Who Does HIPAA Apply To? A Guide for Therapists

Who does HIPAA apply to? Two groups: covered entities and their business associates. Covered entities are health plans, health care clearinghouses, and health care providers who send health information electronically in connection with a standard transaction, such as an insurance claim. Business associates are the companies and contractors that handle protected health information for a covered entity. Since the 2013 HIPAA Omnibus Rule, they and their subcontractors are directly liable for parts of HIPAA. HHS puts the other side just as plainly: "If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules" (HHS, Covered Entities and Business Associates).

For a therapist in private practice, the question becomes: which side of that line am I on? A therapist who bills insurance electronically, or has a biller do it, is a covered entity. A therapist who sees only private-pay clients may not be. Below you'll find the legal definitions in plain words, the common therapist situations sorted, what changes the day you bill insurance, who enforces HIPAA, two state laws that reach further than HIPAA, the steps worth taking either way, and a decision checklist you can copy into your compliance file.

Who does HIPAA apply to? Covered entities and business associates

HIPAA's definitions live in one federal regulation, 45 CFR 160.103. It names three kinds of covered entity:

A health plan: insurers, HMOs, employer group health plans, Medicare, Medicaid and similar programs.
A health care clearinghouse: a company, including a billing service, that converts health information between nonstandard and standard formats, such as turning your billing data into an electronic claim.
A health care provider "who transmits any health information in electronic form in connection with a transaction covered by this subchapter."

That third line is the one that matters for therapists. You are a health care provider under HIPAA either way: the definition covers anyone "who furnishes, bills, or is paid for health care in the normal course of business," and health care includes "counseling, service, assessment, or procedure with respect to the physical or mental condition" of a person. CMS names psychologists among the providers who are covered when they submit transactions such as claims electronically (CMS, Are You a Covered Entity?). What decides whether HIPAA applies is the second half: electronic transactions.

Business associates are people and companies that create, receive, maintain or transmit protected health information on a covered entity's behalf, other than its own workforce. HHS's business associate guidance (last reviewed July 30, 2026) gives examples that map closely onto a small practice: a cloud service that stores your records, an EHR or IT vendor with access to client data, a clearinghouse that sends your claims, a transcription vendor, and a CPA firm whose work involves client information. Their own subcontractors are business associates too. Since the HITECH Act and HHS's 2013 rule, business associates are directly liable for parts of HIPAA, including the Security Rule and impermissible disclosures (HHS, Direct Liability of Business Associates).

Two exceptions save therapists paperwork. Sharing information with another provider for a client's treatment, such as a consulting psychiatrist, doesn't need a business associate agreement. Neither does a pure "conduit" that only carries information, like the Postal Service; HHS says entities that access PHI "on a regular or frequent basis" to do a service for you are not conduits.

The trigger: standard electronic transactions

HIPAA adopted national standards for a list of routine exchanges between providers and health plans. The definition of "transaction" in 160.103 lists them. The ones a therapy practice is likely to touch:

Claims (asking a health plan to pay for a session)
Eligibility checks (is this client covered, and for what)
Claim status inquiries
Referral certification and authorization (prior authorization requests)
Payment and remittance advice, and electronic funds transfers from a plan
Coordination of benefits when a client has two plans

If you, or anyone acting for you, sends any of these electronically even once, you are a covered entity. HHS's Summary of the HIPAA Privacy Rule adds two clarifications therapists ask about all the time:

"Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction."
The rule "covers a health care provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf." CMS's Covered Entity Decision Tool says the same: if a provider uses another entity, such as a clearinghouse, to conduct covered transactions electronically, "the health care provider is considered to be conducting the transaction in electronic form."

A few things that do not make you a covered entity on their own:

Email, video sessions, an EHR or a website.None of these is a standard transaction.
Paper claims.HIPAA's definition of electronic media says paper sent by fax, and voice by telephone, are not electronic transmissions "if the information being exchanged did not exist in electronic form immediately before the transmission."
Having an NPI.CMS says "All health care providers ... may obtain an NPI"; only covered providers must (CMS, NPI booklet).

