HIPAA for Therapists

Does HIPAA apply to therapists?

Working as a therapist does not by itself determine whether HIPAA applies. HIPAA applies to covered entities and business associates that meet the applicable definitions and requirements.

If you're new to HIPAA, start with our What Is HIPAA? guide to understand what HIPAA means, who it applies to, and what information it protects.

Common HIPAA areas therapists should review

• Patient or client health information
• Electronic health records and practice-management systems
• Email and electronic messaging
• Telehealth platforms
• Phones, laptops, tablets, and other devices
• Cloud storage and backups
• Billing and payment workflows
• Vendors and Business Associate Agreements
• Privacy and Security policies
• Workforce access and training

PHI in a therapy practice

PHI may appear in appointment records, treatment information, billing information, communications, intake forms, and other individually identifiable health information.

Understanding where PHI exists and how it moves through your practice is an important part of reviewing HIPAA requirements.

Therapists using telehealth

Telehealth introduces workflows involving platforms, devices, communications, remote access, and vendors. These areas should be included when reviewing how PHI is protected.

See our Telehealth HIPAA Compliance guide .

Therapist HIPAA compliance

For a more detailed review of policies, safeguards, vendors, documentation, and other compliance areas, see:

HIPAA Compliance for Therapists →

HIPAA training

Practices with workforce members should also review applicable HIPAA training requirements.

HIPAA Training for Therapists →

Review your HIPAA practices

Use the guided HIPAA Compliance Assessment to review key requirements, identify potential gaps, and receive recommended next steps.

Start Free HIPAA Compliance Assessment