HIPAA checklist for home care agencies

A named privacy official and a named security official. In a small agency one person, often the owner, holds both roles.

• Privacy official named and documented 45 CFR 164.530(a)
• Security official named and documented 45 CFR 164.308(a)(2)
• Written privacy and security policies 45 CFR 164.530(i) and 164.316(a)
• Notice of Privacy Practices given to clients and posted on your website 45 CFR 164.520
• Sanctions policy for staff who break the rules 45 CFR 164.530(e) and 164.308(a)(1)(ii)(C)

Do one before you start, repeat it after any major change, and review it at least yearly.

• Written risk analysis listing where client information is stored, sent and accessed 164.308(a)(1)(ii)(A)
• Risk management plan with owners and dates 164.308(a)(1)(ii)(B)
• Data backup and disaster recovery plan 164.308(a)(7)

Training at hire and after any material policy change, access limited to each person’s own clients, and access removed the day someone leaves.

• Privacy training for every new hire within a reasonable time, with sign-in records 45 CFR 164.530(b)
• Security awareness training and periodic reminders 164.308(a)(5)
• Caregivers see only their own clients ("minimum necessary") 45 CFR 164.502(b)
• Each user has a unique login, no shared accounts 45 CFR 164.312(a)(2)(i)
• Termination procedure removes access when employment ends 164.308(a)(3)(ii)(C)

Client information belongs in an encrypted app behind a passcode, not in group texts or personal email.

• Passcodes and auto-lock on every phone and computer used for work 45 CFR 164.310(b) and (c)
• Encryption on laptops and in the apps you use 164.312(a)(2)(iv) and (e)(2)(ii)
• Lost or stolen device procedure 164.310(d)

Every vendor that creates, receives, stores or sends client health information for you: scheduling and EVV software, billing services, cloud storage, answering services and shredders.

• Signed BAA with every vendor that handles client information 164.308(b) and 164.504(e)
• List of vendors with BAA dates 164.316(b)
• Process for clients to get copies of their records within 30 days 45 CFR 164.524(b)
• Signed authorization before sharing with family members where required 164.508

Notify each affected client without unreasonable delay and within 60 calendar days of discovery.

• Written breach response plan 164.308(a)(6)
• Breach log, including small incidents 164.408(c)
• Client notice letters within 60 days, in plain language 164.404(b) and (c)