Radiology Benefit Manager HIPAA Compliance Checklist

A radiology benefit manager (RBM) may handle sensitive imaging information while coordinating prior authorization, utilization review, or other health-plan services. Use this checklist to assess whether your organization’s role, contracts, access controls, safeguards, and incident procedures address the HIPAA requirements that apply to its work.

When does a radiology benefit manager qualify as a HIPAA business associate?

An RBM generally qualifies as a HIPAA business associate when it performs a function or service on behalf of a covered entity—such as a health plan—and that work involves creating, receiving, maintaining, or transmitting protected health information (PHI). HHS identifies utilization review and benefit management among business-associate functions. The organization’s actual activities matter more than whether its contract calls it a “vendor” or “business associate.” See HHS guidance on business associates.

• Map the relationship: Identify the health plan, provider, or other covered entity for which the RBM performs services and the PHI involved.
• Check the work performed: Determine whether the RBM uses patient identifiers, orders, clinical notes, images, or reports to conduct authorization, utilization review, or benefit-management tasks.
• Identify subcontractors: Include cloud hosts, imaging platforms, analytics vendors, and other subcontractors that create, receive, maintain, or transmit PHI on the RBM’s behalf.
• Document any exception: If the RBM believes it is not a business associate, document the facts and the basis for that conclusion before PHI is shared.

If the RBM is a business associate, HIPAA obligations apply to it directly in specified areas, including Security Rule protections for electronic PHI (ePHI). A covered entity generally must obtain satisfactory written assurances before allowing a business associate to handle PHI. See HHS guidance for covered entities and business associates.

What should a business associate agreement cover before PHI is shared?

Put a business associate agreement (BAA) in place before the RBM creates, receives, maintains, or transmits PHI for a covered entity. The BAA should describe the services and information involved, and establish the permitted and required uses and disclosures of PHI. HHS lists required BAA provisions in its sample business associate agreement provisions.

• Prohibit uses and disclosures beyond those allowed by the agreement or required by law.
• Require appropriate safeguards, including the Security Rule requirements for ePHI.
• Require the RBM to report impermissible uses or disclosures, security incidents, and breaches of unsecured PHI to the covered entity.
• Address how the RBM will help the covered entity respond to patient requests for access, amendments, or accounting of disclosures when applicable to the services.
• Require comparable protections from subcontractors that handle PHI.
• Address return or destruction of PHI at termination when feasible, and the covered entity’s right to terminate for a material breach of the agreement.

For effective coordination, also specify operational details such as incident escalation contacts, how quickly the RBM must alert the covered entity, what information an incident report should contain, and how records will be preserved. These contract details help the parties respond promptly; do not assume a BAA replaces the underlying services agreement or the organizations’ own HIPAA policies.

How to conduct and document an ePHI risk analysis

The HIPAA Security Rule requires a documented, accurate, and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI the RBM creates, receives, maintains, or transmits. HIPAA does not prescribe one risk analysis method or a universal annual schedule. The analysis should reflect the RBM’s environment and be revisited as risks or operations change. See HHS guidance on risk analysis and its explanation of risk analysis and risk management.

• Inventory ePHI and systems: Track imaging orders, authorization records, reports, images, and related identifiers across systems such as PACS, RIS, portals, interfaces, backups, endpoints, and cloud services.
• Map data flows: Record how information moves between the RBM, health plans, providers, imaging facilities, patients, and subcontractors, including transmission and storage locations.
• Assess threats and weaknesses: Consider unauthorized access, misdirected disclosures, compromised accounts, ransomware, unpatched systems, lost devices, vendor incidents, and disruption of access to imaging information.
• Evaluate likelihood and impact: Assess the potential effect of each identified risk on the confidentiality, integrity, and availability of ePHI, taking existing safeguards into account.
• Document and manage remediation: Keep the assessment, identified gaps, decisions, assigned owners, target dates, and risk-management actions together. Record why a safeguard is selected or, when an implementation specification is addressable, why an alternative is reasonable and appropriate.

