Question 1

What should our HIPAA policies cover, and who reviews them?

Accepted Answer

Your agency should maintain policies for privacy, security, workforce access, incident response, breach response, and contingency planning, adapted to how your team actually works. Quillward helps you assign an owner, set a review date, and keep supporting evidence together. Agency leadership remains responsible for approving and updating its policies. Quillward helps with organization and preparedness; it does not certify compliance or replace your own assessment or qualified legal advice.

Question 2

How long should we retain HIPAA evidence, and who handles deletion?

Accepted Answer

Your agency sets a retention and deletion schedule that accounts for its records, contracts, legal holds, and applicable federal and state requirements. Assign an owner for each evidence type, document the decision, and securely delete records when the approved period ends. Quillward helps make owners, dates, and evidence visible; your agency remains responsible for retention and deletion decisions.

Question 3

What should a small agency include in a risk assessment?

Accepted Answer

Review the people, systems, locations, vendors, and workflows that create, receive, maintain, or transmit protected health information. Record likely threats and vulnerabilities, the potential impact, existing safeguards, open remediation work, and any risks your agency accepts. Revisit the assessment when operations or technology change. Quillward helps organize the work and evidence, but your agency decides the scope, findings, and next actions.

Question 4

What should we keep in workforce training records?

Accepted Answer

Keep the training topic and version, date, audience, attendees or attestations, and any follow-up required. Include role-appropriate privacy and security training, then document refresher training and training after material policy changes. Quillward helps your team track the record and its owner; your agency must keep the information accurate and confirm that training happened.

Question 5

When do we need a business associate agreement (BAA)?

Accepted Answer

When a vendor or other party performs covered services involving protected health information, your agency should determine whether a BAA is required and ensure the agreement matches the relationship and services. A BAA does not transfer your agency’s responsibility for due diligence, access controls, or oversight. Quillward can help track BAA status and supporting evidence, but it does not provide legal advice or decide whether a specific contract is sufficient.

Question 6

How should we handle state-specific requirements?

Accepted Answer

HIPAA is a federal baseline, and state privacy, breach-notification, licensure, record-retention, and home-care rules may add requirements. Identify every state where your agency operates or serves patients, then confirm the applicable requirements with qualified counsel or the relevant regulator. Quillward helps you track state-specific tasks and evidence; it does not interpret state law, provide legal advice, or guarantee compliance.