How does HIPAA apply to Early Intervention agencies?

An Early Intervention agency handles protected health information in every session note, service log, document, and state-system exchange. HIPAA is the floor; New York retention and the state system add more.

Early Intervention records are health records. Session notes, service logs, evaluations, plans, authorizations, and uploaded documents routinely contain protected health information. The agency is a covered entity or a business associate for that work. Minimum necessary access, audit history, and a defined retention period are not optional product flavor.

Email is a common leak. A mail provider without a business associate agreement must not receive names, dates of birth, or clinical detail. Opaque references and generic notice text are the safe shape. The same rule applies to screenshots: only synthetic development data may be published.

HIPAA is not the only law on these records. New York keeps Early Intervention records for years after the child leaves, and the state system is the official record for authorizations and claims. A local working record can be fuller than the official one; it cannot quietly replace it. Corrections keep provenance. They do not rewrite history.