HIPAA Compliance Guide for Pediatric Occupational Therapy and Sensory Clinics

Pediatric occupational therapy and sensory clinics handle sensitive information about children, families, diagnoses, treatment plans, and progress. If your clinic is subject to HIPAA, you need safeguards for that information, clear procedures for staff and vendors, and a plan for handling requests from parents and incidents involving protected health information (PHI).

This guide explains key HIPAA duties for clinics. Your obligations can also depend on state law, your clinic’s structure, and the services you provide, so use current legal and compliance advice for decisions specific to your practice.

Determine whether your pediatric therapy clinic is subject to HIPAA

A clinic’s covered entity status depends on what it does—not simply on its name, size, or whether it uses electronic records. HIPAA covers health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a transaction for which HHS has adopted a standard. Examples of standard transactions include certain claims and payment transactions. HHS guidance on covered entities explains the criteria.

For example, an occupational therapy clinic that electronically submits standard claims itself may be a covered entity. A clinic that uses a billing company or clearinghouse should assess how the transactions are conducted; using email or an electronic health record alone does not automatically make a provider a covered entity.

A clinic that is not a covered entity may still have HIPAA obligations if it performs services involving PHI on behalf of a covered entity as a business associate. In either case, document your analysis and revisit it if your billing, ownership, or service arrangements change. HHS’s covered entity overview describes the provider criteria and links to the applicable definitions.

Limit workforce access and apply the minimum necessary standard

Give each workforce member access appropriate to their job responsibilities. For example, treating therapists may need clinical information for treatment, while scheduling staff may need appointment and contact details without needing broad access to clinical notes. Use role-based access controls where feasible, unique user accounts, and a process to update or remove access when someone changes roles or leaves.

The HIPAA minimum necessary standard generally requires covered entities to make reasonable efforts to limit PHI uses, disclosures, and requests to what is needed for the intended purpose. It does not apply to certain situations, including disclosures to or requests by a health care provider for treatment. Even when the standard does not apply, carefully scoped access and sound confidentiality practices can help protect children’s records. HHS’s minimum necessary guidance explains the standard and its exceptions.

Set access rules in written policies, train staff on how those rules apply to the clinic’s workflows, and periodically review permissions. Avoid shared logins where individual accounts are practical, so the clinic can identify who accessed or changed a record.

Assess risks and safeguard electronic protected health information

The HIPAA Security Rule requires covered entities and business associates to protect electronic protected health information (ePHI) with administrative, physical, and technical safeguards. A required electronic protected health information risk assessment should identify where ePHI is created, received, maintained, and transmitted; consider relevant threats and vulnerabilities; and assess the likelihood and impact of risks to confidentiality, integrity, and availability. HHS guidance on risk analysis describes this requirement.

Use the assessment to decide and document reasonable risk-management measures for your clinic. Depending on your systems and workflows, safeguards may include staff training, secure devices and record storage, access controls, audit logging, backups, secure transmission, and procedures for responding to security incidents. HIPAA requires appropriate safeguards, but the specific measures should reflect your circumstances and documented risk assessment. HHS’s Security Rule summary describes the administrative, physical, and technical safeguards.

Review your assessment when technology, vendors, staffing, or clinic operations change. Keep the required documentation and update policies and safeguards when your review identifies a material risk or a change in how ePHI is handled.

Create business associate agreements with vendors

A vendor is generally a business associate when it performs services for your covered clinic that involve creating, receiving, maintaining, or transmitting PHI on the clinic’s behalf. Examples can include billing services, electronic health record or cloud-storage providers, and technology vendors whose support involves access to ePHI. A vendor that does not handle PHI on the clinic’s behalf does not become a business associate merely because it sells products or services to a therapy clinic. HHS’s business associate guidance explains the definition and examples.

When a business associate relationship exists, the covered clinic generally needs a written business associate agreement before permitting the vendor to handle PHI. The agreement should set out permitted uses and disclosures, require appropriate safeguards, address incident and breach reporting, and cover other required terms. Business associates must also ensure that relevant subcontractors agree to required protections. HHS’s business associate contract guidance describes required provisions.

Make a vendor inventory and record whether each vendor receives, maintains, transmits, or can access PHI. Do not assume a vendor’s marketing statements or security assurances replace a written agreement when HIPAA requires one. Review vendor access and contract terms when services change or end.

Handle parent access to minors’ health records

A parent is generally a minor child’s personal representative when the parent has authority under applicable law to make health care decisions for the child. In that role, the parent generally may exercise the child’s HIPAA rights, including requesting access to records. The precise outcome can depend on state or other applicable law and on the particular service and record at issue. HHS’s personal representative guidance summarizes the general rule.

