The Ethics of HIPAA for Non-Traditional Providers: Why Community Organizations Must Take Privacy Seriously

Many community-based organizations assume HIPAA only applies to hospitals, clinics, and healthcare providers.

That assumption can create significant compliance risks.

As CalAIM continues to expand integrated care models across California, community organizations are increasingly handling sensitive client information. Whether you’re providing Enhanced Care Management (ECM), Community Supports, housing services, care coordination, or social service referrals, you may be accessing, sharing, or storing Protected Health Information (PHI).

If your organization touches Medi-Cal data, privacy and confidentiality are no longer optional—they are essential.

Understanding your responsibilities is critical to protecting clients, maintaining contracts, and preserving the trust that makes your mission possible. 

Protecting client information isn’t just about following regulations. It begins with ethical responsibility.

Organizations serving vulnerable populations are entrusted with highly personal information about an individual’s health, housing status, behavioral health needs, and life circumstances. How that information is handled directly impacts client trust and outcomes.

Two foundational ethical principles guide confidentiality practices:

Autonomy

Autonomy means respecting an individual’s right to make decisions about their own information. Clients have the right to understand how their information is being used and who it is being shared with.

Non-Maleficence

Often summarized as “do no harm,” this principle requires organizations to avoid actions that could negatively impact clients. Improper disclosure of personal information can lead to stigma, discrimination, housing instability, loss of services, or emotional distress.

When organizations fail to protect confidential information, the consequences can extend far beyond regulatory penalties.

Protected Health Information (PHI) refers to any information related to an individual’s health condition, healthcare services, or payment for healthcare that can be linked to a specific person.

Examples include:

• Medical diagnoses
• Treatment plans
• Care coordination notes
• Medi-Cal identification numbers
• Behavioral health information
• Housing and health assessments
• Service utilization records
• Any combination of data that can identify a client

Many community-based organizations are surprised to learn that even seemingly routine client information may qualify as PHI when connected to healthcare services.

A common misconception is that if information sharing helps a client, it is automatically permissible.

HIPAA does not work that way.

Organizations must follow the Minimum Necessary Rule, which requires staff to access, use, and disclose only the information needed to perform a specific task.

The question should always be:

“What is the minimum amount of information necessary to accomplish this objective?”

Sharing more than necessary increases risk and may violate privacy requirements.

Community organizations are often passionate advocates for their clients. However, good intentions do not override confidentiality requirements.

Staff members may be tempted to share personal details when seeking resources, coordinating care, or discussing difficult cases. Without proper authorization, these disclosures can create serious compliance issues.

Common risks include:

• Discussing client cases in public spaces
• Sharing information through unsecured email or text messages
• Providing details to partners without proper authorization
• Accessing client information without a legitimate business need

Protecting confidentiality must remain a priority even when the goal is helping the client.

These laws generally focus on transparency and accountability by requiring organizations to clearly communicate:

• What information is being collected
• Why it is being collected
• How it is being used
• Who it is being shared with

As privacy regulations continue to evolve, organizations should regularly review their data collection and privacy practices to ensure compliance.

1. Verify Your Release of Information Process

Before discussing a client’s situation with a landlord, healthcare provider, partner agency, or other third party, ensure a valid Release of Information (ROI) is in place.

Ask yourself:

• Is the ROI signed and current?
• Does it clearly identify who information may be shared with?
• Does it specify what information can be disclosed?
• Does it align with the purpose of the communication?

An outdated or incomplete ROI may not provide adequate protection.

2. Implement the “Lock and Key” Standard

Protecting client information requires both physical and digital safeguards.

Best practices include:

• Locking physical client files
• Restricting office access
• Using strong passwords
• Encrypting sensitive data
• Securing remote access through VPNs
• Limiting system access based on job responsibilities

Every access point represents a potential vulnerability.

3. Train Every Employee Annually

Compliance is not solely the responsibility of leadership or compliance officers.

Every staff member who handles client information should receive regular privacy and confidentiality training.

Training should cover:

• HIPAA fundamentals
• Organizational privacy policies
• Proper data sharing procedures
• Security best practices
• Incident reporting protocols

One untrained employee can create significant organizational risk.

In reality, strong privacy practices are a competitive advantage.

Health plans, government agencies, and funding partners want to work with organizations they trust. Demonstrating strong confidentiality practices shows that your organization can responsibly manage sensitive information and fulfill contractual obligations.

Good stewardship of client data helps:

• Build client trust
• Strengthen partner relationships
• Reduce legal and financial risk
• Improve audit readiness
• Position your organization for larger funding opportunities

In today’s healthcare environment, compliance is not separate from mission success—it is part of it.

Privacy is more than a legal requirement. It is an ethical commitment to the people who trust your organization during some of the most vulnerable moments of their lives.

By understanding HIPAA, following ethical principles, implementing strong security practices, and investing in staff training, your organization can protect both its clients and its mission.