HIPAA Training for Child Fatality Review Team Staff

Child fatality review teams bring together professionals to examine a child’s death and identify opportunities to prevent future deaths. Their work may involve sensitive medical, family, child-welfare, and investigative records. Training should help you understand when protected health information (PHI) may be accessed, how it must be safeguarded, and which rules apply to your role.

HIPAA does not automatically give every review team access to health records. The legal basis for sharing information depends on the team’s authority, the participating organizations, applicable state law, and the circumstances of the request. Confirm the rules with your organization’s privacy officer or legal counsel before accessing or sharing identifiable case information.

What HIPAA requires of child fatality review team staff

HIPAA applies to covered entities—health plans, health care clearinghouses, and certain health care providers—and to business associates that handle PHI on behalf of covered entities. A person’s membership on a child fatality review team, by itself, does not make that person or the team a covered entity or business associate. The status of each organization and its role in handling the information matter. See HHS’s overview of covered entities and business associates.

If you handle PHI as part of a covered entity’s workforce, that organization must train you on its Privacy Rule policies and procedures as appropriate to your duties. HIPAA does not set a universal annual-training schedule for every review team member. Your employer or team may require recurring training under its own policies, state law, contract, or professional rules.

The HIPAA Privacy Rule governs permitted uses and disclosures of PHI. The HIPAA Security Rule requires covered entities and business associates to use reasonable and appropriate administrative, physical, and technical safeguards to protect electronic PHI. Training should connect both rules to your actual responsibilities: what you may access, where you may discuss a case, and how to protect records and devices. HHS summarizes the Privacy Rule and the Security Rule.

When child fatality review teams may access protected health information

A team’s prevention mission does not, on its own, authorize disclosure of PHI. Before requesting or receiving identifiable health information, establish the legal basis that applies to the case. Depending on the circumstances, it may include a disclosure required by state or federal law, a disclosure to a public health authority legally authorized to receive it, or a valid individual authorization. The Privacy Rule also permits certain disclosures for specified public-interest purposes, but those permissions have conditions.

For example, HIPAA permits disclosures required by law, including a statute or regulation. It also permits certain disclosures to public health authorities authorized by law to receive information for public health purposes. A child fatality review team is not automatically a public health authority simply because it reviews deaths. Confirm that the team or requesting agency meets the applicable definition and has authority to receive the requested records. HHS explains these limits in its guidance on HIPAA and public health activities.

If no permitted legal basis applies, the covered entity generally needs a valid authorization before disclosing PHI for the review. A team’s confidentiality pledge or meeting agreement is useful, but it does not replace a HIPAA authorization or another legal basis for disclosure. HHS explains when an authorization is required.

When the minimum necessary standard applies, the covered entity should limit the information used, requested, or disclosed to what is reasonably needed for the purpose. The standard has exceptions, including disclosures required by law, disclosures pursuant to a valid authorization, and certain treatment disclosures. It is a rule for regulated entities—not a blanket permission for team members to request entire records. See HHS’s guidance on the minimum necessary standard.

How to share and safeguard case information

Use only approved channels and systems when working with case information. Follow your organization’s access controls, keep paper records secured, lock screens when stepping away, and avoid discussing identifiable details where people without a work-related need can overhear. For electronic PHI, use safeguards required by your organization, such as authorized accounts and approved secure transmission methods.

Limit access to people who are authorized for the specific review purpose. Do not assume that attendance at a meeting, employment in a partner agency, or participation in a multidisciplinary team gives someone permission to see every record. Before sharing, confirm the recipient’s role, the permitted purpose, and the scope of information allowed under the applicable law and team procedures.

Business associate agreements (BAAs) may be required when a covered entity engages a business associate to perform services involving PHI. A BAA sets permitted uses and disclosures and requires safeguards, among other provisions; it does not independently authorize every disclosure to a review team. HHS describes the required elements of business associate agreements.

When the review purpose allows it, use de-identification to reduce the risk of identifying a child or family. HIPAA recognizes two methods: Safe Harbor, which removes specified identifiers and meets related conditions, and Expert Determination, which documents a qualified expert’s finding that identification risk is very small. Simply removing a child’s name may not be enough; rare circumstances or combinations of details can still identify a family. HHS provides guidance on de-identification of health information.