HIPAA recognizes exceptions. For example, a parent may not be the child’s personal representative for a particular service when state law allows the minor to consent to that service and the minor does so, when someone else is authorized to consent, or when the parent has agreed to a confidential relationship. A provider may also decline to treat a parent as the personal representative in specified circumstances involving abuse, neglect, or danger to the child. HHS’s Privacy Rule guidance on parents and minors describes these exceptions.

Before releasing records, confirm the requester’s authority, check applicable custody documents and state law, and determine whether an exception applies to the specific information requested. Do not assume that an exception affecting one service automatically removes a parent’s access to unrelated records. Document the decision and involve qualified privacy or legal counsel when the situation is unclear.

Distinguish psychotherapy notes from other medical records

Most occupational therapy documentation—such as evaluations, functional assessments, treatment plans, progress notes, and clinical test results—is part of the medical record, not psychotherapy notes. HIPAA defines psychotherapy notes narrowly: they are notes by a mental health professional documenting or analyzing the contents of a private counseling session and kept separate from the rest of the medical record. HHS guidance on mental health information explains what the definition includes and excludes.

Psychotherapy notes receive special protections, and a covered entity generally needs the individual’s authorization to use or disclose them, subject to limited exceptions. They are also excluded from the general HIPAA right of access. Ordinary clinical notes and treatment records do not become psychotherapy notes simply because they concern mental or behavioral health. HHS’s access-rights guidance distinguishes psychotherapy notes from records that are generally accessible.

If your clinic maintains psychotherapy notes, keep them separate from the ordinary medical record and restrict access appropriately. When responding to a records request, distinguish qualifying psychotherapy notes from clinical documentation that belongs in the designated record set.

Respond to and report breaches of unsecured protected health information

When an impermissible use or disclosure of PHI occurs, it is generally presumed to be a breach unless the clinic or business associate demonstrates a low probability that the PHI was compromised, or an exception applies. A risk assessment considers the type and extent of PHI, who received or used it, whether it was actually acquired or viewed, and how the risk was mitigated. HHS’s Breach Notification Rule guidance explains the presumption and assessment factors.

Use a written incident-response process: contain the incident, preserve relevant evidence, determine what information and individuals were affected, assess whether the information was unsecured, and document the decision about notification. Require staff and vendors to report suspected incidents promptly so the clinic can investigate and meet any applicable deadlines.

For a reportable breach of unsecured PHI, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. A breach affecting 500 or more individuals also requires notice to HHS without unreasonable delay and within that 60-day period; breaches affecting fewer than 500 individuals must be reported to HHS within 60 days after the end of the calendar year in which they were discovered. Media notice is also required in certain cases involving more than 500 residents of a state or jurisdiction. A business associate must notify the covered entity, with the contract often setting a shorter reporting deadline. HHS’s breach notification guidance provides the notification rules.

In summary, determine whether HIPAA applies to your clinic, limit and safeguard access to PHI, assess ePHI risks, formalize relationships with business associates, carefully evaluate parental access requests, and maintain a documented breach-response process.

FAQs

Does HIPAA apply to every pediatric occupational therapy clinic?

No. A health care provider is generally a HIPAA covered entity only if it transmits health information electronically in connection with a transaction for which HHS has adopted a standard. A clinic’s use of electronic records or email alone does not settle the question. A clinic may also have obligations as a business associate when it handles PHI on behalf of a covered entity. HHS’s covered entity guidance explains the criteria.

When can a parent access a minor’s therapy records?

Generally, when the parent is the child’s personal representative under applicable law. State-law rules and HIPAA exceptions can limit access for particular services or circumstances, so clinics should verify authority and review the specific request before releasing records. HHS’s personal representative guidance and HHS’s guidance on parents and minors explain the general rule and exceptions.

Do sensory clinic vendors need business associate agreements?

Some do. A vendor generally needs a business associate agreement if it handles PHI on behalf of a covered clinic—for example, an EHR or cloud-storage provider that maintains ePHI, or a billing service that uses patient information. A vendor that does not handle PHI on the clinic’s behalf does not require an agreement solely because it supplies products or services. HHS’s business associate guidance provides examples.

How quickly must a clinic notify patients after a breach?

For a reportable breach of unsecured PHI, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The clinic should investigate and act promptly rather than treating 60 days as a routine waiting period. HHS’s Breach Notification Rule guidance explains the deadline and related reporting obligations.