A practical guide to reviewing HIPAA responsibilities in physical therapy practices, including patient records, communication, devices, telehealth, vendors, and documentation.
Working as a physical therapist does not, by itself, determine whether HIPAA applies.
HIPAA applies to covered entities and business associates that meet the applicable definitions and requirements.
Many physical therapy practices may be HIPAA-covered healthcare providers, depending on how they operate and conduct applicable healthcare transactions.
Physical therapy practices may handle protected health information ("PHI") in many forms.
Examples may include:
Physical therapy practices should review who can access patient information and whether access is appropriate for each person's role.
Areas to review may include:
Physical therapists may access patient information from desktop computers, laptops, tablets, smartphones, or other systems.
Practices should evaluate appropriate safeguards for devices that create, receive, maintain, or transmit electronic PHI.
Review areas may include:
Physical therapy practices often communicate with patients, referral sources, healthcare organizations, and staff electronically.
Review whether your communication methods use appropriate safeguards based on the information being transmitted and your organization's circumstances.
Remote physical therapy services do not create a separate HIPAA framework.
When HIPAA applies, practices should consider the same Privacy and Security Rule obligations within their telehealth workflows.
Review areas may include:
For a broader remote-care review, see the Telehealth HIPAA Compliance Guide .
Physical therapy practices may rely on vendors for scheduling, billing, cloud storage, communications, telehealth, IT support, and other services.
When a vendor qualifies as a business associate and creates, receives, maintains, or transmits PHI on behalf of a covered entity, applicable HIPAA business-associate requirements should be reviewed.
A patient authorization and a Business Associate Agreement are not interchangeable documents.
Organizations subject to the HIPAA Security Rule should evaluate potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI.
For a more detailed explanation, review our HIPAA Risk Assessment Guide .
HIPAA training should be appropriate to workforce roles, organizational policies, and applicable requirements.
Practices should also consider additional training when policies, systems, responsibilities, or workflows materially change.
Policies and safeguards are more useful when the organization can demonstrate what it has implemented and how it reviews its practices.
Depending on the practice, documentation may include:
HIPAA compliance involves more than one form, policy, or software setting.
A structured assessment can help you review important Privacy and Security areas, identify potential gaps, and prioritize next steps.
You can also use our HIPAA Compliance Checklist for a broader review.
Privacy reminder: Do not enter patient names, medical information, or other PHI into the assessment.
GetHIPAAcheck is an independent compliance-support tool. It is not affiliated with or endorsed by HHS or OCR. This content is educational and does not provide legal advice or certify HIPAA compliance.