HIPAA Compliance Guide for Scoliosis Bracing Clinics

Scoliosis brace measurements, fitting notes, images, and monitoring records can be protected health information (PHI) when they identify a patient and relate to their health or care. HIPAA compliance means protecting that information while still allowing appropriate care coordination. HHS’s summary of the HIPAA Privacy Rule explains what PHI includes and when the rules apply.

What HIPAA requires of scoliosis bracing clinics

A scoliosis bracing clinic is generally a HIPAA covered entity if it is a health care provider that conducts certain standard electronic transactions, such as electronic claims or eligibility inquiries. This applies whether the clinic sends the transactions itself or uses a billing service. Using email alone does not make a provider a covered entity. A clinic that is not a covered entity may still have HIPAA duties if it acts as a business associate for another covered entity. HHS’s covered-entity guidance describes the criteria.

The HIPAA Privacy Rule governs how covered entities use and disclose PHI in any form, including paper, electronic, and spoken information. The HIPAA Security Rule sets safeguards for electronic PHI (ePHI), while the breach notification rule addresses certain breaches of unsecured PHI. Clinics should establish written privacy and security policies, assign staff responsibilities, and review how patient information moves through appointments, measurements, fabrication, billing, follow-up, and monitoring.

HIPAA requires reasonable safeguards suited to the clinic’s circumstances—not a single checklist or one specific technology for every practice. A documented risk analysis helps identify where ePHI is stored, who can access it, and what measures are appropriate. HHS’s Security Rule risk-analysis guidance explains this process.

How to protect patient records and scoliosis brace measurements

Protect paper records and measurement sheets by keeping them out of public view, restricting access to authorized staff, and storing them in secure locations when not in use. Avoid discussing identifiable patient details where others can overhear. When records are no longer needed, use a secure disposal process rather than leaving them accessible to the public. The Privacy Rule calls for reasonable safeguards for PHI in all forms. HHS’s Privacy Rule safeguards guidance provides examples.

For electronic records, use individual user accounts, grant access according to job duties, and remove access when staff roles change or employment ends. Protect devices and accounts with appropriate authentication, keep software and systems maintained, and review available access records. Apply safeguards to ePHI across the clinic’s systems, including photos, scans, measurement files, patient portals, and backups.

The minimum necessary standard generally calls for reasonable limits on PHI used, requested, or disclosed for a particular purpose. For example, a staff member handling scheduling may not need the same record access as a clinician fitting a brace. However, the standard does not apply to disclosures to or requests by a health care provider for treatment purposes. HHS’s minimum necessary guidance explains the rule and its exceptions.

Encryption is an important safeguard to evaluate, especially for portable devices and data sent over networks. Under the Security Rule, encryption is an addressable specification: the clinic must assess whether it is reasonable and appropriate, and document its decision and any alternative safeguard when applicable. HHS’s encryption guidance explains this distinction.

When patient authorization is required to share health information

A clinic may generally use or disclose PHI for treatment, payment, and health care operations without a separate HIPAA authorization, subject to applicable requirements. Sharing relevant brace measurements or fitting information with a patient’s treating orthotist for treatment can therefore be permitted without a signed authorization. Use reasonable safeguards when sending the information, and verify the recipient’s identity and authority if they are not known to the clinic.

When a covered entity discloses PHI to another health care provider for treatment, the minimum necessary standard does not apply. That exception does not eliminate the clinic’s general duty to protect PHI from inappropriate use or disclosure. HHS guidance on treatment disclosures confirms that providers may share information for treatment using reasonable safeguards.

A written authorization is generally needed for uses or disclosures that HIPAA does not otherwise permit or require, such as certain disclosures to third parties for purposes unrelated to treatment, payment, or health care operations. An authorization must meet HIPAA’s requirements; a general notice to patients is not a substitute. Other applicable laws or clinic policies may impose additional limits. HHS’s explanation of consent and authorization describes the difference.

How business associate agreements apply to orthotists and vendors

A business associate agreement (BAA) is generally required when a non-workforce service provider handles PHI on behalf of a covered entity to perform a function or service involving that information. Examples can include an electronic health record vendor, a cloud storage provider, an IT contractor with access to ePHI, or a vendor that hosts a patient-monitoring application. A BAA should define permitted uses and disclosures, require safeguards, and set out incident-reporting responsibilities. HHS’s business associate guidance explains the relationship and contract requirements.

