The HIPAA calendar: what you do, and when

Every clinic owner eventually asks the same question, and it is the right one: what am I supposed to actually do, and how often?

The answer is stranger than you expect. HIPAA fixes about a dozen deadlines, precisely, in days. Everywhere else it says periodic, or regularly, or within a reasonable period of time, and then stops talking.

That silence is deliberate. It is the flexibility clause (45 CFR 164.306(b)) doing its work: a rule that told a twelve-person ABA clinic to do the same things on the same schedule as a hospital system would be a worse rule. But the flexibility has a sting in it. The rule sets a handful of hard deadlines and then, almost everywhere else, says periodic. Which means your cadence is not given to you. It is chosen by you, and you will be held to the choice.

So here are all three layers: the deadlines that are real, the cadences you must set yourself, and the events that force work no matter what month it is.

“The rule sets a handful of hard deadlines and then, almost everywhere else, says periodic. Which means your cadence is not given to you. It is chosen by you, and you will be held to the choice”

Layer one: the deadlines the rule actually fixes

These are not negotiable and not yours to define. Learn them once.

One of those deserves to be on a wall. The 30-day correction window is the most valuable deadline in HIPAA, because it is the only one that makes a penalty disappear rather than merely arrive on time. A clinic that finds its own problems and closes them inside thirty days is standing inside a defense the regulation wrote for it. How that works in an investigation.

Layer two: the cadences you have to choose

Here the rule tells you the work is required and then hands you the calendar. Every item below is mandatory. Every interval below is our recommendation, not law, and we say so plainly because the honest answer is that you must choose a cadence and be able to defend it.

The trap in this table is not laziness. It is writing an ambitious cadence and then not keeping it. Your own policy becomes the standard you are judged against, so a clinic that promises monthly log reviews and performs two a year has manufactured its own finding. Choose intervals you will actually keep, write them down, and keep them.

Layer three: the events that override the calendar

This is the layer that matters most in an ABA clinic, because your business does not run on a calendar. It runs on hiring, turnover, and whatever a clinician downloaded last Tuesday.

Someone is hired. Training before the first solo session. Unique credentials issued. Access granted by role, not by copying someone else’s. Confidentiality acknowledgment signed.

Someone leaves, or changes role. Access revoked the day employment ends, not the week after. Devices returned and wiped. The record of both, dated. In a workforce that turns over like an RBT workforce, this is your most frequently exercised security process.

A new tool or vendor appears. Before it touches a client: what does it hold, who else sees it, has it signed a BAA. The question to ask every time. This is the trigger clinics miss most, because the tool arrives without a decision.

A new location, service line, or platform. A new clinic site, a telehealth program, a new EHR, a new data collection app. Each is a material change to your environment, which triggers the risk analysis review, the evaluation standard, and usually a policy update and retraining.

An incident, of any size. Log it, assess it, and feed it back into the risk analysis. An incident is an unscheduled, expensive discovery about your actual risks, and the four-factor assessment is due whether or not it turns out to be a breach. What to do on the day.

A policy changes materially. Retraining of everyone affected, after it takes effect, documented (45 CFR 164.530(b)(2)(i)(C)).

The regulations change. A final rule, a court decision, a new enforcement initiative. Sweep everything it touches, not just the obvious page. What is changing, and when.

Diligence, or an acquisition approach. Not a compliance event in the legal sense, and absolutely a compliance event in practice: it is the day someone with money at stake reads your file. The request they will send.

The one-page version

If you take nothing else, take this shape:

Every hire and every departure: training in, access out, same day, recorded.

Monthly: read the logs, review the open risk findings, one security reminder to the team.

Quarterly: access review, vendor and BAA review.

Annually: risk analysis review, evaluation, policy review, contingency test, NPP check, and, in January, check whether the penalty figures moved.

Whenever something changes: new tool, new site, new service, new platform, new rule, or an incident. Do not wait for the calendar.

Always: the six-year file, and the thirty-day correction window.

That is a real HIPAA program’s calendar. It is not long, and nothing on it is difficult. What makes it hard is that eight of these items decay continuously in an operation where nobody’s job title contains the word compliance, which is exactly why they need dates and owners rather than good intentions. The twelve parts they belong to.