A practical overview of major HIPAA rules and requirements that may be relevant to therapy practices.
No. A therapist's profession alone does not determine HIPAA applicability. HIPAA applies to covered entities and business associates that meet the applicable definitions and requirements.
The HIPAA Privacy Rule establishes standards concerning protected health information, including certain uses and disclosures and individual rights regarding health information.
Therapy practices subject to HIPAA should review how PHI is used, disclosed, accessed, and protected.
The HIPAA Security Rule establishes standards for protecting electronic protected health information (ePHI).
It includes administrative, physical, and technical safeguards.
Organizations subject to the Security Rule must consider risks and vulnerabilities affecting ePHI as part of their security risk analysis and risk management activities.
Learn about HIPAA Risk Assessment →
Some vendors or service providers may qualify as business associates when they perform certain functions or services involving PHI on behalf of a covered entity.
Applicable relationships should be reviewed to determine whether a Business Associate Agreement is required.
HIPAA-covered entities and business associates should understand applicable breach-notification requirements and maintain procedures for evaluating and responding to incidents involving protected information.
Providing care remotely can involve additional systems, communications, devices, and vendors that should be considered as part of a HIPAA compliance review.
Review Telehealth HIPAA Compliance →
Applicable workforce training requirements should also be included when reviewing a therapy practice's HIPAA responsibilities.
HIPAA Training for Therapists →
GetHIPAAcheck provides a guided assessment for reviewing key HIPAA requirements, potential gaps, and recommended next steps.