A three-physician practice called us the week a laptop went missing from a locked car. The office manager had already done the right things in the wrong order: called the police, called the EHR vendor, and started drafting letters to every patient. Nobody had asked the first question, which was whether the laptop was encrypted. It was. The practice's IT contractor had turned on full-disk encryption two years earlier and could prove it. Under HHS guidance, encrypted data is secured protected health information, and the loss of a secured device is not a reportable breach. The practice documented the risk assessment in an afternoon, replaced the laptop, and sent no letters.
The same month, a different practice emailed us about something that seemed small: a receptionist had looked up her ex-husband's new partner in the EHR. No data left the building. That one was a reportable breach, a sanction and a retraining event, because an impermissible access by a workforce member is a breach regardless of whether anything was printed or sent.
HIPAA for a small practice is not the binder on the shelf. It is the set of decisions staff make dozens of times a day: whether to tell the daughter on the phone, whether to text the appointment reminder, whether the shredding company needs a contract, what to do when a fax lands at the wrong pharmacy. The rules that apply day to day fit on a few pages. A practice meets them by naming a privacy and security officer, doing and documenting a risk analysis, signing business associate agreements with every vendor that touches PHI, training staff on the handful of situations below, and keeping a breach log and the evidence of all of it for six years. This guide is organised as if-this-then-that, because that is how the questions arrive.
If you bill electronically, then you are a covered entity, and the clock is already running
HIPAA applies to health plans, clearinghouses and providers that transmit health information electronically in connection with a standard transaction, which means any practice that sends a claim, checks eligibility or receives an electronic remittance. Being a covered entity carries a fixed set of obligations under the Privacy Rule (all protected health information, in any form), the Security Rule (electronic PHI) and the Breach Notification Rule.
The baseline documents a small practice must be able to produce on request are: a designated privacy official and security official (the same person is fine); written policies covering uses and disclosures, patient rights, safeguards and sanctions; a current risk analysis and the risk management plan that followed it; evidence of workforce training at hire and periodically after; a Notice of Privacy Practices posted in the office and on the website and offered at the first visit with a documented attempt to get an acknowledgment; signed business associate agreements; a breach log; and incident response and contingency (backup and recovery) procedures. Documentation is retained for six years from the date it was created or last in effect. When OCR investigates after a complaint or a breach report, these are the first things it asks for, and a missing risk analysis is the finding that appears in settlement after settlement involving small practices.
One thing a practice cannot produce is a government HIPAA certification, because none exists. Vendors sell training certificates and attestation badges; HHS does not certify anyone. Say "HIPAA compliant" when you have done the work above.
If a vendor can see PHI, then you need a business associate agreement before they start
A business associate is a person or company that creates, receives, maintains or transmits PHI on your behalf, or provides services to you that involve PHI. For an independent practice the list is longer than people expect: the billing company, the EHR and practice management vendors, the clearinghouse, the IT support firm with administrator access, the cloud backup provider, the email provider if PHI moves through it, transcription and scribe services, the answering service that takes clinical messages, the shredding company, the collections agency, the consultants who audit charts, and the attorney who reviews records. Each needs a written business associate agreement before PHI flows, and the agreement binds them to the Security Rule directly and to report breaches to you within 60 days of discovery at most.
Who is not a business associate: other covered entities you disclose to for treatment (the hospital, the specialist), payers you bill, the postal service and internet carriers acting as mere conduits, the cleaning crew whose access to PHI is incidental, and your own workforce, including volunteers and students under your direct control. If you are unsure, ask whether the vendor needs PHI to do the job you hired them for. If yes, sign the agreement. Our billing service and every other Revelrex engagement that touches PHI starts with a BAA for exactly this reason.
If someone asks for information, then ask who they are and why
Most disclosure decisions resolve with one rule: PHI may be used and disclosed without the patient's authorization for the practice's own treatment, payment and health care operations, and to other providers for treatment. Everything else needs either a specific permission in the rule or a signed authorization.
- To another provider treating the patient: yes, without authorization, and the minimum necessary standard does not apply to treatment disclosures. Verify the requester reasonably (a callback to a listed number is enough).
- To a payer for a claim, an audit or a prior authorization: yes, as payment, limited to what the payer needs.
- To a spouse, adult child or friend involved in the patient's care: yes, if the patient has had the opportunity to object and has not, or is not present and you judge in good faith it is in their interest. Limit it to what is relevant to that person's involvement, and record the patient's preferences at intake so the front desk does not have to guess.
- To a parent about a minor: usually yes as the personal representative, except where state law lets the minor consent to the care (common for reproductive, mental health and substance use services). This is state-specific; have counsel write your state's rules into the policy.
- To an employer, a school, a life insurer, a lawyer or a marketing partner: only with a valid signed authorization that names the recipient, the information and an expiration, unless a specific legal exception applies.
- In response to a subpoena: not automatically. A court order signed by a judge must be honored; an attorney's subpoena requires satisfactory assurance that the patient was notified or a protective order sought. Route these to the privacy official and counsel.
