Myasthenia Gravis Clinic HIPAA Compliance Checklist

Use this checklist to help your myasthenia gravis clinic protect patient information across clinical care, billing, communications, and the systems your workforce and vendors use. Apply safeguards to protected health information (PHI) in every form and to electronic protected health information (ePHI) in particular.

Document HIPAA Risk Analysis and Mitigation Plans

Complete and document a HIPAA Security Rule risk analysis that identifies where ePHI is created, received, maintained, or transmitted, the threats and vulnerabilities affecting it, and the safeguards already in place. Include clinical records, scheduling and billing systems, staff devices, backups, patient communications, and vendor platforms.

Maintain an electronic protected health information inventory that records the systems and devices involved, who uses them, where data is stored, and how it moves. Use the inventory to assess risks such as lost devices, phishing, inappropriate access, service outages, and vendor incidents.

Document how the clinic will address each identified risk, assign an owner, and track the action through completion. Review the analysis on a regular schedule and when meaningful changes—such as a new system, location, vendor, or workflow—could affect ePHI. HIPAA does not set one universal review interval, so establish a schedule suited to your clinic and document each review.

Assign Privacy and Security Responsibilities

Designate a privacy official to oversee HIPAA Privacy Rule policies and a security official to coordinate Security Rule safeguards. In a small clinic, one person may hold both roles, but responsibilities should still be clearly documented and supported with enough time, authority, and resources.

Write down who approves access, responds to patient requests, manages security issues, reviews vendor arrangements, and coordinates incident response. Make sure staff know how to contact the responsible person promptly, including when that person is unavailable.

Keep current contact details and escalation steps accessible to authorized personnel. Review assignments when staffing or clinic operations change so responsibilities do not become unclear or go unassigned.

Maintain Workforce Policies and Training Records

Maintain written privacy and security policies that explain permitted uses and disclosures of PHI, workforce responsibilities, reporting channels, sanctions for policy violations, and procedures for access, device use, and secure communications. Keep approved versions, review dates, and records of updates.

Train workforce members on clinic policies when they join and when relevant duties or procedures change. Training should cover recognizing inappropriate access, protecting patient information in conversations and messages, securing devices, and reporting suspected incidents. Tailor examples to each person’s role and keep records of attendance, training content, and any follow-up.

Document confidentiality commitments and apply appropriate corrective action when workforce members do not follow clinic policies. The Security Rule includes workforce security and security awareness and training among its administrative safeguards.

Enforce Role-Based Access Controls

Use role-based access control to give each workforce member access appropriate to their job duties. Limit access to the information and functions needed for assigned work, and use unique user accounts so actions can be attributed to individuals.

Require managers to approve access before it is granted. Review permissions periodically and promptly update or disable accounts when staff change roles, leave the clinic, or no longer need access. Establish a controlled process for temporary or emergency access and document its use.

Use multi-factor authentication, especially for remote access, email, and systems containing ePHI, when supported by your risk assessment and available safeguards. Review access and audit activity for unusual patterns, such as access outside a person’s role or repeated failed sign-ins. HIPAA requires appropriate access controls and mechanisms to record and examine activity in systems containing ePHI.

Secure Clinic Facilities and Devices

Protect areas where patient records, workstations, and network equipment are used or stored. Control physical access to staff-only areas, position screens to reduce casual viewing, lock unattended workstations, and secure paper records when not in use.

Maintain procedures for issuing, tracking, securing, and disposing of devices and media that contain ePHI. Encrypt devices where appropriate, use screen locks, and require staff to report loss or theft immediately. Before reusing or disposing of equipment, ensure ePHI is securely removed or the media is destroyed according to clinic procedures.

Apply safeguards to devices used away from the clinic, including laptops and mobile devices, and set clear rules for remote work. The HIPAA Security Rule’s physical safeguards address facility access, workstation use and security, and device and media controls.

Protect Electronic PHI With Technical Safeguards

Use technical safeguards suited to your risk analysis to control access to ePHI and protect it from unauthorized alteration, destruction, or disclosure. Keep systems and applications maintained, configure secure user authentication, and protect ePHI transmitted over electronic networks.

Use encryption where appropriate for stored and transmitted ePHI, secure backups, and test whether the clinic can restore critical information after a system failure. Set up audit log monitoring for systems that contain or use ePHI, and document how often logs are reviewed, who reviews them, and how concerns are escalated.

Keep written procedures for account management, security updates, backup and recovery, and remote access. HIPAA’s technical safeguards include access controls, audit controls, authentication, integrity protections, and transmission security. Multi-factor authentication can strengthen authentication, but select and apply safeguards based on the clinic’s documented risks.

Manage Business Associates and Security Incidents

Identify vendors and service providers that create, receive, maintain, or transmit PHI on the clinic’s behalf, such as billing, hosting, or IT support providers. Before allowing access, determine whether a business associate agreement is required and put the appropriate written agreement in place. Agreements should define permitted uses and disclosures, safeguards, incident reporting, and relevant subcontractor obligations.

Maintain a current vendor list, agreements, and points of contact. Review vendor access and arrangements when services change or end, and address how PHI will be returned or destroyed when appropriate.

Keep written security incident and breach notification procedures. When an incident is discovered, promptly report and contain it, preserve relevant records, investigate what information and systems may be involved, and document the assessment and mitigation. Determine whether the event is a breach of unsecured PHI and follow applicable notification requirements; do not assume every security incident is a reportable breach. HIPAA requires notifications following breaches of unsecured PHI, with the assessment and notification duties depending on the circumstances.

In summary, an effective clinic checklist connects a documented risk analysis with clear responsibilities, trained staff, limited access, secure facilities and systems, and prepared vendor and incident procedures. Keep evidence of reviews and follow-up so the clinic can demonstrate how it protects patient information.

FAQs

How often should a myasthenia gravis clinic review its HIPAA risk analysis?

HIPAA does not prescribe one fixed review interval. Set a regular schedule appropriate to your clinic and revisit the analysis when significant changes—such as a new system, vendor, location, or workflow—or a security incident may affect ePHI risks. Document each review and the actions taken.

Which staff members need HIPAA privacy and security training?

Train workforce members whose duties involve PHI or clinic systems, including clinical, administrative, billing, and IT personnel, as appropriate to their roles. Provide training when they join and when relevant policies or duties change, and keep records of completion.

What should a clinic do after discovering a security incident?

Report and contain the incident promptly, protect affected systems, preserve relevant evidence, and investigate the information and individuals potentially involved. Document the assessment, mitigation, and decision about whether the incident constitutes a breach of unsecured PHI. Follow applicable breach notification procedures when required.

When is a business associate agreement required?

A business associate agreement is generally required when a vendor or other party performs services for the clinic that involve creating, receiving, maintaining, or transmitting PHI on the clinic’s behalf, subject to applicable HIPAA rules and exceptions. Put the required written arrangement in place before allowing the business associate to handle PHI for the clinic.