SNFist Physician Group HIPAA Compliance Checklist

Use this checklist to review how your SNFist physician group protects patient information across skilled nursing facility (SNF) rounds, remote chart access, care coordination, billing, and vendor relationships. First confirm which HIPAA obligations apply to your group: a physician group may be a covered entity, a business associate to a facility, or both in different relationships.

How should a SNFist physician group conduct and document a HIPAA risk assessment?

Conduct and document a Security risk analysis covering all electronic protected health information (ePHI) your group creates, receives, maintains, or transmits. Include information accessed through facility systems, your practice’s electronic health record, mobile devices, billing platforms, email, and vendors. HHS explains that the analysis must assess potential risks and vulnerabilities to ePHI’s confidentiality, integrity, and availability, but the Security Rule does not prescribe a single assessment method. See HHS guidance on risk analysis.

• Maintain an inventory of ePHI systems, devices, data flows, user groups, and service providers.
• Identify credible threats and vulnerabilities, including lost devices, misdirected records, compromised credentials, ransomware, and system outages.
• Record the likelihood and potential impact of each risk, current safeguards, and remaining exposure.
• Assign each mitigation task to a responsible person, set a target date, and document acceptance or deferral of residual risk.
• Review the analysis when systems, vendors, staffing, locations, or workflows change and after significant security incidents.

Keep the assessment and follow-up records in a form your group can retrieve and explain. HIPAA does not set a universal annual reassessment schedule; instead, it requires an ongoing process and updates as needed. See HHS guidance on ongoing risk analysis.

What privacy practices protect skilled nursing facility patients and their records?

Use written privacy policies that reflect how clinicians and staff actually work in SNFs. Address conversations at nurses’ stations and bedside, shared work areas, printed rounding lists, phone calls, secure messaging, photography, faxing, and disclosures to facility personnel involved in a patient’s care.

• Apply the minimum necessary standard to applicable uses, disclosures, and requests for PHI. Set role-based access and limit non-treatment access to what is reasonably needed for the task. HIPAA’s minimum necessary rule generally does not apply to provider-to-provider disclosures for treatment, so do not let the rule obstruct necessary care. See HHS guidance on the minimum necessary standard.
• Maintain a current Notice of Privacy Practices describing permitted uses and disclosures and patient rights. If the group is a covered provider with a direct treatment relationship, provide the notice as required and make a good-faith effort to obtain an acknowledgment of receipt, documenting the effort if no acknowledgment is obtained. See HHS guidance on Notice of Privacy Practices.
• Use reasonable safeguards in shared clinical settings, such as lowering your voice, positioning screens away from public view, securing paper records, and verifying recipients before sending records.
• Route patient requests for access, amendment, restrictions, or confidential communications to the person responsible for privacy requests, and track responses under the applicable policy.
• Document complaints, privacy incidents, investigations, mitigation, and any corrective action.

Which workforce policies and training records are required?

Maintain written privacy and security policies suited to each workforce member’s duties. HIPAA requires workforce training on privacy policies and procedures as necessary and appropriate to perform those functions, and training on security policies and procedures. It does not impose a universal annual certificate-renewal requirement. See HHS guidance for health care providers and the HHS Security Rule summary.

• Provide orientation before or as staff begin handling PHI, and provide additional instruction when duties, systems, or policies change.
• Cover facility-specific rules, role-based access, secure communications, incident reporting, device security, and appropriate handling of paper and electronic records.
• Keep dated records identifying the learner, topics or materials covered, delivery method, completion or acknowledgment, and any follow-up.
• Maintain an access-approval process, timely changes when job responsibilities change, and prompt access removal when a workforce member leaves.
• Apply and document appropriate sanctions for policy violations, along with corrective coaching or retraining where appropriate.
• Keep required HIPAA documentation for at least six years from its creation or, if later, the date it was last in effect; apply longer retention periods when other laws or contracts require them. See the HHS documentation requirements summary.

A training completion certificate shows that a person completed a course; it does not, by itself, establish that the physician group or an SNF is HIPAA compliant. Include the organization’s own policies and facility-specific procedures in training.

What administrative, physical, and technical safeguards should the checklist cover?

Review safeguards across all systems and work settings that handle ePHI. HIPAA requires reasonable and appropriate administrative, physical, and technical safeguards; the specific measures should reflect the group’s size, infrastructure, capabilities, and risks. See the HHS Security Rule summary.

• Administrative safeguards: designate security responsibility; document risk management; manage workforce access; provide security awareness and training; review system activity; respond to incidents; and evaluate safeguards periodically.
• Physical safeguards: control access to work areas and devices; define safe workstation practices in facilities and remote locations; secure phones, laptops, and paper records; and control device and media movement, reuse, and disposal.
• Technical safeguards: use unique user identification and role-appropriate access; protect sign-ins and credentials; review audit controls and access logs; define emergency access procedures; and protect ePHI during transmission.
• Encryption decisions: assess encryption for stored and transmitted ePHI. Where the Security Rule treats an implementation specification as addressable, document whether it is reasonable and appropriate; if not, document why and adopt an equivalent alternative when reasonable and appropriate.
• Records: retain current policies, approvals, risk decisions, evaluations, and evidence that safeguards are operating as intended.

How should business associate agreements and vendor safeguards be reviewed?