Review the analysis and update it when changes may affect ePHI security—for example, after a security incident, a new system or vendor, a major operational change, or a change in the threat environment. HHS explains that risk analysis is ongoing and that the Security Rule does not set a single required frequency; reviews should be responsive to the organization’s circumstances. See HHS risk-analysis guidance.

How to apply minimum necessary access and support patient access to images and reports

Use the minimum necessary standard to limit PHI used, disclosed, or requested for applicable purposes to what is reasonably needed for the task. For routine RBM work, define the roles that need access, the categories of information each role needs, and the conditions under which access is allowed. Build those decisions into role-based access control (RBAC), rather than relying only on staff to remember informal rules. The minimum necessary standard has exceptions, including certain disclosures to or requests by a health care provider for treatment; apply the rule according to the purpose and applicable exception. See HHS guidance on the minimum necessary requirement.

• Give authorization staff access to the records and clinical details their assigned review requires, not unrestricted access by default.
• Use individual accounts and role-based permissions; review and adjust access when a person changes roles or leaves.
• Document approved exceptions and procedures for access needed during emergencies.
• Ensure workflows do not prevent authorized patient access requests from reaching the covered entity responsible for responding.

Patients generally have a HIPAA right of access to PHI about themselves in a covered entity’s designated record set, including diagnostic images held in that set. When an RBM maintains such information on a covered entity’s behalf, the BAA should clarify whether the RBM provides the information directly or returns it to the covered entity for the response. The covered entity generally must act on an access request within 30 calendar days, with one extension of up to 30 additional days when the required conditions are met. See HHS guidance on access to diagnostic images and HHS guidance on PHI held by a business associate.

Which administrative, technical, and physical safeguards protect imaging data?

The HIPAA Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards to protect ePHI. Select and maintain safeguards based on the organization’s size, capabilities, infrastructure, and assessed risks. The governing standards appear in 45 CFR § 164.308, 45 CFR § 164.310, and 45 CFR § 164.312.

• Administrative safeguards: Assign security responsibility; manage risk; authorize and review workforce access; train the workforce; respond to security incidents; prepare for emergencies; and periodically evaluate safeguards.
• Technical safeguards: Use unique user identification, access controls, and authentication; protect the integrity of imaging data and related records; enable mechanisms that record and examine system activity; and secure ePHI transmissions.
• Physical safeguards: Control facility access, secure workstations, and manage devices and media that may store ePHI—including their movement, reuse, and disposal.
• Addressable specifications: Do not treat “addressable” as optional. Assess whether each specification is reasonable and appropriate in the RBM’s circumstances; document the decision and implement an appropriate alternative when required.

For example, assess encryption for stored images, workstations, backups, and transmissions as part of the risk-management process. The Security Rule identifies encryption as an addressable implementation specification, so document the organization’s assessment and any alternative safeguards rather than assuming that the label alone makes encryption unnecessary. See HHS’s summary of the HIPAA Security Rule.

What policies, workforce training, and audit-log reviews are required?

Maintain written policies and procedures that match the RBM’s actual systems and workflows, and keep the documentation current when environmental or operational changes affect ePHI security. The Security Rule requires a security awareness and training program for all workforce members, including management, and requires appropriate sanctions for workforce members who fail to follow security policies. It does not establish a universal federal annual training interval; set and document training timing and refresher practices based on applicable requirements, risk, and organizational policy. See 45 CFR § 164.308 and 45 CFR § 164.316.

• Cover authorization and access requests, secure handling of image files, approved transmission methods, remote work, password and authentication practices, incident reporting, and sanctions.
• Train staff on the employer’s own procedures and the specific systems and responsibilities they use; record completion and follow up on missed or required corrective training.
• Enable audit controls that record and examine activity in systems containing or using ePHI, including relevant access to imaging files, authorization records, and reports.
• Set a documented review schedule appropriate to risk and system use. Investigate unusual access, failed logins, bulk exports, access outside job duties, and other suspicious activity.
• Retain review records and document findings, escalation, and corrective action. HIPAA requires audit controls but does not establish one universal review interval for every organization.

