HIPAA and Your Medical Office Layout

Two provisions matter for space planning. Under 45 CFR 164.530(c), a covered entity must have appropriate administrative, technical and physical safeguards to protect the privacy of protected health information, and must reasonably safeguard it to limit incidental uses or disclosures. Under 45 CFR 164.502(a)(1)(iii), disclosures incident to an otherwise permitted use or disclosure are allowed, provided the safeguard and minimum necessary requirements have been met.

The HHS Office for Civil Rights (OCR) explains the idea in its incidental disclosures guidance: the Privacy Rule does not require that all risk of incidental use or disclosure be eliminated, and safeguards are not expected to guarantee privacy from every potential risk. A visitor may overhear a conversation or glimpse a name on a sign-in sheet. That is treated differently from a disclosure that results from a failure to apply reasonable safeguards, which is not permitted.

OCR is also direct about construction. In its FAQ on soundproofing, it says the Privacy Rule does not require structural changes to facilities and that the Department does not consider facility restructuring to be a requirement under this standard. Its examples of what is not required include private rooms and soundproofing of rooms.

HHS guidance is not a pass on privacy. A layout that makes safeguards impractical still leaves the practice responsible for finding ones that work.

OCR says reasonable safeguards vary from one covered entity to another, depending on factors such as size and the nature of the business. A covered entity should assess the potential risks to patient privacy, the potential effects on patient care, and any administrative or financial burden. OCR adds that covered entities may consider what other prudent health care and health information professionals are doing.

That means two practices can reach different answers about the same floor plan. A behavioral health practice and a high-volume primary care office hold different information and have different conversations. Have your privacy officer and counsel record what you decided and why, and ask counsel whether state privacy law asks for more.

Check-in is where patients are closest to one another. OCR says physician's offices may use sign-in sheets or call out names in waiting rooms so long as the information disclosed is appropriately limited, and that a sign-in sheet may not display medical information not necessary for signing in, such as the medical problem for which the patient is being seen.

For areas where many patient and staff conversations occur, OCR gives physical examples of what may count as a reasonable safeguard: cubicles, dividers, shields, curtains or similar barriers. It says a large clinic intake area may reasonably use cubicles or shield-type dividers, not separate rooms. Asking people to stand a few feet back from a counter is another of its examples.

Translated into a plan, these are items to discuss with your architect:

• Distance between the check-in counter and the nearest waiting room seats.
• Whether screens at reception face away from patients and visitors.
• A spot, even a small one, to step aside for a sensitive question.
• Dividers at intake positions where more than one conversation runs at once.
• Where staff take phone calls with patient details.

Soundproofing is not a HIPAA requirement, according to OCR. Many practices still treat sound as a design goal, for patient comfort and trust, particularly in therapy and behavioral health. Treat it as an operating choice you pay for, not a legal specification, and be clear with the architect about which rooms matter most.

OCR also lists common habits that count as safeguards, such as speaking quietly when discussing a patient's condition in a waiting room or public area, and avoiding patient names in public hallways and elevators. A layout that places consult conversations away from corridors makes those habits easier to keep, and posted reminders to staff are one of the examples OCR gives.

OCR gives isolating or locking file cabinets or records rooms, and using passwords on computers, as examples of safeguards. It says areas housing patient files could be supervised or locked. Its FAQs say the Privacy Rule does not prohibit keeping charts outside exam rooms, and permits it as long as reasonable and appropriate measures protect the patient's privacy. So a chart holder is a judgment call about the hallway, not a banned item.

Electronic records add the Security Rule. 45 CFR 164.310 sets physical safeguard standards for covered entities and business associates, including facility access controls, which limit physical access to electronic information systems and the facilities that house them, along with standards for workstations and for device and media controls. Some implementation specifications are marked required and others addressable, so have your compliance lead map the server closet, workstations and any shared building riser against the text.

Some of the most useful privacy decisions sit in the lease, not on the floor plan. Healthcare attorneys at Frier Levitt note that commercial leases typically give the landlord broad access to the space, which could compromise a tenant's HIPAA privacy and security obligations if not appropriately limited. Attorneys at Winstead make a similar point about provisions allowing unfettered landlord access. These are the questions to raise, with TAG on the business terms and your attorney on the drafting:

• ✓Does landlord entry require notice, except in a genuine emergency?
• ✓Can we require that landlord staff and contractors be accompanied in clinical and records areas?
• ✓Who cleans the suite after hours, and how are records areas and screens handled during cleaning?
• ✓Does the building's master key reach our records room?
• ✓Can we choose our own locks, cameras or access system?
• ✓If the lease ends or we are displaced, what happens to any records left behind?
• ✓Is there a clear process for moving and disposing of records and devices when we leave?

Move-out deserves its own line in the plan. OCR says covered entities may not simply abandon protected health information or dispose of it in dumpsters or other containers accessible to the public or unauthorized persons, though no particular disposal method is required. The Security Rule also addresses final disposition of electronic information and removal from media before re-use.