Prescription Drug Monitoring Program HIPAA Compliance Checklist

Determine HIPAA Applicability

Start by identifying which organizations create, receive, maintain, or transmit prescription drug monitoring program (PDMP) information and what role each organization plays. A state-run PDMP is not automatically a HIPAA covered entity just because it contains health information. HIPAA generally applies to covered entities and their business associates; state law and other federal privacy rules may apply separately.

• Document whether each participating provider, pharmacy, health plan, health information exchange, agency, and service provider is a HIPAA covered entity, business associate, or neither.
• Determine whether the information is protected health information (PHI), including electronic protected health information (ePHI), in the hands of a HIPAA-regulated organization.
• Map applicable federal and state requirements for PDMP reporting, queries, sharing, retention, and redisclosure.
• Record which organization is responsible for each compliance activity, including access approvals, security monitoring, incident response, and required notices.

Do not assume that one organization’s HIPAA status determines every participant’s obligations. Assess each participant, data flow, and purpose separately.

Conduct and Document Risk Analysis

For each HIPAA-regulated organization handling ePHI, perform and document a risk analysis under the HIPAA Security Rule. Include the complete PDMP workflow, from prescription reporting and identity matching to user queries, data exchange, storage, and disposal.

• Inventory systems, interfaces, devices, data stores, and third parties that handle PDMP information.
• Identify foreseeable threats and vulnerabilities, such as compromised credentials, misdirected records, excessive access, insecure interfaces, ransomware, and service outages.
• Assess the likelihood and potential impact of risks to the confidentiality, integrity, and availability of ePHI.
• Document risk ratings, chosen safeguards, responsible owners, remediation deadlines, and accepted residual risks.
• Review the analysis when systems, participants, data flows, or threats change, and track remediation to completion.

A risk analysis should reflect actual PDMP operations, not just a general enterprise security review. Keep the supporting evidence, decisions, and follow-up actions available for compliance review.

Implement Administrative Physical and Technical Safeguards

Use safeguards appropriate to the organization’s risk analysis to protect PDMP information across systems and workflows. The HIPAA Security Rule requires administrative, physical, and technical safeguards for ePHI; specific control choices should be documented and periodically reassessed.

• Administrative: Assign security and privacy responsibilities, train workforce members, apply sanctions for policy violations, manage access approvals, and maintain incident response and contingency procedures.
• Physical: Restrict access to facilities and equipment, protect workstations and devices, and securely dispose of media containing ePHI.
• Technical: Use unique user identities, role-based access control, strong authentication, encryption where appropriate, secure transmission, audit logs, and routine review of system activity.
• Separate testing and production environments, limit data used in testing, and protect credentials and interface secrets.
• Back up essential information, test restoration, and maintain a plan to continue or safely suspend PDMP operations during an outage.

Confirm that safeguards cover interfaces and intermediary systems, not only the PDMP portal. Document how each control addresses risks identified in the analysis.

Verify Requester Identity and Access Authorization

Before allowing a person or system to query PDMP data, verify who is making the request and whether the requester is authorized for that purpose. Apply state PDMP requirements alongside HIPAA policies that govern the regulated organization’s use and disclosure of PHI.

• Verify professional identity, current credentials, organization affiliation, and any required state registration before granting access.
• Use PDMP data exchange authentication that validates the requesting organization and user, protects credentials, and rejects invalid or expired access.
• Grant access based on job duties and the minimum permissions needed; review role-based access control assignments periodically and when roles change.
• Require stronger verification for sensitive actions, such as account changes, bulk queries, or access from unfamiliar devices.
• Log queries, access decisions, and relevant data exchanges; review unusual patterns and investigate suspected inappropriate access.
• Promptly disable accounts when users leave, lose eligibility, or no longer need access.

Do not rely on a successful login alone. Confirm that the request is permitted under applicable law and organizational policy, and retain evidence of the authorization process.

Manage Business Associate and Intermediary Controls

Determine whether an intermediary—such as a health information exchange, integration vendor, cloud service provider, or data-routing service—is acting as a business associate. A business associate agreement is generally required when a covered entity engages a vendor to perform services involving PHI on its behalf, unless a regulatory exception applies. A vendor’s technical role alone does not answer the question; assess the relationship and the work performed.