List vendors and other outside parties that create, receive, maintain, or transmit PHI for the group. When a vendor is a business associate, have a written business associate agreement (BAA) in place before disclosing PHI, unless an exception applies. A software or cloud provider can be a business associate when it handles ePHI on the group’s behalf, even if it cannot view encrypted data. See HHS guidance on business associates.

• Confirm the contract describes permitted uses and disclosures, requires appropriate safeguards, and prohibits unauthorized use or disclosure.
• Check that it requires the vendor to report impermissible uses, disclosures, security incidents, and breaches, and to support applicable patient-rights and compliance obligations.
• Confirm the vendor must flow relevant protections down to subcontractors that handle PHI.
• Specify practical incident-reporting contacts and timelines, data return or destruction at termination where feasible, and the group’s right to end the arrangement for a material violation.
• Review the vendor’s safeguards and service continuity information in proportion to the sensitivity of the data and the risks identified; keep the review and contract version on file.
• When the group learns of a material BAA violation, take reasonable steps to cure it or end the violation and terminate the arrangement if those steps fail and termination is feasible.

HHS provides sample BAA provisions as a reference, not a substitute for reviewing the group’s actual contract and responsibilities.

How can the group test backups and emergency operations plans?

Keep a contingency plan that addresses data backup, disaster recovery, and an emergency mode operations plan for continuing critical processes while protecting ePHI. The Security Rule requires backup, disaster recovery, and emergency mode planning; testing and revision procedures are an addressable implementation specification. See HHS guidance on contingency planning and ransomware.

• Identify critical applications and data needed for patient care, documentation, prescribing, billing, and care coordination.
• Maintain retrievable backup copies and document who monitors backup completion and failures.
• Test restoration of selected data and systems; record the test date, systems covered, results, gaps, and corrective actions.
• Exercise downtime procedures for accessing essential clinical information, documenting care, communicating with SNF staff, and entering information after systems return.
• Define who activates the plan, how staff are contacted, where current procedures are kept, and how access to ePHI remains controlled during an emergency.
• Revise plans after exercises, system changes, or real emergencies, and coordinate relevant procedures with each facility where the group practices.

What steps should the group take after a suspected breach?

Use a written incident-response procedure that requires prompt reporting of suspected loss, unauthorized access, misdirected communications, malware, or other security incidents. Secure affected accounts or devices, preserve relevant logs and evidence, and involve the privacy or security lead, operational leadership, counsel, and affected vendors as appropriate. Document the facts, investigation, decisions, mitigation, and outcome.

• Determine what information was involved, who may have accessed or received it, when the incident occurred and was discovered, and whether the information was secured.
• Assess whether an impermissible use or disclosure of unsecured PHI is a reportable breach, applying the HIPAA breach-risk assessment and any applicable exception.
• Mitigate harm where practicable, correct the underlying weakness, and document why notification is or is not required.
• Notify the covered entity promptly if the group is acting as its business associate, following the BAA’s reporting terms. HIPAA requires a business associate to notify the covered entity without unreasonable delay and no later than 60 days after discovery; the contract may require a shorter period. See the HHS Breach Notification Rule.
• If the group is the covered entity, notify affected individuals without unreasonable delay and no later than 60 days after discovery when notification is required. Report breaches affecting 500 or more individuals to HHS without unreasonable delay and within that same 60-day limit; breaches affecting fewer than 500 individuals must be reported to HHS within 60 days after the end of the calendar year in which they were discovered. Media notice is generally required when a breach affects more than 500 residents of a state or jurisdiction. See HHS breach notification requirements.

In practice, a reliable checklist links documented risk decisions to privacy procedures, workforce responsibilities, vendor contracts, tested recovery plans, and a practiced incident-response process. Assign owners and review the records regularly so your group can show how it protects SNF patients’ information and responds when safeguards fail.

FAQs.

How often should a SNFist physician group reassess HIPAA security risks?

HIPAA does not specify a fixed reassessment interval. Keep risk analysis ongoing and update it when meaningful changes—such as new systems or vendors, changed workflows, security incidents, or organizational changes—could affect ePHI risks. The group may set a regular review cadence as a practical control, but should not present an annual assessment as a universal HIPAA rule. See HHS risk analysis guidance.

What should a HIPAA incident-response procedure include?

It should explain how workforce members report suspected incidents; who triages and investigates them; how to contain the issue and preserve evidence; how to assess affected PHI and breach notification duties; how to mitigate harm; how to communicate with facilities, business associates, and affected individuals when required; and how to document decisions and corrective actions. HIPAA requires policies and procedures for identifying, responding to, mitigating, and documenting security incidents. See the HHS Security Rule summary and HHS Breach Notification Rule.

When does a physician group need a business associate agreement?

A physician group generally needs a BAA when it is a covered entity and a non-workforce party creates, receives, maintains, or transmits PHI on the group’s behalf as a business associate. The group may also need to sign a BAA when it performs services involving PHI for an SNF or another covered entity as that party’s business associate. Determine the parties’ roles and the nature of the services; do not assume every clinician-to-facility relationship requires a BAA. See HHS business associate guidance.

How should workforce HIPAA training be documented?

Keep dated records showing who completed training, when it occurred, what policies or topics were covered, how it was delivered, and any required acknowledgment or follow-up. Include organization-specific and facility-specific procedures. HIPAA requires training as necessary and appropriate for job functions but does not set a universal annual certificate-renewal schedule. Retain required documentation for at least six years from creation or the date it was last in effect, whichever is later, unless another applicable requirement calls for longer retention. See HHS provider guidance and the HHS Security Rule documentation summary.