One gray area: entering a claim or checking eligibility on an insurer's own website. HIPAA calls this "direct data entry" and requires the provider to use the standard's data content when doing it (45 CFR 162.923(b)), which reads as conducting the transaction. Treat portal billing as a yes, and confirm with a lawyer.

Does HIPAA apply to therapists? Common situations sorted

Here is how the rules above land on the situations therapists describe most often. Each line is general information; your contracts and state law can change the answer.

Private pay only, no insurance of any kind.Probably not a HIPAA covered entity, as long as nobody sends standard transactions for you. Card payments from clients aren't health plan transactions.
Private pay, with superbills clients submit themselves.Probably still not covered, because the client sends the claim, not you. If you or a service file the claim for the client electronically, that changes.
In network with any plan, Medicare or Medicaid, billed electronically.Covered. And HIPAA then reaches your whole practice, not only your insured clients: the Privacy Rule protects "all 'individually identifiable health information' held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral" (HHS Privacy Rule summary). Your self-pay clients' records and your paper notes are included.
Out of network, but you or your biller file claims electronically for clients.Covered.
You check eligibility online for new clients.Likely covered, because eligibility is one of the standard transactions.
You work in a group practice that bills insurance.The practice is the covered entity and you're part of its "workforce," which 160.103 defines as people whose work is "under the direct control" of the entity, paid or not. Its HIPAA policies apply to your work there. Whether a 1099 contractor is workforce or a separate provider is a question for the practice's lawyer.
You see clients through an employee assistance program or a telehealth company that bills.It depends on who bills, in whose name and under which contract. Ask before you assume either way.

Why many private-pay therapists follow HIPAA anyway

Not being a covered entity is a narrow legal status, not permission to be casual. Many private-pay therapists act as if HIPAA applies, for five practical reasons.

State law.Some states define their own "covered entity" far more broadly, or protect health and mental health records for every licensed provider. Two examples follow below.
Ethics codes.None of them asks how you're paid. The ACA Code of Ethics says "Counselors protect the confidential information of prospective and current clients" (B.1.c) and that records "kept in any medium are secure and that only authorized persons have access to them" (B.6.b) (ACA Code of Ethics, 2014; ACA says a revised code is due in fall 2026). The NASW Code asks social workers to "protect the confidentiality of all information obtained in the course of professional service" (NASW Code of Ethics, 1.07(c)). The APA Code says psychologists "take reasonable precautions to protect confidential information obtained through or stored in any medium" (APA Ethics Code, 4.01).
Payers.The day you join a panel or file a claim electronically, HIPAA applies to the client records you hold, not only to the insured client's. Practices that start out compliant don't have to rebuild their setup that week.
Clients' expectations.Clients ask "are you HIPAA compliant?" and expect the answer to be yes. If your website or paperwork says you follow HIPAA, make sure you do; a written promise is something clients and regulators can hold you to.
Vendors.Business associate agreements are written for covered entities. TranqBay's, for example, applies to therapists who are covered entities and says that if you aren't one, its data processing agreement governs how client information is handled instead.

What changes the moment you bill insurance electronically

The first electronic claim, eligibility check or prior authorization request makes you a covered entity. From that day, these are yours:

An NPI on every standard transaction. Covered providers must obtain an NPI and use it to identify themselves (45 CFR 162.410).
A Notice of Privacy Practices for every client, given no later than the first service, with a good-faith effort to get a written acknowledgment. If the first service is online, send it electronically and automatically in response to the client's first request for service, and post it on your practice website (HHS, Notice of Privacy Practices). As of February 16, 2026, notices must also cover substance use disorder records under 42 CFR Part 2, and HHS revised its model notices in February 2026. Our informed consent guide explains how the notice differs from consent.
A business associate agreement with each vendor that handles client information for you, including your biller and clearinghouse (45 CFR 164.502(e) and 164.504(e)). For email and video, our guides to Gmail and HIPAA and Google Meet and HIPAA walk through Google's BAA and settings.
A risk analysis and risk management. The Security Rule makes it required: "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information" (45 CFR 164.308(a)(1)). HHS calls the rule "flexible, scalable, and technology neutral" (Summary of the Security Rule), so a solo practice's analysis can be short, but it has to exist and be written down.
A privacy official and a security official. In a solo practice, that's you, in writing (45 CFR 164.530(a) and 164.308(a)(2)).
Written policies and training for anyone who works with you, including an assistant or biller on your staff (164.530(b)).
Client access to records within 30 days of a request (45 CFR 164.524), with only a reasonable, cost-based fee for copies.
Breach notification. Notify affected clients "without unreasonable delay and in no case later than 60 calendar days after discovery" (45 CFR 164.404). For breaches affecting fewer than 500 people, keep a log and report them to HHS within 60 days after the end of the calendar year (164.408).
Six years of documentation. Policies, notices, acknowledgments and each risk analysis are kept six years from creation or from when they were last in effect, whichever is later (164.530(j)).

HHS also published a proposed update to the Security Rule on January 6, 2025. The Federal Register still lists it as a proposed rule as of this writing, so the current rule applies.

Who enforces HIPAA

Four public bodies enforce different parts of HIPAA. For a therapy practice, the first one is the one that matters day to day.

HHS Office for Civil Rights (OCR)

"HHS' Office for Civil Rights is responsible for enforcing the Privacy and Security Rules" (HHS, HIPAA Enforcement), and it enforces the Breach Notification Rule too. OCR investigates complaints, runs compliance reviews and does education and outreach, and it refers possible criminal violations to the Department of Justice (HHS, Enforcement Process).

How it reaches a small practice: anyone can file a complaint, a client, a parent, a former employee, generally within 180 days of when they knew or should have known of the problem (45 CFR 160.306). Some complaints close with technical assistance, as the first complaint in the counselor's case below did. Others end in a resolution agreement or a civil money penalty. Penalties fall into four tiers by culpability, from "did not know" up to willful neglect left uncorrected (45 CFR 160.404; HHS, HITECH enforcement rule), and the dollar amounts are adjusted each year for inflation in 45 CFR part 102.

Small mental health practices do appear in OCR's resolution agreements. Two examples worth knowing:

A solo licensed professional counselor in Pittsburgh agreed to pay $15,000 and follow a two-year corrective action plan after failing to give a parent timely access to his minor children's records. OCR had already given the counselor technical assistance on an earlier complaint and closed it; the second complaint led to the investigation (HHS resolution agreement, 2023).
A New Jersey psychiatric practice agreed to pay $30,000 after it disclosed four patients' information in replies to their negative online reviews (HHS resolution agreement, 2023).

Neither case involved a hacker. Both came from everyday decisions: a records request and a reply to a review.

CMS

The Centers for Medicare & Medicaid Services enforces the transaction, code set, unique identifier and operating rule standards: the "administrative simplification" side of HIPAA. CMS says plainly that its "authority does not extend to the HIPAA Security Rule and the Privacy Rule" (CMS, Enforcement and Compliance).

The Department of Justice

Criminal cases go to DOJ. Knowingly obtaining or disclosing individually identifiable health information in violation of HIPAA can bring a fine of up to $50,000 and up to a year in prison; under false pretenses, up to $100,000 and five years; with intent to sell it or use it for personal gain or malicious harm, up to $250,000 and ten years (42 U.S.C. 1320d-6).

