HIPAA Compliance Guide for Orthotics and Prosthetics Practices

Orthotics and prosthetics (O&P) practices handle sensitive information throughout evaluation, fitting, fabrication, delivery, follow-up, and billing. A practical HIPAA compliance program helps you protect patient information while supporting timely care and day-to-day operations.

HIPAA obligations depend on an organization’s role and activities. The following guide summarizes key requirements for practices that are covered entities; it is general information, not legal advice.

Which HIPAA rules apply to orthotics and prosthetics practices?

An O&P practice is a health care provider, but it is a HIPAA covered entity only if it conducts certain standard health care transactions electronically, such as qualifying electronic claims or eligibility transactions. Using email or other electronic tools alone does not determine covered-entity status. Check your practice’s billing and transaction workflows, including those conducted through a billing service. HHS guidance on covered entities explains this distinction.

If your practice is a covered entity, the main HIPAA rules include:

• HIPAA Privacy Rule: Establishes how protected health information (PHI) may be used and disclosed, and gives patients rights over their information.
• HIPAA Security Rule: Requires reasonable and appropriate administrative, physical, and technical safeguards for electronic PHI (ePHI).
• HIPAA Breach Notification Rule: Sets notification duties after a breach of unsecured PHI.

These rules apply alongside your practice’s other applicable federal and state obligations. HHS describes the roles of the Privacy Rule, Security Rule, and Breach Notification Rule.

How does HIPAA define protected health information in O&P care?

PHI is individually identifiable health information held or transmitted by a covered entity or its business associate, in any form or medium. It relates to a person’s health or condition, the care provided, or payment for that care, and identifies the person or could reasonably be used to identify them. PHI can be electronic, on paper, or spoken. HHS guidance on protected health information summarizes the definition.

In an O&P setting, PHI may include a patient’s name linked to a diagnosis, referral, prescription, insurance claim, treatment notes, appointment details, or payment record. Identifiable photographs, scans, measurements, gait or fitting notes, and correspondence can also be PHI when associated with a patient’s care. A device or image is not automatically PHI on its own; the key question is whether the information identifies the patient and relates to their health, care, or payment.

What safeguards protect patient records and devices?

Start with a documented risk analysis that identifies where ePHI is created, received, maintained, or transmitted, and assesses potential threats and vulnerabilities. Use the findings to select and review safeguards appropriate to your practice’s size, workflows, technology, and risks. The Security Rule requires this assessment and reasonable, appropriate safeguards; it does not prescribe one identical security setup for every practice. See HHS guidance on risk analysis.

Consider safeguards across three areas:

• Administrative: Assign responsibility for privacy and security, maintain written policies, train staff for their roles, and review access and incident procedures.
• Physical: Limit access to records and work areas, position screens to prevent casual viewing, secure workstations and portable devices, and control storage, movement, reuse, and disposal of media containing ePHI.
• Technical: Use user-specific access controls, appropriate authentication, audit logs, and protections against unauthorized access or alteration. Assess measures such as encryption based on the applicable requirements and your risk analysis.

These safeguards apply to systems and equipment that access or hold ePHI, including computers used for scheduling, billing, clinical records, scans, or design files. Paper prescriptions, printed fitting records, and conversations also need appropriate privacy safeguards, although the Security Rule specifically addresses ePHI. HHS summarizes the Security Rule’s safeguards and physical safeguard requirements.

Train workforce members on the practice’s privacy policies and procedures as necessary and appropriate for their duties, and document that training. HIPAA does not establish a universal annual certificate-renewal requirement. A training completion certificate is evidence that a person completed a course; it does not, by itself, establish that the organization is HIPAA compliant. Make training reflect your practice’s procedures and update it when relevant policies change. HHS training guidance explains that training should be appropriate to the organization and its workforce.

How should staff handle disclosures and patient authorizations?

HIPAA permits covered entities to use or disclose PHI for treatment, payment, and health care operations without obtaining a separate authorization in many circumstances. For example, staff may share relevant information with another provider for a patient’s treatment, or use appropriate information to bill for services. Other uses or disclosures may be permitted by law, but staff should follow the practice’s policies and verify the purpose and recipient before sharing information. See HHS’s Privacy Rule summary.

