How do I ensure my patient record sharing workflow with a health data wallet is HIPAA compliant?

To make a patient-record sharing workflow with a health data wallet HIPAA-compliant, you need to design it around who is disclosing PHI, for what purpose, under what authority, and with what safeguards.

Here’s a practical checklist.

1) First determine your role

HIPAA obligations depend on whether you are a:

• Covered entity: provider, health plan, or clearinghouse
• Business associate: a vendor handling PHI on behalf of a covered entity
• Not covered by HIPAA: many consumer health apps and some wallet operators, unless acting for a covered entity or business associate

If the wallet or wallet provider is acting on behalf of a provider/plan and handles PHI, you may need a Business Associate Agreement (BAA).

2) Confirm there is a valid HIPAA permission basis for disclosure

A health data wallet can be used in several ways, but HIPAA requires a valid basis for sharing PHI, such as:

• Patient authorization for disclosures not otherwise permitted
• Treatment, payment, or health care operations (TPO) if applicable
• Other permitted disclosures under HIPAA
• Patient-directed disclosures are often allowed, but you still need to ensure the process is truly directed by the patient and appropriately scoped

If the workflow uses patient consent/authorization, make sure it meets HIPAA requirements:

• specific description of what is shared
• who can receive it
• purpose of disclosure
• expiration date/event
• patient signature or valid electronic authorization
• right to revoke
• no impermissible conditioning

3) Minimize the data shared

Use the minimum necessary standard where it applies.

• Share only the records needed for the purpose
• Prefer scoped access over bulk export
• Avoid sharing identifiers or notes not needed
• Consider using data segmentation for especially sensitive categories, where required by other laws

4) Use secure transmission and storage

HIPAA Security Rule safeguards should be built in:

• Encrypt data in transit and at rest
• Strong authentication for wallet access
• Role-based access control
• Least privilege
• Audit logs for:
  • who accessed data
  • when
  • what was shared
  • to whom
• Secure key management
• Timeouts, revocation, and session controls

5) Ensure the wallet supports patient control

If the patient is directing the sharing:

• the patient should clearly see what data will be shared
• the destination should be explicit
• the patient should be able to approve/reject
• provide an easy way to revoke future access
• make sure the patient understands whether the recipient is a provider, app, insurer, or other entity

6) Validate recipient status and downstream use

Before sharing, know whether the recipient is:

• a covered entity
• a business associate
• a consumer app outside HIPAA

If the recipient is not covered by HIPAA, the patient should be warned that HIPAA protections may no longer apply once disclosed, and the recipient’s privacy policy may govern use.

7) Put vendor and contractual controls in place

If any third party touches PHI on your behalf:

• execute a BAA if required
• review subcontractors
• define permitted uses/disclosures
• require breach reporting
• require secure disposal/termination procedures

8) Maintain policies, training, and incident response

HIPAA compliance is not just technical.

Have:

• written privacy/security policies
• workforce training
• risk analysis and risk management
• breach response procedures
• access review and periodic audits
• data retention and deletion rules

9) Be careful with special categories of data

Extra rules may apply to:

• mental health records
• substance use disorder records
• reproductive health information
• HIV/STI data
• minors’ records
• genetic data

HIPAA may not be the only law involved; state laws and federal specialty rules can be stricter.

10) Document the workflow

For compliance, document:

• your legal basis for sharing
• what the wallet does
• who is responsible for each step
• whether the wallet is a BA
• security controls
• authorization/consent flows
• breach handling procedures

---

Practical rule of thumb

A HIPAA-safer wallet workflow usually looks like this:

1. Patient authenticates into a provider or health plan portal
2. Patient selects specific records and a specific recipient
3. System confirms purpose and disclosure scope
4. Data is encrypted and transmitted securely
5. Access is logged and revocable
6. Contracts, policies, and risk controls support the process

---

Common pitfalls

• assuming “patient consent” always replaces HIPAA authorization
• sharing more data than needed
• using a wallet vendor without checking BAA status
• failing to tell patients when HIPAA no longer applies after transfer
• not logging or monitoring disclosures
• not addressing state law overlays

If you want, I can also give you:

1. a HIPAA compliance checklist for a wallet product, or
2. a sample end-to-end workflow showing where authorization, encryption, and BAAs fit.