HIPAA Training for Donor Recruitment Coordinators: Privacy Rules and Best Practices

Donor recruitment coordinators may handle sensitive information while contacting potential donors, supporting donor families, and coordinating with transplant teams. HIPAA requirements depend on the organization’s role and the information involved, so follow your organization’s privacy policies and confirm uncertain disclosures with its privacy officer.

What donor information qualifies as protected health information?

Protected health information (PHI) is individually identifiable information about a person’s past, present, or future physical or mental health, health care, or payment for health care. It can be spoken, written, or electronic. Names, contact details, dates, medical history, screening results, eligibility information, and transplant outcomes can qualify when connected to those topics and identifiable to a person. See the HHS Summary of the HIPAA Privacy Rule.

A name or contact detail by itself is not necessarily PHI. But linking it to a person’s donor evaluation, medical status, or transplant care may make it identifiable health information. Treat donor and recipient records as sensitive, and use approved channels even when you are unsure whether a particular data item meets HIPAA’s definition.

Which HIPAA rules govern donor recruitment and outreach?

The HIPAA Privacy Rule governs permitted uses and disclosures of PHI; the Security Rule sets safeguards for electronic PHI; and the Breach Notification Rule covers notification duties after certain breaches of unsecured PHI. HIPAA generally applies to covered entities—such as qualifying health care providers, health plans, and health care clearinghouses—and their business associates. A coordinator’s job title alone does not determine whether HIPAA applies: the organization’s role does. Staff and volunteers working under a covered entity or business associate must follow its applicable policies. See HHS guidance on covered entities and business associates.

For a covered entity, treatment, payment, and health care operations are permitted purposes for using or disclosing PHI, subject to the Privacy Rule’s conditions. Donor recruitment or outreach is not automatically covered by those purposes just because it supports a donation program. Before using PHI in outreach, confirm the organization’s authority, the purpose, and any applicable authorization or other permission with the privacy officer. See HHS guidance on treatment, payment, and health care operations.

For deceased-donor organ, eye, or tissue donation, the Privacy Rule has a specific provision permitting certain disclosures to organizations involved in procurement, banking, or transplantation to facilitate donation and transplantation. That provision is limited to its stated purpose; it does not create a general permission to share identifiable information with a donor’s family or a recipient. See 45 CFR § 164.512.

How should coordinators limit access to donor records?

Use role-based access: access only the records and details you need for your assigned duties. The HIPAA minimum necessary standard generally requires covered entities to make reasonable efforts to limit many uses, requests, and disclosures to what is needed for the purpose. A specific exception applies to disclosures to, or requests by, a health care provider for treatment; do not assume that exception covers recruitment, family communications, or other outreach. See HHS guidance on the minimum necessary standard.

• Use your own authorized account; never share passwords or leave an active session unattended.
• Open records only when needed for your work, and avoid browsing out of curiosity.
• Check recipients and attachments before sending messages, and use organization-approved communication systems.
• Keep donor and recipient details out of public areas, personal devices, and unapproved spreadsheets or messaging apps.
• Follow your organization’s procedures for documenting access and sharing.

When can donor information be shared with recipients or providers?

Sharing PHI with a health care provider for the recipient’s treatment may be permitted without written authorization under HIPAA, provided the disclosure is made by an authorized person and complies with the applicable rules and organizational policy. A coordinator should confirm the provider’s identity, the treatment-related purpose, and the approved process before sending records. HIPAA’s treatment permission does not automatically authorize coordinator-to-recipient or donor-family-to-recipient disclosures. See HHS guidance on permitted treatment disclosures.

For donor-recipient information sharing in organ transplantation, use the organization’s established process for the specific situation. HRSA’s guidance distinguishes living donation from deceased donation and recommends that transplant centers and organ procurement organizations develop clear policies for confidentiality and information exchange. It is guidance for the transplant community, not a blanket HIPAA authorization to disclose anyone’s identity or medical details. See HRSA guidance for donor and recipient information sharing.

When a proposed disclosure is not otherwise permitted or required, obtain a valid written authorization from the person whose PHI would be disclosed, unless the privacy officer confirms another legal basis. An authorization should describe the information, who may disclose it, who may receive it, and the purpose and duration, as required by the applicable rules. Permission from one person does not automatically authorize disclosure of another person’s PHI. See HHS’s summary of authorization requirements.

What administrative, technical, and physical safeguards protect donor privacy?

The HIPAA Security Rule requires covered entities and business associates to use appropriate administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of electronic PHI. The particular safeguards should reflect the organization’s risk assessment and operations. See HHS’s overview of the Security Rule.

• Administrative safeguards: Follow privacy and security policies, complete required employer-specific training, use approved procedures for access and disclosure, and report security concerns promptly.
• Technical safeguards: Use unique logins, access controls, secure transmission methods, and audit or monitoring processes provided by your organization.
• Physical safeguards: Secure paper files and devices, lock screens when stepping away, restrict access to work areas, and use approved procedures to store or dispose of records.

These are examples of protective practices, not a substitute for your organization’s security program. Follow the safeguards and workflows established by your employer or contracting organization.

How should coordinators respond to privacy risks and unauthorized disclosures?

Report suspected loss, misdirected messages, unauthorized access, or improper disclosure immediately through your organization’s incident-reporting process. Notify the privacy or security officer, preserve relevant messages and records, and provide accurate facts about what happened, when it occurred, what information may be involved, and who may have received or accessed it. Do not delete evidence, investigate beyond your role, or notify affected people or outside parties unless authorized.

The organization—not an individual coordinator—assesses whether an incident is a reportable breach, including whether an exception or risk assessment applies. For breaches of unsecured PHI, HIPAA notification rules generally require covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovery; different reporting requirements apply based on the number of people affected. A business associate must notify the covered entity under the applicable rule and its agreement. See the HHS Breach Notification Rule.

Conclusion

Protect donor and recipient information by understanding what may count as PHI, using only authorized access, and confirming the legal basis before sharing identifiable details. Follow your organization’s safeguards and donor-recipient information-sharing procedures, and promptly escalate suspected privacy incidents.

FAQs

Does HIPAA apply to donor recruitment coordinators?

It depends on the organization and the coordinator’s role. HIPAA applies to covered entities and business associates; coordinators who are workforce members of those organizations must follow the applicable privacy and security policies. A donor-related role alone does not establish that a person or organization is covered by HIPAA.

What donor information can coordinators share with a recipient?

Share only information the organization has approved for that recipient and purpose. PHI may be shared with a health care provider for treatment under HIPAA’s permitted-disclosure rules, but that does not automatically allow direct disclosure to a recipient or donor family. Use the organization’s donor-recipient sharing process and verify authorization or another applicable legal basis before disclosing identifiable information.

When is written authorization required to disclose donor information?

For a covered entity, written authorization is generally required when a use or disclosure of PHI is not otherwise permitted or required by HIPAA. The exact requirements depend on the purpose, the information, and any applicable exception. Ask the privacy officer to confirm whether a valid authorization is needed and that it covers the planned disclosure.

What should a coordinator do after a suspected privacy breach?

Promptly report it through the organization’s incident process and notify the privacy or security officer. Preserve relevant evidence and provide the known facts, but do not independently decide whether the incident is a reportable breach or contact affected people unless instructed. The organization evaluates the incident and manages any required notices.