Record receipt and subsequent movement in the approved inventory or chain-of-custody system. These are practical safeguards; follow your organization’s procedures for the specific specimen and study.

Store specimens and linked records so unauthorized people cannot access them. Restrict access to storage areas and systems, secure paper files, and use your institution’s approved methods for sending PHI. Before transferring specimens or records, verify the recipient and authorization for the transfer, use approved packaging and transmission procedures, and document the handoff as required by local policy.

Dispose of PHI using safeguards appropriate to its form and sensitivity. HHS explains that covered entities must have policies for disposal, must not abandon PHI where unauthorized people can access it, and may use methods such as shredding paper records or clearing, purging, or destroying electronic media. HIPAA does not prescribe one disposal method for every situation; see HHS guidance on disposing of PHI.

What to do after a privacy or security incident

If a label, record, shipment, or electronic account may have exposed identifiers, promptly report it through your organization’s privacy or security incident process. Share what happened, when it happened, what information or specimens were involved, who may have received or accessed them, and what containment steps you took. Preserve relevant records and follow instructions from your privacy or security team; do not independently decide that an incident is not reportable.

The organization must assess whether an impermissible use or disclosure constitutes a breach under the Breach Notification Rule. The assessment considers factors including the information involved, who received it, whether it was actually acquired or viewed, and the extent to which the risk was mitigated. If notification is required, the covered entity generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery; separate reporting rules also apply. Consult the HHS Breach Notification Rule guidance. Staff should follow internal reporting deadlines, which may be earlier than HIPAA’s outer notification deadline.

How to apply HIPAA rules to coded and de-identified specimens

Coded specimens are not automatically de-identified under HIPAA. If a covered entity or business associate can link the code to an individual, or the associated information identifies the donor, the linked information may still be PHI. Keep any code key separate and restrict access, but do not treat coding alone as a substitute for the required HIPAA analysis.

HIPAA recognizes two methods for meeting its de-identification standard: removing the specified identifiers under the Safe Harbor method, or obtaining an expert determination that the risk of identifying an individual is very small. Under Safe Harbor, the covered entity must also lack actual knowledge that the remaining information could identify the individual. Review the HHS de-identification guidance before describing information or specimens as de-identified.

A limited data set is different: it excludes specified direct identifiers but remains PHI, and disclosure for research generally requires a data use agreement. HIPAA status is also distinct from whether research involving coded specimens is human-subjects research under other rules. HHS explains that separate conditions apply to that determination in its guidance on coded private information and biospecimens.

In practice, protect linked identifiers, limit access to what each role needs, follow approved research permissions, and use your organization’s reporting and disposal procedures. Treat coded data as potentially identifiable unless the appropriate HIPAA de-identification method has been established.

FAQs

Does HIPAA apply to coded biorepository specimens?

Coding alone does not make a specimen’s linked information de-identified. If a covered entity or business associate can link the code to the donor, or the related records identify the donor, HIPAA may apply to that PHI. Assess the specimen and its associated information under your organization’s privacy procedures.

When does specimen information qualify as de-identified under HIPAA?

It qualifies when it meets one of HIPAA’s two methods: the Safe Harbor method, which removes specified identifiers and satisfies its additional conditions, or an expert determination that the risk of identification is very small. A coded identifier by itself does not establish de-identification.

Who can access specimen records containing protected health information?

Only people with appropriate authorization and a work-related need should access them, subject to the organization’s role-based access policies and applicable research permissions. Access should be limited to the PHI needed for the task when the minimum necessary standard applies.

What should staff do if specimen identifiers are disclosed accidentally?

Report the incident promptly through your organization’s privacy or security process. Provide the relevant facts, preserve records, and follow instructions from the privacy or security team. The organization—not an individual staff member acting alone—determines whether the incident is a breach requiring notification.