Wisconsin Mobile Swallow Study Privacy Laws: A Compliance Checklist

A mobile swallow study, such as a videofluoroscopic swallowing examination, involves both patient records and diagnostic X-ray equipment. Compliance depends on the provider’s role, the equipment and location, who operates the fluoroscope, and how the resulting images and reports are handled.

Use this checklist to review Wisconsin confidentiality rules, equipment registration, staff qualifications, device safeguards, breach response, and record retention. It is a practical overview, not a substitute for advice about a specific provider or service arrangement.

What patient-record confidentiality rules apply to mobile swallow studies in Wisconsin

Wisconsin’s Wisconsin Statutes section 146.82 generally requires patient health care records to remain confidential. A swallow-study order, report, images, and related records may be subject to that protection when they meet the statutory definition of a patient health care record.

Disclosure generally requires the patient’s informed consent unless a statutory exception permits the release. The exceptions matter in practice: they may allow disclosures for purposes such as treatment or other specified circumstances. A provider should identify the applicable exception and limit what it shares to what is needed for that purpose.

HIPAA also applies when an organization is a covered entity or business associate. Its Privacy Rule permits certain uses and disclosures without a separate authorization, including disclosures for treatment, payment, and health care operations. A mobile imaging company handling records for a covered provider may be a business associate and should address the relationship in a business associate agreement. See 45 CFR § 164.506 and the HIPAA Privacy Rule provisions on permitted uses and disclosures.

Do not confuse permission to disclose records with consent to perform the procedure. A provider should separately follow its applicable clinical consent and ordering requirements. For patient access to records, Wisconsin law provides inspection and copying rights under Wisconsin Statutes section 146.83, subject to the law’s conditions and exceptions.

Which Wisconsin registrations and certifications apply to mobile X-ray services

Wisconsin requires annual registration of X-ray devices with the Department of Health Services (DHS). DHS says registration is tied to the person in control of the radiation source; installations at separate addresses generally require separate registrations. The registration period expires on December 31, and changes or additions to devices at an existing registered facility must generally be reported within 30 days. Review the current DHS X-ray facility registration, surveys, and inspections guidance and DHS X-ray device requirements.

Because mobile equipment travels between service locations, do not assume a registration automatically covers every location or operating arrangement. Confirm with DHS how the mobile installation and responsible registrant should be recorded.

Portable X-ray supplier certification is a separate issue. Wisconsin DHS describes this certification as applying to groups that supply portable X-ray services in the Medicare program. Do not assume that merely using mobile equipment creates this certification requirement, or that a portable supplier certificate replaces device registration. Check the provider’s Medicare service and billing arrangement against the DHS portable X-ray services certification guidance.

How can providers verify X-ray operator and fluoroscopy qualifications

Wisconsin requires operators of X-ray units used for human diagnostic medical imaging to hold a radiographer license or a limited X-ray machine operator (LXMO) permit. Verify the individual’s current credential through Wisconsin DSPS rather than relying only on a résumé, employer title, or an out-of-state credential. Start with the DSPS pages for a licensed radiographer and a limited X-ray machine operator.

A mobile swallow study uses fluoroscopy, so verify scope as well as credential status. Wisconsin’s radiographer scope includes diagnostic and noninterpretive fluoroscopic procedures prescribed by a licensed practitioner. The LXMO credential is limited in scope; do not assume it authorizes operation of fluoroscopic equipment. See Wisconsin Administrative Code RAD 4.01 and RAD 4.02.

Wisconsin’s fluoroscopy rule also addresses supervision and operator training. Radiologic technologists’ use of fluoroscopic X-ray systems must be under a licensed practitioner’s supervision, and the registrant must ensure that the system operator meets the applicable qualification standard, including specified fluoroscopy training where required. Review Wisconsin Administrative Code DHS 157.76 and document credentials, training, supervision arrangements, and any relevant equipment-specific authorization.

What safeguards protect patient information on mobile devices

The HIPAA Security Rule requires covered entities and business associates to protect electronic protected health information (ePHI) through administrative, physical, and technical safeguards. For mobile swallow studies, apply those controls to tablets, laptops, image-capture systems, removable media, wireless transfers, and any cloud or vendor platform that stores or transmits patient information.

• Restrict access to workforce members who need the information for their roles, and use unique user accounts rather than shared logins.
• Use secure authentication, automatic session locking, and audit logging to help detect and investigate access.
• Assess risks to ePHI on mobile devices and use encryption and secure transmission protections appropriate to the risk. HIPAA lists encryption as an addressable implementation specification; addressable does not mean optional without assessment and documentation.
• Set procedures for device loss, remote access, software updates, backups, secure transfer of images, and removal of ePHI before equipment is reused or discarded.
• Train workforce members on employer-specific privacy and security procedures, including what to do if a device is lost or information is sent to the wrong recipient.