What state laws and team agreements add to HIPAA requirements

State laws may establish a review team’s authority, identify which agencies or professionals may participate, and specify what records they may obtain or share. They may also add confidentiality protections or restrictions that are more protective than HIPAA. HIPAA’s relationship with state law is fact-specific; do not assume that a team statute overrides every other confidentiality rule. HHS explains how the Privacy Rule addresses potential conflicts with state laws.

Team agreements can set practical rules for handling records: who may receive materials, how case documents are stored, whether information may be discussed outside meetings, and when copies must be returned or destroyed. These agreements can strengthen confidentiality and clarify responsibilities, but they do not create a HIPAA disclosure permission that the law does not otherwise provide. The same is true of a BAA: it governs a business associate relationship and is not a general substitute for legal authority to disclose PHI.

Because child fatality review statutes and confidentiality rules differ by jurisdiction, training should direct you to the current state statute, agency policies, and team agreement that apply to your work. Ask the privacy officer or counsel to resolve uncertainties before requesting or redistributing identifiable case information.

How to respond to privacy breaches or unauthorized disclosures

If you discover that information was sent to the wrong recipient, accessed without authorization, lost, or discussed inappropriately, promptly notify your supervisor and the privacy or security officer identified in your organization’s policy. Include what information was involved, who may have received or accessed it, when it happened, and what steps have already been taken. Preserve relevant messages or records and follow instructions; do not conduct an independent investigation or notify affected families or outside agencies unless you are assigned that responsibility.

An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity or business associate establishes an applicable exception or documents a risk assessment showing a low probability that the PHI was compromised. The regulated organization determines whether notification is required and handles any required notices under the Breach Notification Rule. HHS describes the Breach Notification Rule, including its risk-assessment factors and notification duties.

Follow the organization’s incident-response process even if you are unsure whether the event meets HIPAA’s definition of a reportable breach. Early reporting allows the responsible organization to contain further disclosure, assess the facts, document its decision, and meet any applicable deadlines.

What practical scenarios should HIPAA training cover

Scenario-based training helps you apply rules to the work you actually do. Practice how to respond when:

• A team requests a hospital record, but the requester cannot identify the statute, authorization, or other legal basis for disclosure.
• A participant asks to email case notes to a personal account or store them on an unapproved device.
• A meeting attendee wants to share a case detail with a colleague who is not authorized to receive it.
• A public presentation or report includes details that could identify a child or family even though names have been removed.
• A file is sent to the wrong person, a device containing case information goes missing, or someone accesses a record without a work-related need.
• A team member assumes that a confidentiality agreement or BAA alone permits a covered entity to disclose PHI.

For each scenario, training should reinforce the same habits: verify authority before access, share only through approved channels and within permitted limits, protect records from unnecessary exposure, and promptly report suspected incidents. These steps support a review process that can learn from a child’s death while respecting the privacy rules that govern sensitive case information.

FAQs

Are child fatality review team members covered by HIPAA?

Not automatically. HIPAA applies to covered entities and their business associates, not to every person or group that handles health information. A team member may have HIPAA duties through their employer or role, and a team organization may be covered or act as a business associate depending on its functions. Check with the relevant organization’s privacy officer.

When may a child fatality review team access protected health information?

Only when the disclosure is permitted or required under an applicable legal basis, such as a state law requiring disclosure, a qualifying public-health disclosure, or a valid authorization. Team membership or a prevention purpose alone does not automatically authorize access. The covered entity should confirm the authority and apply the minimum necessary standard when it applies.

Can team members share case information outside review meetings?

Only when the sharing is permitted by applicable law and team policy, and the recipient is authorized to receive the information. A confidentiality agreement may impose additional restrictions, but it does not by itself authorize a HIPAA disclosure. Use de-identified information when appropriate and approved.

Does HIPAA require child fatality review staff to complete annual training?

HIPAA requires covered entities to train workforce members on relevant Privacy Rule policies and procedures as necessary and appropriate for their duties, including new workforce members within a reasonable period and when material policy changes affect their work. It does not establish a universal annual training requirement for every child fatality review team member. Employers, state laws, contracts, or team policies may require annual or other recurring training.