HHS describes regular review of information-system records as part of Security Rule compliance and identifies audit logs, access reports, and security-incident tracking reports as useful records to review. See HHS’s HIPAA Security Rule summary and the HHS HIPAA audit protocol.

How should incidents be investigated and breach notifications handled?

Maintain a process to identify, respond to, contain, and document suspected or known security incidents. Preserve relevant audit logs and other evidence; identify the systems, data, and individuals potentially affected; and record investigation steps, decisions, mitigation, and corrective actions. An impermissible use or disclosure of PHI is generally presumed to be a breach unless the covered entity or business associate establishes a low probability that the PHI was compromised through the required risk assessment or an applicable exception. See the HHS Breach Notification Rule guidance.

• Notify the covered entity promptly: If an incident at or by the RBM may involve a breach of unsecured PHI, follow the BAA’s reporting procedure and provide the covered entity with the facts needed to investigate. HIPAA sets an outside limit of 60 calendar days from discovery for a business associate’s notice to the covered entity, but the BAA may require a shorter period.
• Assess the breach: Document the nature and extent of the PHI involved, who used or received it, whether it was actually acquired or viewed, and the extent to which the risk was mitigated.
• Coordinate required notices: The covered entity is generally responsible for notifying affected individuals and the HHS Secretary; the BAA may assign the RBM a role in preparing or sending notices.
• Apply the large-breach rules: For a breach affecting 500 or more individuals, the covered entity must notify HHS without unreasonable delay and no later than 60 calendar days after discovery. For a breach affecting fewer than 500 individuals, it may report to HHS annually, no later than 60 days after the end of the calendar year in which the breach was discovered.
• Check the media threshold separately: A covered entity must notify prominent media outlets when the breach involves more than 500 residents of a state or jurisdiction. This threshold is based on residents of a state or jurisdiction, not simply the total number of affected individuals.

The 60-day period is an outer limit, not a reason to delay notification when notice can be provided sooner. See HHS’s Breach Notification Rule guidance and HHS breach-reporting instructions.

In practice, an RBM’s checklist should connect its business-associate status and BAA to a documented ePHI risk analysis, appropriate access and safeguards, trained staff, reviewed audit logs, and a tested incident-notification process.

FAQs

Does a radiology benefit manager need a HIPAA business associate agreement?

Usually, yes, when the RBM performs services on behalf of a covered entity—such as utilization review or benefit management—and handles PHI in doing so. The exact determination depends on the parties’ functions and data flows. A covered entity generally needs a written BAA or other qualifying written arrangement establishing the required safeguards before the business associate handles PHI. See HHS guidance on business associates.

How often should an ePHI risk analysis be updated?

HIPAA does not set a universal annual frequency. The risk-analysis process should be ongoing, with reviews and updates as needed when changes in technology, operations, vendors, threats, or security incidents may affect ePHI. Document the organization’s review approach and its decisions. See HHS risk-analysis guidance.

What is the HIPAA breach notification deadline after discovery?

A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery, although the BAA may require faster notice. Covered-entity notices to affected individuals are also due without unreasonable delay and no later than 60 calendar days after discovery. The 60-day limit is the outer deadline, not a required waiting period. See HHS Breach Notification Rule guidance.

Which HIPAA breach reporting requirements apply to large incidents?

For a breach affecting 500 or more individuals, the covered entity must notify HHS without unreasonable delay and no later than 60 calendar days after discovery, and notify affected individuals within the same general deadline. If the breach affects more than 500 residents of a state or jurisdiction, the covered entity must also notify prominent media outlets serving that area. The business associate must notify the covered entity as required by HIPAA and the BAA. See HHS breach-notification requirements.