State attorneys general

The HITECH Act "gave State Attorneys General the authority to bring civil actions on behalf of state residents for violations of the HIPAA Privacy and Security Rules" (HHS, State Attorneys General). They can seek an injunction or damages of up to $100 per violation, capped at $25,000 a year for identical violations (42 U.S.C. 1320d-5(d)). Attorneys general can also enforce their own state's privacy laws; in Texas, for example, the attorney general enforces the state's medical records privacy law described below.

Two more bodies don't enforce HIPAA but matter just as much to a therapist: your licensing board, which enforces your state's confidentiality rules and the code it has adopted, and the courts, where state law may let a client sue. HIPAA itself is enforced by the agencies above.

State privacy laws that go further than HIPAA

HIPAA sets a floor. A state law about the privacy of health information that is "more stringent" than HIPAA's Privacy Rule stays in force (45 CFR 160.203(b)). Two examples show how far a state can go.

Texas: Health and Safety Code chapter 181

Texas's medical records privacy law has its own definition of "covered entity," and it isn't tied to insurance billing. It includes any person who, for professional gain or even pro bono, engages in "assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information," and anyone who "comes into possession of protected health information" (section 181.001). A private-pay therapist in Texas is likely covered by chapter 181 even when HIPAA doesn't apply. Among its requirements:

Training for employees on state and federal privacy law, completed within 90 days of hire (181.101).
Electronic records within 15 business days of a written request, when your records system can produce them (181.102), a shorter deadline than HIPAA's 30 days.
Notice to clients when their information is subject to electronic disclosure (181.154).
Penalties the attorney general can seek: up to $5,000 per violation a year for negligent violations and up to $25,000 for knowing or intentional ones, with higher amounts in some cases (181.201).

Washington: two laws, one for records and one for health data

Washington's Uniform Health Care Information Act, chapter 70.02 RCW, applies to any "health care provider," defined as a person "licensed, certified, registered, or otherwise authorized" by the state to provide health care. No billing trigger. Its starting rule is that a provider "may not disclose health care information about a patient to any other person without the patient's written authorization," with exceptions listed in the chapter (70.02.020); mental health records get added protection (70.02.230); and a patient can sue a provider who doesn't comply (70.02.170), something HIPAA itself doesn't offer.

Washington's My Health My Data Act (chapter 19.373 RCW) covers "consumer health data," which expressly includes "social, psychological, behavioral, and medical interventions." It exempts HIPAA protected health information and health care information handled under chapter 70.02, but it may still reach data your website or marketing tools collect. It requires a consumer health data privacy policy linked from your homepage, limits collecting and sharing such data to what is needed for the service the person asked for unless they consent, and treats a violation as an unfair or deceptive act under Washington's Consumer Protection Act. Whether it touches your practice is a question for a Washington lawyer.

Other states

Many states have their own medical records or mental health confidentiality statutes, such as California's Confidentiality of Medical Information Act and Illinois's Mental Health and Developmental Disabilities Confidentiality Act. Your licensing board's website usually links the statutes and rules for your license; start there, then confirm with your professional association's state chapter or a lawyer.

What every therapist should do anyway

Whether or not HIPAA applies to you today, these steps protect your clients, meet your ethics code and leave you ready for the day you bill a plan.

Get a BAA, or equivalent data protection terms, from every vendor that stores client information: records, video, forms, email, cloud storage, billing. Keep a one-page list of vendors, what each one holds and where its agreement is.
Write a Notice of Privacy Practices. HHS's model notices are a sound starting point even for a practice that isn't covered yet, and posting it on your website tells clients how you handle their information.
Do a risk analysis and write it down. HHS and ONC publish a Security Risk Assessment Tool, as a Windows app or an Excel workbook, whose "target audience ... is medium and small providers." According to that page, what you enter stays on your own computer.
Name yourself privacy and security official, write short policies you actually follow, and train anyone who helps you.
Plan for a records request and for a mistake. Know your deadline for giving a client or parent their records (30 days under HIPAA, shorter in some states), and what you'll do if client information goes to the wrong person.
Cover confidentiality and its limits in your consent paperwork, and keep the notice, consent and releases as separate documents. Our informed consent template and intake form guide show how they fit together.
Never answer an online review with client details, even to correct the record. A generic reply that confirms nothing is the safe pattern.
Check your status again every year, and before you join a panel, take an EAP referral or hire a biller.

