Pulmonary Embolism Response Team HIPAA Compliance Checklist

A Pulmonary Embolism Response Team (PERT) may bring clinicians together quickly to review a patient’s condition, imaging, and treatment options. Because those discussions can involve protected health information (PHI), your team should define who may participate, use approved communication and record-sharing tools, and follow your organization’s privacy and security policies.

Use this checklist to guide review with your organization’s privacy, security, and clinical leaders. HIPAA obligations depend on whether an organization or person is a covered entity or business associate and on how the PERT is organized; the checklist is not a substitute for your organization’s legal or compliance review. See the HHS overview of covered entities and business associates.

What patient information does a PERT handle during case review?

During case review, PERT members may use patient identifiers, symptoms, medical history, medications, laboratory results, CT scans, echocardiograms, and information about the care being considered. When individually identifiable health information relates to a person’s health, health care, or payment for care, it may be PHI. The format does not change that: information discussed aloud or shown on screen can also be PHI. See HHS guidance on protected health information.

• Define the treatment purpose. Document whether the case discussion is for consultation or coordination of care, quality improvement, research, or another purpose. Do not assume that every PERT activity has the same HIPAA basis.
• Identify authorized participants. Establish which treating providers and other authorized personnel may join, and how the team verifies their identities and roles.
• Limit unnecessary exposure. Share the clinical information needed for the discussion, and avoid displaying unrelated records or cases where they are not needed.
• Apply the minimum necessary standard where it applies. HIPAA generally calls for reasonable limits on PHI uses and disclosures, but the minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment purposes. Even when that exception applies, follow organizational access and privacy safeguards. See HHS minimum necessary guidance.

How should teams secure PERT calls and web-based case discussions?

Use communication systems approved by your organization for the type of information and discussion involved. For treatment-related telehealth or remote communication, HHS says covered providers and health plans must use technology vendors that comply with HIPAA and enter into business associate agreements (BAAs) when the vendor is acting as a business associate for the service. See HHS guidance on HIPAA rules for telehealth technology.

• Confirm vendor arrangements. Determine whether a platform provider creates, receives, maintains, or transmits PHI on behalf of a covered entity. If it is a business associate, confirm the required written agreement is in place. HHS describes key BAA requirements in its business associate contract guidance.
• Control meeting access. Use individual accounts, appropriate authentication, restricted invitations, and a process for removing access when a participant no longer needs it. Avoid public links and unattended meeting rooms.
• Protect the discussion environment. Ask participants to join from a private location, use headsets where appropriate, and avoid exposing patient names or records to people outside the care discussion.
• Review recording and transcription settings. Disable recording, automated transcription, or meeting summaries unless they are authorized, necessary, and covered by organizational policy and any applicable vendor agreement.
• Assess safeguards based on risk. The HIPAA Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards for electronic PHI (ePHI), including access controls, audit controls, and transmission security. Encryption is an addressable implementation specification: organizations must assess whether it is reasonable and appropriate and document and address the decision as required. See the HHS Security Rule summary and HHS encryption FAQ.

How should patient images and clinical records be shared?

Share CT scans, echocardiograms, and related records through approved clinical systems, such as an authorized imaging viewer or secure health record workflow. Do not assume an image is de-identified because it lacks a visible patient name: associated records, embedded metadata, labels, or other identifying details may still connect it to a patient.

• Verify the recipient and case. Confirm that the correct patient and intended PERT participants are selected before sending or displaying a file.
• Use controlled access. Prefer systems that authenticate users and restrict access according to assigned roles. Avoid personal email, consumer file-sharing accounts, or unapproved messaging tools for PHI.
• Check the full file and its context. Review image overlays, metadata, filenames, and accompanying notes for identifiers before sharing information for a purpose that calls for de-identification.
• Protect data in transit. Use organization-approved methods that protect ePHI against unauthorized access while it travels over a network. HHS identifies transmission security as a Security Rule safeguard; see the HHS Security Rule summary.
• Apply formal de-identification when required. HIPAA recognizes two methods: Safe Harbor and Expert Determination. Safe Harbor requires removing specified identifiers, including full-face photographs and comparable images, and having no actual knowledge that remaining information could identify the person. See HHS de-identification guidance.

What safeguards apply to PERT activation and treatment recommendations?

HIPAA does not provide a separate PERT activation checklist. The relevant safeguards depend on the organizations and people involved, the purpose of the communication, and how PHI is used or disclosed. HIPAA generally permits covered entities to use or disclose PHI for treatment without an individual’s authorization, including provider consultation about care. See HHS guidance on treatment, payment, and health care operations.

