Health and HIPAA at medical events

Safe intake at medical events

At medical events, HIPAA means protecting any protected health information you collect and controlling how you use it. Protected health information, or PHI, is any information that ties a person to their health. Confirm your specific duties with your attorney or compliance advisor.

Before the event

• Decide if you need PHI at all, because skipping it removes most risk.
• Separate clinical intake from marketing interest, so PHI never enters your marketing tools.
• Post a plain one page data notice, so people know what you collect and why.
• Get written consent for email and text, because consent sets expectations and reduces complaints.
• Use vendors that sign a BAA, because HIPAA requires a business associate agreement for PHI handling.
• Train staff on minimum necessary, so they ask only for what is needed for the purpose.
• Plan secure storage and transport, with a locked container and a named custodian.

During and after

• Hold conversations out of earshot, because voice privacy prevents accidental disclosure.
• Keep paper forms in a closed container, not on the table where cameras can see them.
• Use a hotspot or private network for ePHI, and avoid public Wi-Fi.
• Never type PHI into personal email, notes or a general CRM, and use your approved system instead.
• Put only de-identified notes in your marketing CRM, which means personal details are removed.
• Segment follow up by consent, and never include PHI in email, text or social posts.
• Log custody and storage each day, noting who has the box and where it is.
• Dispose of leftovers securely, by shredding paper and wiping devices per your policy.
• Act quickly if something is lost, and follow your incident response plan.

If you want help planning and documenting this flow, I can support you with HIPAA Compliance and Marketing Plans. I also set up consent based follow up with CRM, Email Marketing, Social Media Marketing and Text Alerts. For non PHI leads, I can configure AppWT CRM.