South Carolina Children’s Hospice & Palliative Care Team Privacy Laws: A Compliance Checklist

Your pediatric hospice team manages some of the most sensitive information there is. This compliance checklist translates core privacy expectations into practical steps you can implement today, with a focus on South Carolina operations and pediatric care nuances.

Use it to confirm that your policies, technology, and daily practices align with HIPAA, state requirements, and recognized Patient Privacy Protections while maintaining family-centered, compassionate care.

Record Maintenance Requirements

Core elements to capture

• Identify the child clearly: full name, date of birth, unique medical record number, and legal guardianship or custody status (include court orders or authorizations on file).
• Document consents: treatment consent, HIPAA authorization when needed, DNR/portable orders, advance care planning notes, and age-appropriate assent.
• Maintain a current plan of care: goals, interdisciplinary interventions, equipment, supplies, and medication lists with indication and dosing rationale.
• Record encounters promptly: date/time, modality (in person/telehealth), clinician identity/credentials, services provided, and caregiver education delivered.
• Track safety-critical data: allergies, pain and symptom assessments, weight-based dosing, device/line care, emergency plans, and code status.
• Log communications with families, schools, home-health partners, and specialty teams to support continuity and Health Information Use and Disclosure requirements.

Data integrity and security

• Use standardized templates and problem lists; apply addenda for corrections with a preserved audit trail—never overwrite or delete prior entries.
• Protect EHRs with encryption in transit and at rest, role-based access, multi-factor authentication, and routine backup testing.
• Perform a documented Security Risk Analysis and remediate identified gaps; schedule periodic reviews tied to system or workflow changes.
• Tag records with status, retention category, and legal holds to streamline Hospice Record Retention compliance and discovery readiness.

Pediatric-specific documentation

• Capture decision-making authority (parents, guardians, foster agencies) and any limits; verify consent regularly as circumstances change.
• Track growth parameters, developmental needs, school plans, and caregiver training competencies that affect safety at home.

Confidentiality and Authorized Access

Minimum necessary access

• Limit record access to team members with a legitimate care-related need; apply role-based permissions and unique user credentials.
• Use confidentiality agreements, annual training, and a sanctions policy to reinforce expected behavior and consequences.

Permitted Health Information Use and Disclosure

• Allow uses/disclosures for treatment, payment, and health care operations consistent with HIPAA’s minimum necessary standard.
• Recognize personal representatives for minors (parents/guardians) while honoring specific restrictions related to emancipated or mature minors where applicable.
• For quality improvement or research, rely on a Limited Data Set with a Data Use Agreement or use de-identified data where feasible.

State privacy considerations

• When interacting with state programs or agencies, account for the South Carolina Family Privacy Protection Act, which restricts certain public use or release of personal information and reinforces family privacy expectations.
• Avoid public posting or non-care-related sharing of identifiable family details in marketing or fundraising without explicit authorization.

Record Transfer Procedures

Care transitions

• Before transfer or concurrent care, verify identity and authority, then share a concise clinical summary, current medication list, recent labs/imaging, and equipment needs.
• Use secure channels (direct secure messaging, encrypted exchange, or certified HIE). Confirm receipt and file a transfer confirmation note.

Facility consolidation or closure

• Designate a records custodian, create an inventory of active/inactive records, and notify patients/guardians how to request copies.
• Prepare a written transfer plan describing secure transport, chain-of-custody, and post-transfer access; maintain documentation for potential Department of Public Health Inspection review.

Data minimization and proofs

• Share the minimum necessary information or a Limited Data Set when full records are not required; document the legal basis and authorization status for each disclosure.
• Retain transmission logs, acknowledgments, and reconciliation checklists to demonstrate control over Health Information Use and Disclosure.

Record Retention and Disposal

Retention framework

• Apply state retention rules and payer contract requirements; for pediatric records, maintain files at least through the age of majority and any additional period required by state regulation or policy.
• Keep HIPAA privacy/security policies, risk analyses, Notices of Privacy Practices, authorizations, and disclosure logs for at least six years from creation or last effective date, whichever is later.
• Define Hospice Record Retention schedules in policy, label records with categories, and enforce legal holds for litigation or investigations.