• Define the activation pathway. Specify who may initiate a case review, how participants are identified, and which approved channels are used for urgent discussions.
• Use role-based access control. Assign permissions according to participants’ responsibilities and the information they need to perform their duties. HHS explains that the Security Rule requires access controls for authorized persons and that covered entities must develop role-based policies for workforce access. See the Security Rule summary and HHS treatment disclosure guidance.
• Keep the clinical record in the appropriate system. Follow local policy for documenting the discussion, relevant clinical findings, recommendations, and decisions in the patient’s record. Do not rely on an informal chat or meeting log as a replacement for required clinical documentation.
• Separate care from secondary uses. If information will be used for research, registry analysis, or another purpose beyond treatment, confirm that the use or disclosure is permitted and that the appropriate authorization, waiver, or other HIPAA pathway is in place.
• Plan for incidents. Ensure participants know how to report misdirected messages, unauthorized access, lost devices, or other suspected security incidents under organizational procedures for incident reporting.

How should PERT registry data be collected and protected?

First establish why the registry is being maintained. A registry used for care management or quality improvement may have a different purpose from a systematic investigation designed to contribute to generalizable knowledge. The activity’s purpose and design—not simply whether results may be published—help determine which rules and approvals apply. For research uses of PHI, HIPAA allows specific pathways, including individual authorization, documented IRB or Privacy Board waiver, and a limited data set with a data use agreement. See HHS HIPAA and research guidance and HHS quality improvement guidance.

• Collect only fields that serve the registry’s defined purpose. Record why each data element is needed and who may enter, review, or export it.
• Restrict access and maintain protections. Use appropriate user permissions, authentication, secure storage, and safeguards for data transfers. The Security Rule requires regulated entities to protect ePHI and implement audit controls; see the HHS Security Rule summary.
• Determine whether the activity is research. If the registry is used for research involving identifiable PHI, confirm a valid HIPAA pathway before using or disclosing the data. A limited data set is still PHI and requires a data use agreement when disclosed under that pathway.
• Use de-identification when appropriate. If research or another secondary use can proceed with de-identified information, apply Safe Harbor or Expert Determination rather than treating coded data as automatically de-identified. See HHS de-identification guidance.
• Define retention and disposal procedures. Follow applicable laws and organizational policies for retaining, archiving, and securely disposing of registry records.

How can teams audit access and address HIPAA compliance gaps?

Assign responsibility for reviewing PERT privacy and security practices, and include the systems that store or transmit case information. The HIPAA Security Rule requires audit controls that record and examine activity in systems containing or using ePHI, as well as procedures to review records of information-system activity. See the HHS Security Rule summary.

• Review access logs. Look for unusual access patterns, inappropriate viewing, failed logins, and access by people whose role or case involvement does not appear to justify it.
• Recheck permissions. Remove access when team membership or responsibilities change, and confirm that role-based permissions remain appropriate.
• Assess vendors and agreements. Confirm that required BAAs are current and that vendor services, storage, and subcontractor arrangements match approved workflows. See HHS business associate contract guidance.
• Document and correct gaps. Record identified risks, assign corrective actions, and track completion. HHS describes ongoing risk analysis and evaluation among the Security Rule’s general requirements in its Security Rule summary.
• Reinforce procedures with participants. Train team members on approved communication channels, safe handling of images and records, incident reporting, and any employer-specific privacy and security policies.

In summary, a sound PERT HIPAA compliance checklist clarifies the purpose of each discussion, limits access to authorized participants, protects PHI in calls and file sharing, distinguishes treatment from registry research, and supports regular audit and risk review.

FAQs

Can a PERT discuss identifiable patient information over a web-based platform?

Yes, when the discussion is permitted for the purpose, such as treatment consultation between health care providers, and the organizations use appropriate safeguards and approved technology. If a vendor handles PHI on behalf of a covered entity as a business associate, the required business associate agreement and other HIPAA safeguards must be addressed. See HHS telehealth technology guidance and HHS minimum necessary guidance.

What safeguards should be used when sharing CT scans and echocardiograms?

Use an organization-approved imaging or record-sharing system, verify the recipient and patient, restrict access to authorized participants, and protect ePHI during transmission. Before using an image for a secondary purpose requiring de-identification, check the image and associated data for identifiers and apply a HIPAA-recognized method. See HHS Security Rule guidance and HHS de-identification guidance.

Does a PERT registry require HIPAA-compliant data entry?

If a covered entity or business associate creates, receives, maintains, or transmits PHI in the registry, applicable HIPAA Privacy and Security Rule requirements apply. The exact permissions and safeguards depend on the registry’s purpose and the entities involved. If identifiable PHI is used or disclosed for research, confirm the applicable authorization, waiver, or other permitted pathway. See HHS Security Rule guidance and HHS HIPAA and research guidance.

When should PERT research data be de-identified?

Consider de-identification when identifiable information is not needed for the research or other secondary use. HIPAA recognizes the Safe Harbor and Expert Determination methods. If the project needs identifiable PHI, determine whether an individual authorization or another permitted research pathway applies before using or disclosing it. See HHS de-identification guidance and HHS research guidance.