Montana Hospice Patient Records Privacy Laws Checklist (HIPAA and State Requirements)

HIPAA Privacy Rule Protections

What the Privacy Rule requires

• Identify your designated record set (DRS) and apply the minimum necessary standard to all non-treatment uses and disclosures.
• Issue and post a clear Notice of Privacy Practices and honor patient preferences for confidential communications.
• Fulfill right-of-access requests within 30 days (one extension permitted), in the format requested when readily producible, including electronic copies from your EHR.
• Maintain an accounting of disclosures, privacy policies, and workforce training documentation for the required HIPAA documentation retention period.
• Recognize personal representatives and next of kin as allowed by state law and document verification steps.

Patient Authorization Requirements

Obtain a HIPAA-compliant authorization for disclosures not permitted by law (for example, marketing unrelated to care). A valid authorization identifies the information, the sender and recipient, purpose, expiration date or event, the individual’s signature and date, and the revocation process. Inform patients of potential re-disclosure risks once PHI leaves your control.

Hybrid Entity Designation

If your hospice operates within a larger organization (for example, a county health department or health system), formalize a Hybrid Entity Designation. Clearly define the hospice health care component, segregate PHI from non-covered components, and implement firewalls so only authorized workforce members access PHI.

HIPAA Security Rule Safeguards

Administrative safeguards

• Complete an enterprise risk analysis at least annually; track remediation in a living risk management plan.
• Implement role-based access, sanctions for violations, vendor due diligence, and Business Associate Agreements.
• Maintain contingency and disaster recovery plans, data backup testing, and incident response procedures.

Technical safeguards

• Require unique user IDs, multi-factor authentication, automatic logoff, and robust audit controls for all systems handling ePHI.
• Encrypt ePHI in transit and at rest; use secure messaging instead of SMS for care coordination.
• Continuously monitor endpoints and mobile devices with patching, device encryption, and remote wipe.

Electronic Health Record Safeguards

Configure your EHR with Health Information Security Protocols that enforce least-privilege access, “break-the-glass” emergency access with justification, and immutable audit logs. Validate export and patient portal settings to ensure releases match minimum necessary and authorization scopes.

Montana DPHHS Compliance

Licensure and policy alignment

Align hospice policies with Montana DPHHS licensing standards for documentation, confidentiality, and record maintenance. Keep procedures current for admissions, consents, interdisciplinary group coordination, and patient rights consistent with state expectations.

Plan of Care Documentation

Maintain a comprehensive plan of care for each patient, updated by the interdisciplinary team. Include physician orders, goals, interventions, medication profiles, visit notes, and changes in condition. Ensure signatures, dates, and timely updates are captured in the record.

State law interplay

Montana’s health information rules work alongside HIPAA. When state law is more protective of privacy or prescribes specific processes (for example, disclosures to family or access parameters), follow the stricter standard. Document how your policies satisfy both HIPAA and DPHHS requirements.

Protected Health Information Definitions

PHI and designated record set

Protected Health Information (PHI) is individually identifiable health data created or received by your hospice. Your designated record set includes medical and billing records you use to make decisions about a patient, such as assessments, plan of care documentation, visit notes, orders, and claims.

De-identified data and limited data set

De-identified data meets HIPAA’s safe harbor or expert determination and is no longer PHI. A Limited Data Set excludes direct identifiers but remains PHI that can be shared for research, public health, or operations with a Data Use Agreement.

Personal representatives

Recognize a patient’s personal representative under state law (for example, a legal guardian or someone holding a valid power of attorney). Verify authority, record it in the chart, and honor the representative’s rights to access and authorize disclosures.

PHI Disclosure Exceptions

Permitted uses and disclosures without authorization

• Treatment, payment, and health care operations activities.
• Public health reporting, abuse/neglect reporting, health oversight, and required-by-law disclosures.
• Judicial and administrative proceedings, law enforcement purposes, coroners/medical examiners, organ donation, and workers’ compensation.
• To avert a serious threat to health or safety, consistent with law and professional judgment.

Compulsory Process Disclosure

When responding to a court order, subpoena, or other compulsory process disclosure, release only the minimum necessary information. For subpoenas without a court order, seek satisfactory assurances (patient notice or protective order) or obtain patient authorization before disclosing. Log disclosures when required and preserve records subject to litigation holds.

Medical Record Retention Requirements

HIPAA documentation retention

Retain HIPAA-required documentation—policies, procedures, authorizations, notices, training, risk analyses, breach logs, and complaint records—for at least six years from the date of creation or last effective date, whichever is later.

Clinical record Medical Record Retention Period

Set a written Medical Record Retention Period that satisfies Montana DPHHS standards, payer contracts, and risk management needs. A conservative baseline many hospices use is: keep adult clinical records at least 10 years after the last date of service; for minors, retain until at least age 28 (age of majority plus 10 years). Maintain Medicare cost-report and related financial records for no less than five years.

Storage, destruction, and EHR migration

• Store records securely with role-based access and encryption; keep offsite backups.
• Apply documented destruction processes: cross-cut shredding or certified wiping with destruction logs.
• During EHR transitions, migrate the designated record set and preserve legacy access or readable exports for the full retention period.
• Implement litigation holds to suspend routine destruction when disputes or audits are reasonably anticipated.

Confidentiality and Access Controls

Role-based access and minimum necessary

Grant the least access needed to perform a job. Segment sensitive modules (for example, bereavement notes or psychotherapy notes) and require enhanced approvals for non-routine access.

Requests for information (ROI)

Centralize ROI with identity verification, request tracking, and standardized fee schedules. Support patient-directed electronic access to third-party applications via your EHR APIs while protecting security tokens and scopes.

Monitoring and workforce management

• Review audit logs for anomalous access; investigate and resolve alerts promptly.
• Provide onboarding and annual training on privacy, security, phishing, and incident reporting.
• Deprovision access immediately at role change or termination; retrieve devices and revoke tokens.

Summary

Build your compliance program around HIPAA’s privacy and security standards, Montana DPHHS documentation expectations, and a retention policy that favors patient safety and legal readiness. Use robust Electronic Health Record safeguards, clear Patient Authorization Requirements, and disciplined access controls to keep PHI private, available, and accurate.

FAQs.

What are the key HIPAA requirements for hospice patient records?

You must protect PHI under the Privacy Rule, secure ePHI under the Security Rule, honor patient rights (access, amendments, restrictions), apply minimum necessary, and maintain required documentation for six years. Implement Health Information Security Protocols and Business Associate Agreements.

How long must Montana hospice records be retained?

Adopt a policy that meets state licensing and payer standards: a widely used baseline is at least 10 years after the last date of service for adults, and until at least age 28 for minors. Keep HIPAA documentation for six years, and preserve Medicare cost-report records for no less than five years.

When can PHI be disclosed without patient authorization?

For treatment, payment, and operations; when required by law; for public health and oversight; to report abuse or neglect; for certain law enforcement and judicial needs; for decedents and organ donation; to avert serious threats; and for workers’ compensation. Use minimum necessary and document compulsory process disclosure steps.

What rights do patients have to access their medical records?

Patients (or verified personal representatives) can inspect or obtain copies of their designated record set, usually within 30 days, in paper or electronic form when readily producible. They may request amendments, set confidential communication preferences, and ask for an accounting of certain disclosures.