- To law enforcement: only in the specific situations the rule permits (a court order or warrant, limited identifying data about a suspect, a crime on the premises, certain emergencies). "The officer asked" is not one of them.
- In an online review reply: never confirm the person is a patient or discuss their care, even if they posted details themselves. OCR has settled cases over exactly this.
If a patient asks for their records, then you have 30 days and limited fees
The right of access is the Privacy Rule provision OCR enforces most often against small practices, because the violations are simple to prove. A patient (or their personal representative) may ask for a copy of their records in the designated record set, and the practice must provide it within 30 calendar days of the request, with one extension of up to 30 more days if you tell the patient in writing why and when. The copy must be in the form and format the patient requests if it is readily producible (a PDF by secure email, a portal download, a paper copy), and the patient may direct it to a third party in writing. The fee is limited to a reasonable, cost-based charge for labor to copy, supplies and postage; OCR guidance also offers a flat-fee option for electronic copies, and state law may cap fees lower. You may not charge a retrieval fee, require the patient to come in person, or withhold records over an unpaid balance.
Operationally: log every request with the date received, accept requests made in any form, assign one person to fulfil them, and send the records through a channel the patient agreed to. Psychotherapy notes and information compiled for litigation are the main categories you may exclude; everything else in the designated record set, including billing records, goes.
If PHI went somewhere it should not have, then assess, document and decide within days
A breach is an impermissible acquisition, access, use or disclosure of unsecured PHI, and it is presumed to be a breach unless you can demonstrate a low probability that the PHI was compromised based on four factors: the nature and extent of the PHI, the unauthorized person who received it, whether the PHI was actually acquired or viewed, and the extent to which the risk has been mitigated. Write the assessment down, with the facts and the conclusion, whether or not you conclude it was reportable. Three exceptions take an event out of the definition: unintentional access by a workforce member acting in good faith within their authority, inadvertent disclosure between two people at the same practice who are both authorized, and disclosure to someone who could not reasonably have retained the information.
Then the deadlines. Affected individuals must be notified by first-class mail (or email if they agreed) without unreasonable delay and no later than 60 calendar days after discovery, which is the first day anyone in the workforce other than the person responsible knew or should have known. If 500 or more residents of a state are affected, prominent media in that state must also be notified within the same 60 days. HHS is notified through the OCR breach portal: within 60 days of discovery for breaches affecting 500 or more individuals, and for smaller breaches, logged and submitted within 60 days after the end of the calendar year in which they were discovered. Business associates notify the covered entity within 60 days.
Encryption is the small practice's best friend here. PHI encrypted to the standards in HHS guidance is "secured", and its loss is not a breach at all. That is why full-disk encryption on every laptop and phone that touches PHI, and encrypted backups, are the first items on any risk management plan we write.
If you have not done a risk analysis in the last year, then that is the next task
The Security Rule requires an accurate and thorough assessment of the risks to the confidentiality, integrity and availability of all ePHI the practice holds, followed by measures that reduce those risks to a reasonable and appropriate level. For a small practice that means listing every place ePHI lives (the EHR, the practice management system, workstations, laptops, phones, email, the fax server, backups, the portal, the billing company's connection), identifying the threats to each, rating likelihood and impact, and writing down what you will do about the high ones and when. The HHS Security Risk Assessment Tool, built by ONC with OCR for small and medium practices, walks through this as a questionnaire and produces the documentation.
The safeguards the rule expects, and that OCR looks for after an incident, are not exotic: unique user IDs for every person (no shared logins), automatic logoff, role-based access, encryption on devices and in transit, multi-factor authentication for remote and administrative access, regular review of audit logs, tested backups with a documented recovery procedure, a process to remove access the day someone leaves, device disposal procedures, and training that covers phishing because that is how most practices are actually breached. The Security Rule has historically labelled some of these "addressable" rather than "required", and OCR has proposed making more of them mandatory; in practice, treat encryption, MFA and audit log review as required and document your reasoning for anything you decide not to do. Since 2021, OCR must also consider whether a practice had recognized security practices in place for the prior twelve months when it sets penalties, which is a direct financial reason to keep the evidence.