A HIPAA decision checklist you can copy

Fill this in once a year and keep it with your policies. It is a self-check, not a legal opinion.

HIPAA covered entity checkTemplate

HIPAA COVERED ENTITY CHECKPractice name:Date checked:Checked by:

PART A: DO I SEND STANDARD TRANSACTIONS?Count it if you send it yourself, or a biller,clearinghouse or EHR sends it for you.A1. Insurance claims sent electronically (yes/no):A2. Eligibility checks sent electronically (yes/no):A3. Claim status inquiries (yes/no):A4. Prior authorization or referral requests (yes/no):A5. Payments, remittance advice or EFT from a plan (yes/no):A6. Claims or checks entered on an insurer's website (yes/no):A7. Any yes in A1 to A6? (yes/no):

PART B: THINGS THAT DO NOT DECIDE IT ON THEIR OWNB1. I have an NPI (yes/no):B2. I use email, video or an EHR (yes/no):B3. I give clients superbills they submit (yes/no):B4. I mail paper claims only (yes/no):

PART C: RESULTIf A7 is yes: I am a covered entity. HIPAA appliesto every client's information, in any form.If A7 is no: I am probably not a covered entity.State law and my ethics code still apply.

PART D: STATE AND CONTRACTSD1. My state's health records law (name):D2. My state's mental health records law (name):D3. Any contract that requires HIPAA (EAP, group,platform, insurer) (list):D4. Plans to bill insurance in the next 12 months:

PART E: IN PLACE EITHER WAY (date done)E1. Vendor list with BAAs or data terms:E2. Notice of Privacy Practices, posted on website:E3. Written risk analysis:E4. Privacy and security official named:E5. Policies and training records:E6. Records request procedure (30 days, or mystate's shorter deadline):E7. Breach response steps:E8. Next review date:

Questions for my lawyer:

How this works in TranqBay

TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions and a form library in one place. Here is where it fits in the steps above.

TranqBay signs a BAA.Video sessions are HIPAA-ready, and the agreement applies automatically when a therapist who is a covered entity accepts TranqBay's Terms of Service; there's no separate document to sign. If you're not a covered entity, the agreement says it doesn't apply and TranqBay's data processing agreement governs how your clients' information is handled. You can read TranqBay's Business Associate Agreement before you decide anything.
Booking, video and forms under one agreement.When the booking page, the session and the client's forms live in the same system, that's one vendor on your list and one agreement to keep, instead of one for each tool.
Forms that wait with the session.The form library has ready-made templates you can send a client for a session, including intake, consent to treat, telehealth consent, release of information, the PHQ-9 and the GAD-7. The client fills them in online, and the answers wait with the session. TranqBay doesn't score the measures; you do.
Still yours to do:your Notice of Privacy Practices, your risk analysis and the agreements with any other tools you use for client information, such as email.

To see what a new client sees before a first session, look at the booking page on practice.tranqbay.health. It shows each step a client goes through to book, which helps you decide when your privacy notice and consent forms should go out.

Questions to take to a lawyer

These are the points in this article that depend on facts or law we can't settle for you. Bring them to a healthcare attorney licensed in your state:

Whether I am a covered entity, given exactly how I bill, check eligibility and get paid.
Whether entering claims or eligibility checks on an insurer's website makes me a covered entity.
Whether giving clients superbills, or using a service that files claims for them, changes my status.
Whether I stop being a covered entity if I stop billing insurance, and what I must keep doing for records created while I was covered.
Whether, as a contractor in a group practice, an EAP network or a telehealth company, I am part of their workforce, a separate covered entity or neither.
Which state laws on health records, mental health records, breach notification and consumer health data apply to me, including where my clients live.
Whether anything my website or paperwork says about HIPAA creates a duty I must meet even if HIPAA doesn't apply.
Whether any of my clients' records are substance use disorder records under 42 CFR Part 2.

