Updated November 2026 · Southern New Hampshire
HIPAA compliance NH: a small business guide beyond shredding
HIPAA reaches far more New Hampshire businesses than clinics, from billing services and IT shops to the accountant who reviews a practice’s books. This HIPAA compliance NH guide covers who is covered, what a business associate owes, the safeguards the rules require and what to do when something goes wrong.
99¢ per pound at our Tewksbury drop-off. Certificate of Destruction on every job.
- 99¢ per pound
- Since 2007
- BBB A+ rated
- HIPAA BAA on request
Quick answer
HIPAA compliance in NH starts with one question: are you a covered entity (a health plan, a clearinghouse or a provider that bills electronically) or a business associate that handles their patient information? If so, you need a privacy and a security official, a written risk analysis, policies, staff training, signed Business Associate Agreements and a plan to give breach notice within 60 days, with New Hampshire’s RSA 359-C:20 adding state notice duties for computerized data. New Hampshire Document Shredding covers the disposal piece with a BAA on request, explained on our HIPAA shredding requirements page.
HIPAA compliance NH basics: the three rules that matter
HIPAA is a 1996 federal law, but the duties a business actually follows live in regulations at 45 CFR Parts 160 and 164. Three sets of rules do most of the work. Knowing which part says what saves you from buying a “HIPAA kit” that covers the wrong things.
Privacy Rule
Subpart E of Part 164. Who may see and share protected health information (PHI), patient rights, the notice of privacy practices, the privacy official, training and safeguards for PHI in any form, paper included.
Security Rule
Subpart C of Part 164. Administrative, physical and technical safeguards for electronic PHI. It applies to covered entities and business associates alike, and it starts with a risk analysis.
Breach Notification Rule
Subpart D of Part 164. What counts as a breach of unsecured PHI, who must be told, and the deadlines: individuals, HHS, sometimes the media, and the covered entity when a business associate slips.
Part 160 holds the definitions and the enforcement rules. It also settles the federal and state question. Under 45 CFR 160.203, HIPAA generally preempts a contrary state law, but a state privacy law that is more stringent than the Privacy Rule stays in force. So a New Hampshire business follows HIPAA plus any stricter state rule, not one or the other.
Who HIPAA covers: covered entities and everyone else
The definition at 45 CFR 160.103 names three kinds of covered entity: a health plan, a health care clearinghouse, and “a health care provider who transmits any health information in electronic form in connection with a transaction” covered by the rules. Transactions include claims, eligibility checks, claim status, referral authorizations and payment and remittance advice.
The provider test trips people up. A provider is anyone who “furnishes, bills, or is paid for health care in the normal course of business.” Bill one insurer electronically, directly or through a billing service, and the whole practice is a covered entity. A cash-only provider that never sends a standard electronic transaction may fall outside it, though state law and licensing rules still apply.
| New Hampshire business | Likely HIPAA status | Why |
|---|---|---|
| Physician, dental, therapy or chiropractic office that bills insurance | Covered entity | Health care provider sending electronic claims and eligibility checks |
| Pharmacy or home health agency billing payers | Covered entity | Same provider test |
| Medical billing company or practice management firm | Business associate | Handles PHI for claims processing and billing on a covered entity’s behalf |
| IT support, cloud backup or EHR hosting vendor | Business associate | Creates, receives, maintains or transmits PHI for a covered entity |
| CPA firm or law firm working for a practice | Business associate when PHI is disclosed to it | Accounting and legal services are named in the definition |
| Shredding vendor collecting patient files | Business associate | Receives PHI to destroy it on the covered entity’s behalf |
| Employer holding sick notes in personnel files | Not PHI in that role | PHI excludes employment records a covered entity holds as employer |
Accountants are a common surprise. If a practice sends you patient-level reports to prepare its books, you are likely a business associate. Our page on shredding for accountants covers the client files that pile up afterwards, and law firms can see our post on law firm shredding.
Business associates: what you owe under HIPAA
A business associate is a person or company outside the covered entity’s workforce that creates, receives, maintains or transmits PHI for a regulated function, or provides legal, accounting, consulting, management or financial services that involve PHI. Subcontractors of a business associate that touch the same PHI are business associates too.
The agreement
The contract rules at 45 CFR 164.504(e) list what a Business Associate Agreement must say. It sets the permitted uses of PHI, requires appropriate safeguards and Security Rule compliance for electronic PHI, and requires reporting of any use not allowed by the contract, including breaches.
It also makes the associate bind its own subcontractors to the same terms, open its books to HHS on request, and, at the end of the contract, return or destroy the PHI if feasible.
Direct duties
Business associates are not just contract parties. The Security Rule standards in 164.308, 164.310 and 164.312 apply to “a covered entity or business associate” by their own terms. A five-person IT firm needs its own risk analysis and security official.
And under 164.410, a business associate that discovers a breach of unsecured PHI must notify the covered entity without unreasonable delay and within 60 calendar days, with the names of the people affected where possible.
- Keep a list of every covered entity you serve and the date each BAA was signed.