A clinic generally does not need a BAA simply to disclose a patient’s PHI to an independent health care provider for that patient’s treatment. Thus, if an orthotist is treating the patient and receives measurements for care coordination, the disclosure alone does not make the orthotist the clinic’s business associate. The relationship may be different if the orthotist or another organization performs a service on the clinic’s behalf that involves handling PHI. Determine the role based on the actual work and relationship, not just the organization’s title.

Review vendor services before giving access to patient information. Confirm whether the vendor creates, receives, maintains, or transmits PHI for the clinic, put a BAA in place when required, and check that any subcontractors handling PHI are appropriately covered. A vendor’s claim of being “HIPAA compliant” does not replace the clinic’s own assessment or its responsibility to protect PHI.

How to train staff and respond to a data breach

Covered entities must train workforce members on privacy policies and procedures as necessary and appropriate for their roles. The Security Rule also calls for a security-awareness and training program for the workforce. Tailor training to clinic tasks such as measuring patients, photographing brace fit, handling paper records, messaging orthotists, and using monitoring systems. Document training and update it when policies, roles, or relevant technology change. HIPAA does not impose a universal annual certificate-renewal requirement; training should follow the clinic’s obligations and employer-specific policies.

After a suspected incident, staff should report it promptly through the clinic’s established process. The clinic should contain the issue where possible, preserve relevant records or logs, and involve the person responsible for privacy or security. Assess the facts to determine whether unsecured PHI was involved and whether the event is a reportable breach. HHS explains that an impermissible use or disclosure is generally presumed to be a breach unless an exception applies or a documented risk assessment shows a low probability that the PHI was compromised. HHS’s breach notification guidance describes that assessment.

If notification is required, the clinic must notify affected individuals without unreasonable delay and no later than 60 days after discovering the breach. Breaches affecting 500 or more individuals must also be reported to HHS within that period; breaches involving fewer than 500 individuals may be reported to HHS annually, within 60 days after the end of the calendar year. Media notice may also be required when more than 500 residents of a state or jurisdiction are affected. If a business associate discovers a breach, it must notify the covered entity without unreasonable delay and no later than 60 days after discovery. HHS’s notification requirements provide the applicable details.

HIPAA safeguards for telehealth and digital brace monitoring

Remote fitting follow-ups and digital brace monitoring can involve ePHI, including identifiable measurements, images, messages, or sensor data. Include the tools used for telehealth and remote monitoring in the clinic’s risk analysis. Check how each system verifies users, controls access, transmits and stores data, and handles recordings or collected images. HHS’s telehealth privacy and security guidance recommends assessing policies, technology, and training.

Use private settings for telehealth when feasible, confirm the identity of the patient and other authorized participants, and use secure communication methods appropriate to the information being shared. Avoid recording sessions unless needed; establish how recordings or brace images will be collected, stored, accessed, and retained. If a platform or monitoring vendor handles PHI on the clinic’s behalf, determine whether a BAA is required before using it.

In short, a bracing clinic should determine whether HIPAA applies, protect identifiable measurements and records with safeguards suited to its risks, share information appropriately for treatment, and prepare staff and vendors to respond to incidents. Regularly review these practices as the clinic’s workflows and technology change.

FAQs.

Are scoliosis bracing clinics covered entities under HIPAA?

They are generally covered entities if they are health care providers that conduct certain standard electronic transactions, such as electronic claims, directly or through a billing service. A clinic’s use of email alone does not determine covered-entity status. HHS’s covered-entity guidance explains the criteria.

Can a clinic share brace measurements with a patient's orthotist?

Generally, yes, if the orthotist is a health care provider and the clinic shares the measurements for the patient’s treatment. HIPAA permits provider-to-provider treatment disclosures without patient authorization, provided the clinic uses reasonable safeguards. HHS’s guidance on treatment disclosures covers this.

Do scoliosis bracing clinics need a business associate agreement with software vendors?

A clinic generally needs a BAA when a vendor handles PHI on the clinic’s behalf as part of a service, such as hosting or maintaining systems that store ePHI. Whether a particular vendor requires a BAA depends on its role and access to PHI. HHS’s business associate guidance provides examples and exceptions.

What should a clinic do after a suspected HIPAA breach?

Report the incident promptly through the clinic’s response process, contain it when possible, preserve relevant evidence, and assess whether unsecured PHI was involved and whether notification is required. If it is a breach of unsecured PHI, follow the HIPAA notification requirements and deadlines. HHS’s Breach Notification Rule guidance explains the assessment and reporting duties.