HIPAA Compliance Guide for Therapeutic Footwear Suppliers

Therapeutic footwear suppliers may handle information about a person’s diagnosis, treatment, insurance, or shoe-fitting needs. Whether HIPAA applies depends on the supplier’s role and how it receives, uses, or shares that information—not simply on the type of product it sells.

This guide explains how to assess business associate status, limit access to protected health information (PHI), safeguard records, and respond to incidents. HIPAA requirements can vary with the supplier’s activities and agreements, so review your specific arrangements with qualified compliance or legal counsel.

Determine HIPAA Business Associate Status

A therapeutic footwear supplier is not automatically a HIPAA business associate just because it works with a health care provider or receives information about a patient. A business associate is generally an organization that performs a function or service on behalf of a HIPAA-covered entity—such as a health plan or covered health care provider—that involves PHI.

Consider what your business actually does. If a provider sends a prescription or relevant clinical details so you can furnish footwear to a patient, that exchange alone does not necessarily make your company a business associate. A provider’s disclosure to another health care provider for treatment may also fall outside the minimum necessary standard. But if you perform services for a covered entity involving PHI—such as claims processing, billing, or managing records—you may be acting as a business associate.

Your company could also be a covered health care provider in its own right if it furnishes health care and conducts certain standard electronic transactions, such as submitting claims electronically. That status is separate from being a business associate. Assess the services you provide, whose behalf you perform them on, the information involved, and the transactions your organization conducts.

If you are a business associate, HIPAA duties can apply even when PHI is stored by a vendor or is not routinely viewed by your staff. If you use subcontractors that handle PHI on your behalf, they may also have business associate obligations.

Apply the Minimum Necessary Standard

The minimum necessary standard under the HIPAA Privacy Rule calls for reasonable steps to limit PHI used, disclosed, or requested to what is needed for the intended purpose. For a footwear supplier acting as a business associate, this means setting clear limits on which information staff can access and use for each task.

For example, a fitter may need an order and relevant sizing or clinical details, while a billing employee may need the information required to submit a claim. Neither role should receive a full medical record by default. Define role-based access, use approved forms and systems, and train staff to avoid discussing or sharing patient details beyond what their work requires.

The standard has exceptions, including certain disclosures to or requests by a health care provider for treatment. It does not remove other HIPAA obligations: you must still use or disclose PHI only as permitted by law and, when applicable, your business associate agreement.

Safeguard Protected Health Information

PHI includes individually identifiable health information held or transmitted in electronic, paper, or oral form. A patient’s name linked to a diagnosis, prescription, insurance claim, or fitting record may be PHI. The HIPAA Security Rule applies to electronic PHI, while the HIPAA Privacy Rule governs permitted uses and disclosures of PHI more broadly.

Use administrative, physical, and technical safeguards suited to your operations. Practical measures include assigning unique user accounts, restricting access by job role, securing devices and paper files, training staff, maintaining secure backups, and using appropriate protections when transmitting electronic PHI. Have procedures for addressing suspected or known security incidents and documenting how they are handled.

Assess risks to electronic PHI and address vulnerabilities in the systems and workflows where it is created, received, maintained, or transmitted. Keep safeguards in place when staff work remotely, use mobile devices, or communicate with clinics, insurers, and subcontractors.

Manage Business Associate Agreements

When your company is a business associate, the covered entity generally must obtain satisfactory written assurances through a business associate agreement (BAA) before sharing PHI for the business associate’s work. A BAA should define permitted uses and disclosures, require appropriate safeguards, and address reporting of unauthorized uses, disclosures, security incidents, and breaches of unsecured PHI.

Review the agreement before accepting or handling PHI. Confirm who may access the information, which services are covered, how subcontractors are managed, and how the parties will cooperate with individual requests and compliance reviews. Do not use PHI for a purpose outside the agreement or applicable law.

If a subcontractor will handle PHI on your behalf, put a written agreement in place that requires the subcontractor to protect the information under applicable HIPAA requirements. Keep agreements and related compliance documentation organized and accessible to appropriate staff.

Respond to Breaches and Security Incidents

Have a written incident response process for suspected or known incidents, including misdirected emails, lost devices, unauthorized access, or misplaced paperwork. Train employees to report concerns promptly to a designated contact, preserve relevant records, and avoid investigating or communicating externally without following your response plan.

Contain the incident when possible, document what happened, identify the information and people potentially affected, and take steps to mitigate harm. Notify the covered entity promptly as required by your BAA and report security incidents under the agreement. A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery; the BAA may require a shorter reporting period.

An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an applicable exception applies or a risk assessment demonstrates a low probability that the PHI was compromised. The covered entity generally handles required notices to affected individuals and government agencies, though a BAA may delegate particular notification tasks. Do not assume that every security incident is a reportable breach; assess and document it under the applicable rules and agreement.

Retain and Dispose of Health Records

HIPAA generally does not set a retention period for medical records. State law, other applicable requirements, contracts, and business needs may determine how long your organization must keep particular records. HIPAA does require retention of certain compliance documentation for six years from its creation or the date it was last in effect, whichever is later; this is not a general six-year medical-record retention rule.

When PHI is no longer needed, dispose of it in a way that protects it from access by unauthorized people. Securely destroy paper records and electronic media, and address copies held by service providers. Follow the BAA’s instructions when the agreement ends: return or destroy PHI where feasible. If doing so is infeasible, continue to protect the information and limit further use or disclosure as required by the agreement and HIPAA.

In short, determine your HIPAA role based on the work you perform, limit PHI to what is needed, safeguard it throughout its lifecycle, and follow your BAA’s incident and record-handling terms. Apply relevant state and other legal requirements to retention and disposal.

FAQs

Are therapeutic footwear suppliers considered HIPAA business associates?

Not automatically. A supplier may be a business associate when it performs a service on behalf of a covered entity that involves PHI. A supplier may also be a covered health care provider in its own right if it meets HIPAA’s requirements, including conducting certain standard electronic transactions. The supplier’s actual role and activities determine which rules apply.

When does a supplier need a business associate agreement?

A supplier generally needs a BAA when it performs work for a HIPAA-covered entity that involves creating, receiving, maintaining, or transmitting PHI as part of that work. A routine exchange of information between providers for treatment does not, by itself, necessarily create a business associate relationship. Assess the purpose of the arrangement and the supplier’s role before PHI is shared.

What protected health information may a therapeutic footwear supplier access?

The supplier should access only the PHI permitted for its role and needed for the task, subject to applicable HIPAA rules and any BAA. This might include an order, relevant fitting or clinical details, or information needed for billing. Access to an entire medical record should not be the default.

What should a supplier do after a suspected HIPAA breach?

Follow your incident response plan: report the concern promptly to the designated contact, take reasonable steps to contain and mitigate it, preserve relevant evidence, and document what is known. Notify the covered entity as required by the BAA and cooperate with its assessment. The covered entity generally manages required notifications unless the agreement assigns specific notification duties to the supplier.