- Flow the same terms down to your own vendors who touch the data, including cloud storage and disposal.
- Read the termination clause. Know how you will return or destroy PHI when a client leaves.
- Train your staff, even if you are small. The duty does not shrink with headcount.
HIPAA compliance NH checklist: the safeguards the rules require
Most of HIPAA compliance for a small office comes down to a handful of named people, written documents and habits. The Privacy Rule sets the people and the training. The Security Rule sets the risk analysis and the technical controls for electronic PHI.
Administrative
Name a security official (164.308(a)(2)) and a privacy official (164.530(a)). Run a risk analysis and a risk management plan, both marked “Required.” Keep a sanction policy and a security awareness and training program for all staff, managers included.
Physical
Limit physical access to the systems and the rooms that hold them under 164.310(a). Control workstations and set policies for the final disposition of devices and media. Locked doors and locked cabinets do much of the work.
Technical
Under 164.312, give each user a unique login, keep audit controls that record activity in systems holding electronic PHI, protect data integrity, and secure PHI sent over a network.
- Name the officialsIn a small office one person can be both privacy and security official. Write the name into your policies so staff know who to ask.
- Do the risk analysisList where PHI lives: the EHR, email, laptops, phones, paper files, the copier. Rate the risks and write down what you will do about each.
- Write the policiesAccess, passwords, devices, paper handling, disposal, breach response. Short and specific beats long and generic.
- Sign the agreementsGet a BAA from every vendor that touches PHI: billing, IT, cloud, shredding. File them together.
- Train and documentTrain new staff within a reasonable time and retrain when policies change. Keep sign-in sheets for the training.
- Keep it six yearsRetain policies, risk analyses and other required documentation for six years from creation or last effective date, whichever is later.
Breach notification: the federal clock
Under 45 CFR 164.402, a breach is the acquisition, access, use or disclosure of PHI in a way the Privacy Rule does not permit that compromises its security or privacy. Any impermissible use or disclosure is presumed to be a breach unless you can show a low probability of compromise after a risk assessment of at least four factors: the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and how far the risk has been mitigated.
| Who must be told | When | Rule |
|---|---|---|
| Each affected individual | Without unreasonable delay, no later than 60 calendar days after discovery | 164.404 |
| Prominent media outlets in the state | Same 60-day limit, when more than 500 residents of a state are affected | 164.406 |
| HHS, 500 or more people | At the same time as the notice to individuals | 164.408(b) |
| HHS, fewer than 500 people | Keep a log, report within 60 days after the end of the calendar year | 164.408(c) |
| The covered entity, from a business associate | Without unreasonable delay, no later than 60 calendar days after discovery | 164.410 |
The clock starts on discovery, and discovery is earlier than most owners think. A breach counts as discovered on the first day any workforce member or agent, other than the person who caused it, knew or should reasonably have known. The front desk noticing a misdirected fax on Monday starts the clock on Monday, not when the owner hears about it on Friday.
The rule only covers unsecured PHI. Information that has been destroyed so it cannot be read or reconstructed is no longer a breach risk, which is the practical reason disposal belongs in your breach plan.
New Hampshire law on top of HIPAA
New Hampshire has its own notice of security breach statute, RSA 359-C:19 to 359-C:21. It applies to any person doing business in the state, not only health care, and it can apply to the same incident as the federal rule.
What the state law covers
The statute protects “personal information”: a first name or initial and last name combined with a Social Security number, a driver’s license or other government ID number, or a financial account or card number with the code needed to access it. It applies to computerized data, and encrypted data is excluded unless the key goes with it.
When a business becomes aware of a breach, it must promptly decide whether misuse has occurred or is reasonably likely. If so, or if it cannot tell, it must notify affected people as soon as possible.
Who else gets notice
Most businesses must also notify the New Hampshire attorney general’s office, or their primary regulator, with the expected notice date and the approximate number of residents affected. If more than 1,000 people need notice, the nationwide consumer reporting agencies must be told as well.
Businesses that follow a state or federal regulator’s breach procedures may be deemed compliant under RSA 359-C:20, V, if they fall within its terms. Our guide to the New Hampshire data breach law covers notice content and enforcement.
Licensing rules add a retention layer. Physicians licensed by the NH Board of Medicine must keep a complete copy of patient records for at least 7 years from the patient’s last contact under Med 501.02(f)(8). HIPAA sets no retention period for the charts themselves, so the board rule controls. Other boards set their own.
Where paper and disposal fit in HIPAA compliance
The Privacy Rule’s safeguard standard at 45 CFR 164.530(c) covers PHI in any form, so paper is part of compliance even in a fully electronic office. Printed schedules, faxes, intake forms and the box of old charts in the basement all count.
Disposal is one line in your policy, not the whole program. We keep this guide on the broader rules and cover the disposal detail on our medical shredding service page, which explains how a practice job runs with a Business Associate Agreement and a Certificate of Destruction.
