HIPAA Compliance for Chiropractors: How to Share X-Rays with Referring Physicians Legally

HIPAA Privacy Rule and Treatment Purposes

Under the HIPAA Privacy Rule, X-rays and their associated metadata are Protected Health Information (PHI). You may disclose PHI to another health care provider for treatment without obtaining the patient’s written authorization. This “treatment purpose disclosure” includes consultations, referrals, care coordination, and obtaining a specialist’s interpretation.

The Minimum Necessary standard does not apply to disclosures for treatment. Even so, sending only the clinically relevant views, limiting accompanying notes to what the receiving provider needs, and confirming the recipient’s identity are prudent PHI safeguards that reduce risk while keeping care efficient.

What counts as a treatment disclosure

• Forwarding spine films to a referring primary care physician for ongoing management.
• Sending extremity X-rays to an orthopedic specialist for consultation.
• Providing prior imaging to a radiologist to compare findings and refine the read.

Documentation to support the disclosure

For clarity, record the clinical reason, the recipient’s role in treatment, the date and method of transmission, and what was shared. This creates a straightforward compliance trail aligned with treatment purposes.

Chiropractors as Covered Entities

Chiropractors are health care providers. If you transmit health information electronically in standard transactions (for example, claims, eligibility inquiries, or remittance advice), you are a covered entity under HIPAA. As such, your office must implement policies and technical controls for Electronic Data Transmission, maintain a Notice of Privacy Practices, and train your workforce on privacy and security obligations.

Operational implications

• Assign a privacy/security lead to oversee PHI safeguards and incident response.
• Standardize secure workflows for sending and receiving imaging and reports.
• Use platforms and vendors that support HIPAA-compliant transmission and access controls.

State Laws and Scope of Practice

HIPAA sets a national privacy baseline. State laws and Scope of Practice Regulations determine whether—and under what conditions—you may order, acquire, or interpret imaging. Most states allow chiropractors to obtain and share imaging related to neuromusculoskeletal care, while some restrict modality choice or require specific referral pathways.

When state privacy rules are more protective than HIPAA, you must follow the stricter rule. If you refer across state lines, verify scope and sharing rules for both your state and the recipient’s to ensure the disclosure supports lawful practice and patient care.

Practical steps

• Confirm that the imaging relates to conditions within your licensed scope.
• Note any state-specific consent or documentation requirements in the chart.
• Align your imaging protocols with payer and state expectations to avoid disputes about medical necessity.

Reasonable Safeguards for Sharing PHI

HIPAA expects “reasonable safeguards” to protect PHI during disclosure. For X-rays, that means verifying recipients, securing channels, and preventing unauthorized access before, during, and after transmission.

Administrative safeguards

• Written procedures for sending images, including recipient verification and callback confirmation.
• Role-based access so only authorized staff handle image release and transfer.
• Staff training on de-identification, misdirected-message handling, and breach reporting.

Technical safeguards

• Use encrypted transmission (for example, secure portals, SFTP, or encrypted email) and unique, strong credentials.
• Store images in secure PACS or EHR modules with audit logs enabled.
• When feasible, password-protect exported media and share the password via a separate channel.

Physical safeguards

• Keep image CDs or printed films in locked areas and use sealed, labeled packaging.
• Confirm fax numbers and use cover sheets; avoid public fax machines.
• Shred unneeded prints and sleeves according to your retention schedule.

Pre-sharing checklist

• Confirm treatment relationship and purpose.
• Verify recipient identity and destination details.
• Send only necessary views and pertinent notes.
• Use secure Electronic Data Transmission; confirm successful delivery.
• Record what was shared, why, how, and to whom.

Business Associate Agreements

A Business Associate Agreement (BAA) is required with vendors that create, receive, maintain, or transmit PHI on your behalf. Common examples include cloud PACS providers, image-sharing platforms, data backup services, IT support with server access, and email encryption vendors. The BAA contractually requires appropriate safeguards, breach notification, and subcontractor oversight.

When a BAA is not required

• Disclosures to another health care provider for treatment purposes do not require a BAA.
• Uses of true “conduits” (such as postal mail or common carriers) generally do not create a business associate relationship.

When in doubt, treat service providers who store or can access PHI as business associates and obtain a signed BAA before sharing.

Documentation and Medical Necessity

Strong Medical Necessity Documentation supports both clinical decision-making and compliant sharing. In your chart, capture the clinical indications, exam findings, area imaged, and how X-rays will influence diagnosis or care plans. Include the recipient provider’s name and role in treatment.

Efficient documentation elements

• Reason for imaging tied to history, exam, or red flags.
• Imaging details (views, laterality, acquisition date).
• Treatment purpose disclosure statement identifying the recipient.
• Transmission method and confirmation of receipt.

While many practices track disclosures internally, note that routine treatment disclosures are generally not subject to HIPAA’s accounting-of-disclosures requirement. Internal logging still helps demonstrate compliance and streamline audits.

Patient Rights to Access X-Rays

Patients have the right to access and receive copies of their X-rays and related PHI in a readily producible format. If they request digital files (for example, DICOM), provide them when feasible, or agree on an alternative format such as a secure download, encrypted email, or portable media.

You may charge a reasonable, cost-based fee for copies, but you cannot withhold access due to unpaid bills. Verify identity, honor a patient’s request to direct a copy to a third party, and respond within HIPAA’s required timeframe. Do not force portal-only access; offer practical options that meet the patient’s needs.

FAQs

Can chiropractors share patient X-rays with referring physicians without patient consent?

Yes. HIPAA permits treatment purpose disclosure to other providers without written patient authorization. Share only what’s clinically relevant, verify the recipient, and use secure transmission. Document the reason for sharing and how the images were sent as part of your compliance record.

What reasonable safeguards must chiropractors implement when sharing X-rays?

Implement administrative, technical, and physical PHI safeguards. In practice, verify the recipient, use encrypted channels or secure portals, protect exported media with passwords, enable audit logs, limit access to authorized staff, and maintain procedures for misdirected or failed transmissions.

Are chiropractors required to have Business Associate Agreements for handling PHI?

Obtain a Business Associate Agreement with any vendor that stores, transmits, or can access PHI on your behalf—such as cloud PACS, backup, image-sharing, or IT support providers. You do not need a BAA to send X-rays directly to another provider for treatment.

How do state laws affect chiropractors’ ability to order and share imaging studies?

Scope of Practice Regulations and privacy rules vary by state. Ensure the imaging relates to conditions within your licensed scope and follow any state-specific documentation or consent requirements. When laws differ, apply the stricter rule and verify requirements for cross-state referrals before sharing.