Secure disposal

• Destroy paper via cross-cut shredding or certified destruction; sanitize media per recognized standards (for example, NIST SP 800-88 techniques).
• Use vetted vendors under Business Associate Agreements and obtain certificates of destruction; document chain-of-custody end to end.

Audit readiness

• Maintain an index of archived records, retrieval procedures, and staff roles to expedite responses to payer audits or Department of Public Health Inspection requests.

HIPAA Compliance and Privacy Rule

Core program elements

• Publish and distribute a clear Notice of Privacy Practices to parents/guardians and, when appropriate, to adolescent patients.
• Enforce the minimum necessary standard; obtain written authorization for non-routine uses (such as marketing or fundraising with PHI).
• Execute and manage Business Associate Agreements with EHR, billing, telehealth, and destruction vendors.

Security program

• Conduct a Security Risk Analysis; implement administrative, physical, and technical safeguards; and track corrective actions to completion.
• Encrypt endpoints and mobile devices, monitor access with audit logs, and review alerts for inappropriate activity.

Breach readiness

• Maintain an incident response plan covering investigation, risk assessment, mitigation, patient notification timelines, and regulatory reporting.
• Keep an accounting of disclosures upon request and educate staff to report suspected incidents immediately.

Patient Rights and Non-Discrimination

Access and amendments

• Provide timely access to records, with respectful guidance on what can be shared with parents/guardians versus adolescents under applicable rules.
• Document requests to amend or restrict disclosures and communicate determinations promptly.

Confidential communications

• Accommodate reasonable requests to communicate at alternative locations or via specific channels to enhance Patient Privacy Protections.
• Offer language access, auxiliary aids, and culturally sensitive communication in line with non-discrimination obligations.

Inclusive, family-centered care

• Prevent discrimination based on race, color, national origin, age, disability, sex, gender identity, sexual orientation, or religion.
• Honor family structure, guardianship nuances, and cultural practices while ensuring safety and informed consent.

Department Oversight and Access

Preparing for inspections

• Maintain a survey-readiness binder: licenses, policies, training logs, risk analyses, BAAs, recent audits, and sample records with identifiers redacted where appropriate.
• Ensure staff know how to verify surveyor credentials and facilitate secure on-site or remote record review.

Access boundaries

• Provide requested records to authorized officials for regulatory review while limiting disclosures to the scope of the inspection.
• Document what was accessed, by whom, when, and under what authority to maintain a clear compliance trail.

Summary

By tightening documentation, limiting access to the minimum necessary, transferring records securely, and aligning retention and HIPAA practices, you strengthen both compliance and trust. Regular training, risk analysis, and readiness for Department of Public Health Inspection activities keep your pediatric hospice program survey-ready and family-centered.

FAQs.

What are the record retention requirements for children's hospice in South Carolina?

Follow state retention rules and payer contracts, maintaining pediatric records at least through the age of majority plus any additional period required by state policy. Keep HIPAA-related documentation (such as policies, authorizations, and disclosure logs) for at least six years. Define and enforce a formal Hospice Record Retention schedule so staff know exactly how long to keep each record type.

How must patient records be transferred during facility closure?

Designate a records custodian, inventory records, and notify patients or guardians about how to request copies. Transfer files using encrypted methods with chain-of-custody logs, and retain proofs of delivery. Keep your closure and transfer plan on file for potential Department of Public Health Inspection review and for payer or regulator audits.

What are the HIPAA compliance obligations for hospice care teams?

Provide a Notice of Privacy Practices; apply minimum necessary standards; execute Business Associate Agreements; and conduct a Security Risk Analysis with documented remediation. Safeguard systems (administrative, physical, technical controls), maintain disclosure logs, train staff annually, and follow breach investigation and notification procedures when incidents occur.

How does South Carolina law protect family privacy in hospice care?

In addition to HIPAA’s Patient Privacy Protections, the South Carolina Family Privacy Protection Act limits certain public uses of personal information by state agencies and related activities. When you work with state programs or provide information to government entities, confirm disclosures are legally permitted, use the minimum necessary data, and obtain authorization where required.