Devices are the other half. The Security Rule asks for policies on the final disposition of electronic PHI and the media it sits on. Old laptops, copier drives and phones go to hard drive destruction, physically destroyed and quoted per item.
What does disposal cost in a compliance budget? Less than most owners expect, as long as you batch it. The chart below compares a small office’s year of paper handled four times or once.
Drop-off at our office, 1215 Main Street, Unit 115, Tewksbury, is 99 cents per pound with no appointment on weekdays. Pickup adds $129.95 in Zone 1 (border towns such as Salem, Pelham, Windham and Plaistow), $159.95 in Zone 2 (greater Nashua and Manchester) or $199.95 in Zone 3 (the Seacoast and farther north). Every job adds $34.90 in per-job fees. Specialty practices can see our pages on dental office shredding and mental health records shredding, and the full price list is on our shredding rates page.
Frequently asked questions
Does HIPAA apply to my small New Hampshire business?
It applies if you are a covered entity or a business associate. Covered entities are health plans, clearinghouses and health care providers that send health information electronically for transactions such as claims or eligibility checks. Business associates handle PHI on a covered entity’s behalf, such as billing, IT, legal, accounting or shredding vendors. If neither fits, HIPAA likely does not apply, though state law may.
Is there a size exemption for small practices?
No. The definitions in 45 CFR 160.103 do not depend on headcount or revenue. A solo provider who bills one insurer electronically is a covered entity. Under 164.306(b), the Security Rule lets you weigh your size, complexity, capabilities and costs when you choose safeguards, but a written risk analysis, policies, training and Business Associate Agreements are still expected of a one-person office.
Who needs a Business Associate Agreement?
Any vendor that creates, receives, maintains or transmits PHI for a covered entity, or provides legal, accounting, consulting or similar services involving PHI. That includes billing companies, IT and cloud vendors, and shredding companies. Business associates must also get agreements from their own subcontractors that touch the same PHI. New Hampshire Document Shredding signs a BAA on request.
How fast must we give notice after a HIPAA breach?
Without unreasonable delay and no later than 60 calendar days after discovery for affected individuals. Breaches affecting 500 or more people must be reported to HHS at the same time, and to prominent media if more than 500 residents of a state are affected. Smaller breaches go in a log reported to HHS within 60 days after the end of the calendar year.
Does New Hampshire have its own breach notice law?
Yes. RSA 359-C:20 requires businesses to notify affected people as soon as possible when computerized personal information, such as a name with a Social Security or account number, has been or is reasonably likely to be misused. Most must also notify the New Hampshire attorney general’s office, and breaches requiring notice to more than 1,000 people also go to the nationwide credit bureaus.
How long must HIPAA records be kept?
Required HIPAA documentation, such as policies, procedures, risk analyses and Business Associate Agreements, must be kept for six years from creation or the date it was last in effect, whichever is later, under 164.316 and 164.530(j). HIPAA does not set a retention period for medical charts. In New Hampshire, physicians follow the Board of Medicine’s 7-year rule from the patient’s last contact.
Do HIPAA rules cover paper records?
Yes. The Privacy Rule protects PHI in any form, and 45 CFR 164.530(c) requires appropriate administrative, technical and physical safeguards for it. The Security Rule covers only electronic PHI. So paper charts, faxes and printouts need locked storage and a disposal method that leaves them unreadable, alongside the electronic controls.
Can we watch our records being destroyed?
Yes. A witnessed session at our Tewksbury office is $1.99 per pound with a $100 minimum, plus $34.90 per job, and the certificate is signed in front of you. It suits small amounts of very sensitive paper or a practice owner closing an office. Book online or call (978) 636-0301 to set a time.
Sources
- govinfo: 45 CFR 160.103, definitions of covered entity, business associate and PHI (checked November 2026)
- govinfo: 45 CFR Part 164, Subpart C, Security Standards (checked November 2026)
- govinfo: 45 CFR Part 164, Subpart D, Notification in the Case of Breach (checked November 2026)
- govinfo: 45 CFR 164.504, including (e) business associate contracts (checked November 2026)
- govinfo: 45 CFR 164.530, administrative requirements (checked November 2026)
- New Hampshire General Court: RSA 359-C:20, notification of security breach (checked November 2026)
Put disposal on your compliance checklist
Ask for our Business Associate Agreement when you book, then bring your boxes to Tewksbury on any weekday or schedule a pickup by zone. Every job ends with a Certificate of Destruction for your HIPAA file.
Visit or call
1215 Main Street, Unit 115, Tewksbury, MA 01876. Route 38 near the I-495 interchange, about 15 minutes south of the NH line. Free parking out front.
Monday to Friday, 10 a.m. to 5 p.m. Witnessed sessions and pickups outside these hours by appointment.
Three ways to shred: walk-in drop-off at 99¢ per pound, pickup by zone, or a witnessed session at $1.99 per pound.
New Hampshire Document Shredding · 1215 Main Street, Unit 115, Tewksbury, MA 01876 · (978) 636-0301 · Monday to Friday, 10 a.m. to 5 p.m.