Apply the minimum necessary standard to uses, disclosures, and requests where it applies: make reasonable efforts to limit PHI to what is needed for the purpose. For example, a billing disclosure should generally include information needed for payment rather than unrelated clinical details. The standard does not apply to disclosures to, or requests by, a health care provider for treatment, among other exceptions. HHS minimum necessary guidance describes the rule and its exceptions.

When a use or disclosure is not otherwise allowed or required by HIPAA, obtain a valid written authorization before proceeding. It should identify the information, who may disclose it, who may receive it, the purpose where required, and an expiration date or event. Staff should distinguish an authorization from any optional consent process the practice uses for treatment, payment, or health care operations. HHS guidance on consent and authorization explains the difference.

What steps should practices take after a suspected breach?

Treat a suspected loss, misdirected record, unauthorized access, or inappropriate disclosure as an incident requiring prompt attention. Follow your incident-response procedures: limit further access or disclosure where possible, preserve relevant records and system logs, notify the person responsible for privacy or security, and document what happened and the actions taken.

Assess whether the incident involved an impermissible use or disclosure of PHI and whether it qualifies as a breach of unsecured PHI. HIPAA presumes an impermissible use or disclosure is a breach unless an exception applies or a documented risk assessment demonstrates a low probability that the PHI was compromised. The assessment considers the information involved, who received or used it, whether it was actually acquired or viewed, and mitigation. HHS breach guidance explains the assessment and exceptions.

If notification is required, notify affected individuals without unreasonable delay and no later than 60 days after discovery. The practice must also report to HHS; reporting deadlines vary by the number of people affected, and media notice is required in certain larger breaches. If a business associate reports an incident involving the practice’s PHI, coordinate promptly: the covered entity remains responsible for ensuring required patient notifications, even if it delegates notice delivery. Document the investigation, risk assessment, mitigation, decisions, and any notices.

How do business associate agreements apply to O&P vendors?

A vendor may be a business associate if it performs a service for your practice that involves creating, receiving, maintaining, or transmitting PHI on the practice’s behalf. Examples can include billing or practice-management services, cloud storage, an electronic health record vendor, or an IT provider whose work gives it access to ePHI. Whether a specific vendor qualifies depends on what it does and how it handles PHI, not simply on the fact that it works with a health care practice.

Before allowing a business associate to handle PHI, obtain a written business associate agreement (BAA) that describes permitted uses and disclosures, requires appropriate safeguards, and addresses reporting of security incidents and breaches. A business associate that uses subcontractors to handle PHI must also obtain appropriate agreements with those subcontractors. HHS lists examples and explains BAA requirements in its Business Associates guidance.

Not every exchange requires a BAA. For example, a provider generally does not need a BAA simply to disclose PHI to another provider for treatment, and a vendor that acts only as a qualifying transmission conduit may fall within an exception. Review each arrangement based on whether the recipient is performing a function or service for your practice involving PHI.

In summary, O&P practices should determine whether they are covered entities, identify and safeguard PHI across clinical and operational workflows, train staff on practice-specific procedures, respond promptly to suspected incidents, and use BAAs when vendors handle PHI on the practice’s behalf.

FAQs.

Are orthotics and prosthetics practices covered entities under HIPAA?

An O&P practice may be a covered entity if it is a health care provider that conducts certain standard health care transactions electronically. The fact that a practice uses email or other electronic tools alone does not make it a covered entity; review whether its transactions meet HIPAA’s standards. HHS covered-entity guidance provides details.

What patient information is protected by HIPAA in O&P practices?

HIPAA protects identifiable information related to a patient’s health, care, or payment when held or transmitted by a covered entity or its business associate. This can include prescriptions, measurements, scans, fitting notes, clinical photographs, claims, and billing records when linked to an identifiable patient.

Do O&P practices need business associate agreements with vendors?

Yes, when a vendor qualifies as a business associate by handling PHI on the practice’s behalf while providing a covered function or service. A BAA is not required for every vendor or every exchange; assess the vendor’s role and access to PHI before deciding.

What should an O&P practice do after a suspected data breach?

Follow the incident-response process, contain the exposure where possible, preserve evidence, notify the appropriate privacy or security lead, and document the investigation. Assess whether a breach of unsecured PHI occurred and, if so, follow applicable notification deadlines and requirements. Contact qualified privacy or legal counsel when needed.