The decision table
| Situation | The question to ask | If yes | If no |
|---|---|---|---|
| A new vendor will have access to systems or records | Do they need PHI to do the job? | Business associate agreement signed before access; add to the BA inventory | No BAA; confidentiality clause in the service contract is enough |
| A caller asks about a patient | Is the caller a treating provider, a payer with a claim, or a person the patient has involved in their care? | Disclose the minimum relevant information after reasonable verification; note it in the chart if unusual | Require a signed authorization or a legal process routed to the privacy official |
| A patient asks for their records | Can you produce the requested format? | Provide within 30 days in that format; cost-based fee only; log the request | Offer a readable alternative format; if the patient refuses, provide paper; still within 30 days |
| Staff want to text or email patients | Is the message limited to what is needed and sent through a channel the patient agreed to? | Permitted; appointment reminders need minimal content; use secure messaging or the portal for clinical detail | Get the patient's preference in writing first; do not send clinical detail by unencrypted channels unless the patient asked after a warning |
| A fax or email went to the wrong recipient | Did the recipient view or retain it, and is it a covered entity or BA that will destroy it? | Document the four-factor assessment; if the recipient confirms destruction without viewing, you may conclude low probability of compromise | Treat as a breach; notify the patient within 60 days; log it for the annual HHS submission |
| A device with PHI is lost or stolen | Was it encrypted and can you prove it? | Not a breach of unsecured PHI; document the determination and the evidence | Breach; begin notifications; count individuals to decide whether HHS and media notice are due within 60 days |
| A workforce member viewed a record without a work reason | Was the access in good faith within their authority? | Not a breach; document and retrain if judgment was poor | Breach of the individual's PHI; notify the patient; apply the sanctions policy; retrain |
| Ransomware or a compromised email account | Can you demonstrate a low probability that PHI was compromised? | Document the forensic basis thoroughly; keep the evidence | Presume breach for everyone whose PHI was accessible; notify; expect to report to HHS |
| A patient complains about privacy | Does your Notice of Privacy Practices tell them how to complain to you and to HHS? | Investigate, respond in writing, document; no retaliation | Fix the Notice; the right to complain to HHS cannot be waived |
The edge cases that cause the arguments
Sign-in sheets and calling names in the waiting room are permitted as incidental disclosures with reasonable safeguards: ask only for a name and arrival time, not the reason for the visit. A voicemail may carry your name, the practice and a callback number; not results or diagnoses unless the patient asked. Photographs for social media need a specific authorization that mentions the use. Students and shadowing high-schoolers are workforce members if you control their work, and need training and confidentiality agreements before they see anything. Texting between staff about patients on personal phones is the fastest way to lose control of PHI; use the EHR's messaging or an encrypted team app under a BAA. And state law frequently adds requirements, notably for mental health, HIV, substance use and reproductive health information, and sometimes shorter breach notification deadlines; the stricter rule governs, and this is where counsel earns their fee.
HIPAA is also enforced from two directions. OCR enforces the Privacy, Security and Breach Notification Rules, and state attorneys general can bring HIPAA actions too. CMS enforces the Administrative Simplification standards (transactions, code sets, identifiers and operating rules) that govern how your claims and eligibility checks move. A compliance program that covers the OIG's general compliance guidance, HIPAA and the billing rules together is smaller than three separate ones, and our training courses for practice staff are built that way.
Questions we hear
Does HIPAA apply to a solo practice with two employees?
Yes, in full, if the practice transmits health information electronically in connection with a standard transaction, which a solo practice that bills insurance does every day. Reasonable and appropriate safeguards for a solo practice differ from a hospital's, but the obligations (officer, risk analysis, policies, training, BAAs, Notice, breach procedures) are the same.
Can we text or email patients?
Yes, with care. Appointment reminders with minimal content are permitted. For anything clinical, use the patient portal or an encrypted messaging service, or get the patient's documented preference for unencrypted email or text after telling them the risk. Never send PHI from personal phones or personal email accounts, and make sure your messaging vendor has signed a business associate agreement.
How often do we have to do HIPAA training?
The Privacy Rule requires training for each new workforce member within a reasonable time after hire and whenever material policy changes affect their work; the Security Rule requires a security awareness program with periodic updates. Most practices train at hire and annually, with short reminders when a phishing attempt makes a point teachable. Keep the completion records for six years.
What counts as a reportable breach, and when do we report to HHS?
Any impermissible use or disclosure of unsecured PHI that you cannot show had a low probability of compromise under the four-factor assessment. Patients are notified within 60 days of discovery; HHS within 60 days for breaches of 500 or more individuals, with media notice where 500 or more residents of a state are affected; smaller breaches are logged and reported to HHS within 60 days after the end of the calendar year. Document every assessment, including those that conclude no breach occurred.
How much can we charge for copies of records?
A reasonable, cost-based fee covering labor for copying, supplies, postage, and preparation of a summary if the patient asked for one. OCR guidance allows a flat fee for electronic copies as an alternative to calculating actual costs; check the current amount on the HHS access guidance. State law may set a lower cap, and the lower one applies.
Sources and references
- HIPAA Basics, ONC (HHS): a plain-language entry point to the Privacy and Security Rules and their scope, with links to the HHS resources for providers.
- Guidance on Risk Analysis Requirements Under the HIPAA Security Rule, ONC (HHS): the OCR guidance on what a risk analysis must cover and how it is documented.
- Security Risk Assessment Tool, ONC (HHS): the free SRA Tool built with OCR for small and medium practices, as a Windows application or Excel workbook.
- Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information, HHS Office for Civil Rights: where covered entities report breaches of any size, and the public list of breaches affecting 500 or more individuals.
- OCR Complaint Portal, HHS Office for Civil Rights: the portal through which patients file HIPAA complaints, and the process a practice should expect to be on the other side of.
- General Compliance Program Guidance, HHS Office of Inspector General: the seven elements of an effective compliance program that a practice can combine with its HIPAA program.
- Enforcement and Compliance, Administrative Simplification, CMS: how CMS enforces the HIPAA transaction, code set, identifier and operating rule standards, separately from OCR's privacy and security enforcement.