• Document each intermediary’s function, data handled, purpose of access, and HIPAA role.
• Where required, execute a business associate agreement before the intermediary handles PHI. Address permitted uses and disclosures, safeguards, incident reporting, subcontractors, and return or destruction of information.
• Require business associates to obtain appropriate written assurances from subcontractors that create, receive, maintain, or transmit ePHI on their behalf.
• Set practical requirements for security evidence, incident escalation timelines, access reviews, and cooperation with investigations.
• Review agreements and service arrangements when the intermediary’s services, data access, or subcontracting changes.
• Clarify responsibilities for responding to patient requests, legal demands, and security incidents.

Do not assume that every state PDMP or public agency requires a business associate agreement. Analyze each arrangement under HIPAA and applicable state law, and document the conclusion.

Apply Privacy and Permitted Disclosure Rules

Establish rules for when PDMP information may be accessed, used, and disclosed. HIPAA permission does not eliminate stricter state confidentiality or PDMP laws, and an organization’s authority to query a system does not automatically authorize every subsequent use or disclosure.

• Define approved purposes for collecting, querying, using, and sharing PDMP information, and limit disclosures to what is permitted by applicable law.
• Apply the HIPAA minimum necessary standard where it applies, while considering exceptions and any stricter state requirements.
• Verify the legal basis and recipient before responding to law enforcement, regulatory, public health, or other external requests.
• Set rules for redisclosure, secondary use, patient access requests, retention, and secure disposal.
• Train users to avoid unnecessary copying, screenshots, local downloads, or discussions of identifiable records outside authorized workflows.
• Identify whether records are subject to 42 CFR Part 2 or other heightened confidentiality rules, and apply those rules to access, disclosure, and redisclosure.

42 CFR Part 2 applies to qualifying substance use disorder records, not automatically to every PDMP record. If Part 2 records are involved, determine whether the organization is a Part 2 program or lawful holder and follow the applicable consent, use, disclosure, and breach requirements. The 2024 Part 2 final rule’s compliance date was February 16, 2026, so covered organizations should verify that current procedures reflect its applicable requirements.

Prepare for Breaches and Operational Disruptions

Maintain a response plan for suspected unauthorized access, disclosure, loss, or alteration of PDMP information, as well as outages that interrupt reporting or access. Plans should identify who makes decisions, how participants coordinate, and how records and systems will be restored safely.

• Define how workforce members and intermediaries report suspected incidents, preserve evidence, contain access, and escalate urgent threats.
• Assess whether an incident involves a HIPAA breach, a Part 2 breach, or a state-law reporting event; document the decision and supporting analysis.
• Prepare to notify affected individuals, regulators, and other required parties within applicable deadlines. HIPAA breach notification requirements may apply to breaches of unsecured PHI, and Part 2 has separate breach obligations for unsecured Part 2 records.
• Coordinate investigations and notifications with business associates, subcontractors, state agencies, and other affected participants.
• Test backup restoration, downtime procedures, secure alternate communications, and recovery priorities for critical PDMP services.
• Document response actions, notification decisions, remediation, and lessons learned; update safeguards and training based on findings.

A practical compliance program ties together applicability, risk analysis, safeguards, authorized access, vendor oversight, privacy rules, and incident readiness. Review the checklist whenever a system, participant, data flow, or legal requirement changes.

FAQs

Does HIPAA apply to every prescription drug monitoring program?

No. HIPAA applies to covered entities and their business associates, not automatically to every state PDMP or participant. A provider or vendor may have HIPAA obligations based on its own status and activities, while PDMP operations may also be governed by state law or other federal rules.

What safeguards should protect PDMP data exchanges?

Use verified identities, strong authentication, role-based access control, secure transmission, encryption where appropriate, audit logging, and monitoring for unusual activity. Document the risk analysis behind the safeguards, limit access to authorized users and purposes, and test incident response and recovery procedures.

When is a business associate agreement required for a PDMP intermediary?

A business associate agreement is generally required when a covered entity engages an intermediary to perform services on its behalf that involve PHI, unless an exception applies. Assess the parties’ roles, the services performed, and the information handled; do not assume that every intermediary or state PDMP has the same status.

How do 42 CFR Part 2 restrictions affect PDMP records?

Part 2 protects qualifying substance use disorder records and may restrict their use, disclosure, and redisclosure even when information is accessible through a PDMP workflow. Determine whether the records are subject to Part 2 and whether the organization is a Part 2 program or lawful holder, then apply the relevant consent and disclosure rules alongside HIPAA and state law.