Skip to content
Deploris
Request an engineer

Compliance · US covered entities (health plans, health care clearinghouses and health care providers that conduct certain electronic transactions) and their business associates and subcontractors that handle protected health information.

HIPAA and field work.

Health Insurance Portability and Accountability Act

Trust CenterAsk about your scope

General information, not legal advice. Last reviewed October 27, 2026.

Quick answer

How does HIPAA touch field work?

HIPAA is the US federal law that protects health information held by covered entities, such as health plans and most health care providers, and by their business associates. On-site IT work in clinics and hospitals can expose patient data on screens, drives and tickets, so the covered entity may need a business associate agreement, media controls and breach reporting rules.

What is HIPAA?

The HIPAA rules, enforced by the HHS Office for Civil Rights, include the Privacy Rule, the Security Rule and the Breach Notification Rule. They protect protected health information (PHI), and the Security Rule applies to electronic PHI (ePHI).

A business associate is a person or entity, other than a member of the covered entity's workforce, that performs functions or services for a covered entity involving access to PHI. A subcontractor that handles PHI for a business associate is also a business associate. Covered entities and business associates generally need a written contract, a business associate agreement (BAA), before PHI is shared for such services.

The Security Rule's physical safeguards include facility access controls and device and media controls. Facility controls address a facility security plan, access control and validation including visitor control, and records of repairs and modifications related to security. Device and media controls require policies for the receipt and removal of hardware and electronic media that hold ePHI. Procedures for disposal and media re-use are required, and accountability and data backup are addressable, which means they must be implemented or their absence justified.

Under the Breach Notification Rule, a business associate must notify the covered entity without unreasonable delay and in no case later than 60 calendar days after discovering a breach of unsecured PHI. The 60 days is an outer limit, not a target.

HHS proposed amendments to the Security Rule in a notice published in January 2025. Check HHS for whether a final rule has been published before relying on the current text.

How it touches on-site IT work

  • Incidental or real access: HHS guidance treats technicians whose work needs no access to PHI, with only incidental exposure, differently from vendors who handle PHI. An engineer who works on systems or drives holding ePHI, or who takes custody of a drive, is more likely to be treated as a business associate. The covered entity decides, with counsel.
  • Devices with ePHI: clinical workstations, servers and storage may hold patient data. Swapping a failed drive or moving a device raises the question of who holds the media and how it is wiped, returned or destroyed.
  • Visitor and facility control: clinics and hospitals control who enters server rooms and clinical areas. Field engineers need visitor procedures, escorts where required and a record of access.
  • Hardware movement: the Security Rule's accountability specification expects a record of movements of hardware and electronic media and who is responsible, so removals need a log.
  • Photos and screens: photos taken in clinical areas or of screens can capture patients or PHI. What may be photographed should be agreed first.
  • Subcontractors and incidents: a business associate must have assurances from its subcontractors, and its contract must require reporting of security incidents and breaches to the covered entity.

What you can agree in a written scope

  • Whether a BAA is required, decided by the covered entity with counsel, and signed before any access to PHI.
  • Limits on access: engineers do not open patient records, and work is done with the minimum access the task needs.
  • Drive handling: media stays under the customer's control, or leaves only with a custody record and an agreed wipe or destruction method with evidence, such as NIST SP 800-88 sanitization.
  • A movement log for hardware and media that leave the site.
  • Visitor rules: ID checks, escorts, badge handling and sign-in records.
  • Photo rules: no patients, no screen contents, and a storage and deletion rule for any photos taken.
  • Subcontractor terms: approval first, with the same obligations passed down.
  • Incident reporting that is much faster than the 60-day limit, with a named contact and the details the covered entity needs.
  • Return or destruction of PHI and related records at the end of the engagement.

Questions to ask any field services provider

  • Will you sign a business associate agreement if our work involves PHI?
  • Who will attend, and what HIPAA or privacy training do they have?
  • What do you do if an engineer sees PHI unexpectedly?
  • Do you remove drives from our site, and how are they tracked until wiped or destroyed?
  • Do you use cloud tools for tickets or photos that could contain PHI?
  • How soon will you report a security incident or lost media?
  • Do subcontractors or independent engineers work on our site, and how are they bound?

This page is general information and not legal advice. Deploris does not claim certification or compliance status here. Confirm what applies to you with your own counsel or compliance team.

Official sources

QUESTIONS

Common questions.

Does an IT field services provider need a BAA under HIPAA?
It depends on whether the provider has access to PHI as part of its services. HHS guidance treats equipment repair where exposure is only incidental differently from vendors who create, receive, maintain or transmit PHI. If engineers will work on systems or drives that hold ePHI, the covered entity usually signs a BAA, and it should decide the question with counsel.
Is there a HIPAA certification for vendors?
No. HHS does not certify persons, products or organizations as HIPAA compliant and does not recognize private HIPAA certifications. Treat a claim of HIPAA certification as a marketing phrase and ask instead what the provider will agree to in a BAA and a written scope.
What does HIPAA say about removed hard drives?
The Security Rule requires policies for the receipt and removal of hardware and electronic media that contain ePHI, including procedures for disposal and for removing ePHI before media is reused. It also expects a record of movements of hardware and media. Write the drive handling and evidence you expect into the scope.
How fast must a business associate report a breach?
A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI. That is an outer limit. Most covered entities ask for much faster notice in the BAA or the scope.

KEEP READING

Related pages.

Get started

Need engineers on site? Tell us where.

Tell us the sites, the scope and the timeline. We reply with a written plan.

Request ServicesBrowse services

Go to

Saved and recent pages stay on this device. Press ? for keyboard shortcuts.

Keyboard shortcuts

Search the site
/ or Ctrl K
Show this list
?
Switch light, dark or system theme
t
Save or unsave this page
s
Go to the home page
g then h
Go to services
g then s
Go to coverage
g then c
Go to the contact form
g then q

Shortcuts are off while you type in a field.