Medical and dental practices are considered “covered entities” under HIPAA and therefore have a duty to protect and secure their patient’s protected health information (“PHI”). A key component of this duty is to protect and secure PHI from potential access by a landlord. Leases for medical or dental practice spaces should include provisions that prohibit or restrict a landlord’s right to access the leased space or areas of the leased space where PHI is generated or stored. Leases should also prohibit a landlord from seizing any records containing PHI or equipment used to store PHI. Further, leases should include language that allows the medical or dental practice tenant to terminate the lease if the landlord does access seize or access PHI. In general, whether a lease contains such provisions or not a medical or dental practice should take steps to secure PHI from any potential unauthorized access from anyone who may enter the leased space, including but not limited to a landlord, janitorial service, repair technician, IT support, etc. Medical and dental professionals often enter into “form” lease agreements without carefully scrutinizing the boilerplate provisions of the lease regarding the landlord’s rights. Due to the large expense of leasing, long-term commitment, and potential liability involved, you should have an attorney experienced in medical or dental office leases review the terms of the lease agreement before you execute it.
If you have questions about your duties or rights, please contact TLG Attorney Chad Hanke to discuss.