Does HIPAA apply to my practice?

Question

Accepted Answer

HIPAA applies to covered entities and their business associates. For a practice, the usual test is whether you are a health care provider who sends health information electronically in connection with standard transactions, which mostly means billing insurance. A cash-only coach, trainer or wellness practitioner who never bills insurance is often not covered. A provider who bills even one insurer electronically is covered for all their patients. Who is covered Health plans. Health care clearinghouses. Health care providers who conduct standard electronic transactions, such as claims and eligibility checks. Business associates: vendors that handle protected health information for any of the above. If you are covered You need privacy and security policies, a notice of privacy practices for patients, business associate agreements with vendors that touch patient data, and a plan for breaches. Patients have rights to see and copy their records. If you are not You are not free of privacy rules. Several states protect health information directly, among them California's Confidentiality of Medical Information Act and Washington's My Health My Data Act, which reaches consumer health data held by businesses HIPAA does not cover. The FTC also enforces against health apps and businesses that misuse health data or break their own privacy promises. Treat client health information as if HIPAA applied: collect what you need, store it securely, and say what you do with it. What to do Check whether you bill insurance electronically, directly or through a billing service. If you do, put HIPAA policies and business associate agreements in place. If you do not, check your state's health privacy laws and publish an accurate privacy policy. Collect only the health information you actually use.

Does HIPAA apply to my practice?

Who is covered

If you are covered

If you are not

What to do

Related questions