Frequently asked questions about who HIPAA applies to

Does HIPAA apply to therapists?

It applies to therapists who are covered entities: those who send health information electronically in connection with a standard transaction, such as an insurance claim or eligibility check, themselves or through a biller or clearinghouse. A therapist who sees only private-pay clients and never sends those transactions may not be covered, though state law and ethics codes still require confidentiality.

Do therapists have to follow HIPAA if they only take private pay?

Not necessarily under HIPAA itself. HHS says an entity that isn't a covered entity or business associate "does not have to comply with the HIPAA Rules." But a state like Texas defines covered entity broadly enough that it may include you, and many therapists follow HIPAA anyway so nothing changes when they start billing a plan.

If I see one client through insurance, does HIPAA apply to all my clients?

Yes. Once you're a covered entity, the Privacy Rule protects all individually identifiable health information you hold, in any form, including self-pay clients' records and paper notes.

Does having an NPI make me a covered entity?

No. CMS says all health care providers may obtain an NPI, and only covered providers must. What makes you covered is sending standard transactions electronically.

Who enforces HIPAA?

The HHS Office for Civil Rights enforces the Privacy, Security and Breach Notification Rules. CMS enforces the transaction and code set standards. The Department of Justice handles criminal cases, and state attorneys general can bring civil actions on behalf of state residents under the HITECH Act.

Can a client sue me for a HIPAA violation?

HIPAA itself is enforced by the agencies above, and a client can file a complaint with OCR. Some state laws do let a client sue; Washington's health care information law, for example, gives patients a civil remedy against a provider who doesn't comply. Ask a lawyer about your state.

Who would not be considered a covered entity under HIPAA?

Anyone who isn't a health plan, a clearinghouse or a provider who conducts standard transactions electronically, and who isn't a business associate. That includes a therapist who is paid only by clients directly and sends no standard transactions, and most employers acting as employers. HIPAA's definition of protected health information also leaves out education records covered by FERPA and employment records a covered entity holds as an employer (45 CFR 160.103).

Is there a HIPAA certification for therapists?

No. HIPAA doesn't require one, and HHS says it "does not endorse or otherwise recognize private organizations' 'certifications'" for the Security Rule (HHS FAQ 2003). Compliance is the set of safeguards, documents and habits described above. A vendor's part of it shows in the BAA it signs and the controls it gives you.

I work in a group practice. Whose HIPAA is it?

If the group bills insurance, it is the covered entity and you're part of its workforce for the work you do there. Its notice, policies and agreements apply. Your own private practice on the side is a separate question.

Before you decide where you stand

Fill in the checklist above, starting with Part A, and keep it with your policies. If every answer in Part A is no, you're probably outside HIPAA today, but your state's law and your ethics code are not, and the steps in Part E are worth doing anyway. If any answer is yes, HIPAA applies to your whole practice, and the nine items in "What changes the moment you bill insurance" are your list.

If you'd like booking, video sessions and client forms in one place under one agreement, see how TranqBay works for private practice: you can look at a practice website template and the booking page your clients would use. If you're deciding whether to join, this page explains how joining TranqBay works.

Sources

41 sources

Regulations 14HHS 16CMS 4Federal 1States 3Associations 3

Laws and regulations14

U.S. Department of Health and Human Services16

Centers for Medicare & Medicaid Services4

Other federal agencies1

35HealthIT.gov: Security Risk Assessment Toolhealthit.govhttps://healthit.gov/privacy-security/security-risk-assessment-tool/

State boards and laws3

Professional associations3

Updated October 25, 2026. Found it useful? Send it to a colleague.