These measures align with the HHS HIPAA Security Rule guidance and its technical safeguards for access control, audit controls, authentication, integrity, and transmission security in 45 CFR § 164.312. They are safeguards to evaluate and implement based on the applicable rules and documented risk analysis, not a claim that every listed technology is expressly mandatory in every circumstance.

What privacy rights and breach-notification duties apply to patients

Patients may have rights to inspect or obtain copies of their records under Wisconsin law and, when HIPAA applies, rights that include access and requests to amend information. A HIPAA-covered provider must give patients a Notice of Privacy Practices explaining its privacy practices and patient rights. The Notice of Privacy Practices is not itself a blanket authorization for every disclosure.

If a breach involves unsecured protected health information, HIPAA-covered entities generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. Business associates must notify the covered entity under the applicable rule and their agreement. The covered entity must also report to HHS, with reporting deadlines that vary depending on how many individuals are affected. See the HHS Breach Notification Rule.

Wisconsin Statutes section 134.98 has a separate, narrower breach-notice framework for specified personal identifiers and contains an exception for certain entities subject to and complying with HIPAA. A health record alone is not one of the listed identifiers in that statute’s definition of personal information. Assess the data involved and the entity’s status before deciding which notice rules apply; do not treat the 45-day state deadline as a universal deadline for every health-information incident. Review Wisconsin Statutes section 134.98 alongside the applicable HIPAA requirements.

How should mobile swallow study records be retained and securely destroyed

HIPAA does not set a general retention period for medical records. State rules and the provider’s facility type may set the applicable minimum. For example, Wisconsin’s physician and physician-assistant rule requires records to be maintained for at least five years after the last entry, or longer if another law requires it. See Wisconsin Administrative Code Med 21.03 and the HHS explanation of HIPAA medical-record retention. Check additional requirements that may apply to a hospital, facility, payer, or contract before setting a destruction date.

Keep the swallow-study report and images in the designated patient record system, and define in writing which organization is responsible for maintaining the official record. If a mobile vendor handles records for a covered provider, the business associate agreement and provider retention schedule should address access, return, and secure destruction at the end of the service relationship.

When the applicable retention period ends and no legal hold or other requirement prevents disposal, use a method that protects the information from unauthorized access or reconstruction. Securely shred paper records and use appropriate procedures to clear or destroy electronic media. HIPAA also requires covered entities and business associates to apply appropriate safeguards to PHI during disposal; see 45 CFR § 164.530(c) and 45 CFR § 164.310(d)(2).

In short, confirm the record-release basis, register the X-ray equipment correctly, verify fluoroscopy credentials and supervision, protect ePHI on every mobile device, assess breach deadlines based on the data and entity, and retain or destroy records only under the applicable schedule.

FAQs

Does Wisconsin require patient consent before disclosing mobile swallow study records?

Not for every disclosure. Wisconsin Statutes section 146.82 generally protects patient health care records and permits release with informed consent or under specified statutory exceptions. When HIPAA applies, certain disclosures—such as those for treatment, payment, and health care operations—may also be permitted without a separate authorization. Determine the legal basis for the particular disclosure before sending records.

How often must Wisconsin X-ray devices be registered?

Wisconsin requires annual DHS registration of X-ray devices. DHS says registrations expire on December 31, and additions or changes to devices at an existing registered facility generally must be reported within 30 days. For mobile equipment, confirm with DHS how the installation and service locations should be reflected in the registration.

Who may operate fluoroscopic equipment for a mobile swallow study?

Verify that the operator has a credential and scope that authorize the work. Wisconsin’s radiographer scope includes prescribed diagnostic and noninterpretive fluoroscopic procedures; an LXMO permit is limited and should not be assumed to authorize fluoroscopy. The applicable fluoroscopy rule also addresses supervision and operator training requirements.

How quickly must patients be notified of a health information breach?

For a breach of unsecured protected health information subject to the HHS Breach Notification Rule, affected individuals generally must be notified without unreasonable delay and no later than 60 calendar days after discovery. Wisconsin’s 45-day statute applies to a narrower category of specified personal identifiers and includes an exception for certain HIPAA-regulated entities that comply with HIPAA. Assess the facts and applicable rules promptly because other reporting duties may also apply.