HIPAA Compliance for Death Doulas: A Technical Guide

1. When HIPAA applies to a death doula

HIPAA's Privacy, Security, and Breach Notification Rules apply to covered entities — health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a HIPAA standard transaction (most commonly, billing insurance electronically). Certain provisions also apply directly to their business associates, meaning people outside the covered entity's workforce who are engaged to perform functions involving protected health information (PHI) on its behalf.

Three practical scenarios cover most doulas:

• Independent practice, private pay. You contract directly with families and do not bill insurance electronically. You are almost certainly not a covered entity, and HIPAA does not apply to you directly. State privacy law, consumer-protection law, and your own contracts still do.
• Contracted by a hospice, hospital, or health system. If a covered entity engages you and discloses PHI so you can perform a function on its behalf, you are functioning as a business associate. Under the HITECH Act and the 2013 Omnibus Rule, business associates are directly liable for parts of the HIPAA Rules — including the Security Rule's safeguards and impermissible uses and disclosures — and can be enforced against by the HHS Office for Civil Rights.
• Volunteer inside a hospice program. If you serve as part of a hospice's own volunteer workforce, you are generally covered by that organization's policies as a workforce member, not as a separate business associate. Ask the hospice which category they place you in — it changes who is responsible for training, breach reporting, and your recordkeeping.

The line matters because it decides whether a breach triggers a legal notification obligation. A business associate that discovers a breach of unsecured PHI must notify the covered entity, without unreasonable delay and no later than 60 days after discovery, so the covered entity can meet its own notification duties.

2. Business associate agreements, in the direction that surprises people

A covered entity must obtain satisfactory assurances — in writing, as a business associate agreement (BAA) — before disclosing PHI to you. Two consequences follow that doulas routinely miss:

• The hospice hands you a BAA, not the other way around. Read it before signing. It will impose obligations on you: safeguards, subcontractor flow-down, breach reporting timelines, and return or destruction of PHI at termination.
• Your tools inherit the obligation. If you store that PHI in a notes app, a spreadsheet in a consumer cloud drive, or a practice-management platform, that vendor is your subcontractor and needs its own BAA with you. Consumer messaging apps and most general-purpose note apps will not sign one.

If you are in independent private practice, no BAA is legally required. It is still worth asking a vendor whether the platform is designed to the Security Rule's safeguards, because that question tells you a lot about how the product treats your data.

3. What the Security Rule actually asks for, technically

The HIPAA Security Rule is deliberately technology-neutral: it names safeguards, not products. Translated into the choices a solo practitioner actually makes:

4. The parts HIPAA does not cover but families care about

Much of what a death doula records is not clinical at all: who is estranged from whom, what a person wants said at the bedside, which faith tradition to honor and which to avoid, the song that should be playing. It is not medical data, and exposure of it can still be devastating.

• Collect less. Ask whether each field changes your care. A diagnosis often does; a full date of birth often does not.
• Share narrowly. When a family member or volunteer needs access — for a care calendar, say — give them a scoped, expiring link instead of an account into the whole record.
• Plan for after the death. Decide in advance how long records are retained, who may request them, and what happens to your practice data if you stop practicing. Write it into your service agreement.
• Keep the working copy off paper. A binder in a car is the most common realistic breach in this field, and it has no audit log.

5. A checklist for a solo practice

• Determine your status: independent, business associate, or hospice workforce member — in writing, per contract.
• If any contract makes you a business associate, sign the BAA and get one from every tool that stores that data.
• Unique login and a strong, unique password for every person; multi-factor authentication where available.
• No client health information in consumer messaging, personal email, or unencrypted spreadsheets.
• Automatic session timeout on any device that opens client records.
• Full-disk encryption and a screen lock on every laptop and phone you use for practice.
• Scoped, expiring links for family- and volunteer-facing views instead of shared logins.
• A one-page written risk analysis and data policy, reviewed annually and retained for six years.
• A short breach response plan: who you call, what you document, the 60-day clock.
• A documented retention and end-of-practice plan for client records.

How Liminal Desk approaches this

Liminal Desk is client management software built specifically for end-of-life doulas. The technical safeguards described above are built into the platform rather than left to configuration: encryption in transit and at rest, row-level data isolation so one practitioner's records are unreachable by another at the database layer, a 15-minute inactivity timeout, append-only audit logging for signature events, and time-limited tokens for client portals and shared care calendars.

No software alone makes a practice HIPAA compliant — compliance also requires your own policies, training, agreements, and judgment. Software can, however, remove the failure modes that come from a binder, a spreadsheet, and a shared inbox.