HIPAA Compliance Guide for Transcranial Magnetic Stimulation Clinics

When does HIPAA apply to a TMS clinic?

HIPAA does not automatically apply to every business that offers transcranial magnetic stimulation (TMS). A TMS clinic is generally a HIPAA covered entity if it is a health care provider that electronically conducts a transaction for which HHS has adopted a standard, such as submitting insurance claims or checking benefit eligibility. A provider can conduct those transactions through a billing service or another agent and still be covered. HHS guidance on covered entities explains the test.

Even if a clinic is not a covered entity, it may have HIPAA obligations if it performs services involving protected health information (PHI) on behalf of a covered entity as a business associate. Confirm the status of each relevant organization and relationship rather than assuming that a clinic’s size, specialty, or use of electronic records settles the question. State privacy laws and other requirements may apply independently of HIPAA.

What TMS records and device data count as protected health information?

PHI is individually identifiable information related to a person’s health or condition, the care they receive, or payment for that care. It may be protected in any form—electronic, paper, or spoken—when held or transmitted by a covered entity or its business associate. The HHS explanation of protected health information describes the definition and examples.

For a TMS clinic, records that may qualify include evaluations, diagnoses, treatment plans, appointment records, progress notes, billing information, and communications about a patient’s care. Stimulation settings, session histories, equipment identifiers, and device logs can also be PHI when they are linked or reasonably linkable to an identifiable patient and relate to that patient’s treatment. A device record that is genuinely de-identified and cannot reasonably identify a patient may fall outside the PHI definition; assess how the information is stored, combined, and accessed.

When PHI is created, received, maintained, or transmitted electronically, it is electronic protected health information (ePHI) and is subject to the HIPAA Security Rule. Keep patient-linked TMS data within approved systems, limit staff access to job-related needs, and account for data stored on treatment devices, workstations, removable media, and vendor platforms.

How should clinics manage notices, patient rights, and authorizations?

Give patients a current Notice of Privacy Practices (NPP) that explains how the clinic may use and disclose PHI, the clinic’s privacy duties, patients’ rights, and how to raise a complaint. Providers with a direct treatment relationship generally must provide the notice by the first service date, make it available as required, and ask the patient to acknowledge receipt in writing. The patient’s signature is not a consent to special uses of information, and refusal to sign does not by itself prevent HIPAA-permitted care or disclosures. See HHS guidance on the Notice of Privacy Practices.

Train staff to route and respond to patient requests, including requests to access records, seek amendments, request restrictions, or receive confidential communications. Patients may also complain to the clinic or HHS. A clinic generally does not have to agree to every requested restriction, but it must follow a restriction it has agreed to and accommodate reasonable requests for confidential communications as required by the Privacy Rule.

HIPAA generally permits relevant uses and disclosures for treatment, payment, and health care operations without a separate patient authorization, subject to applicable limits. The minimum necessary standard generally requires reasonable limits on PHI used, requested, or disclosed for payment and health care operations; it does not apply to disclosures to or requests by a health care provider for treatment. Obtain a valid HIPAA authorization when a proposed use or disclosure is not otherwise permitted or required, such as many disclosures to an outside party for a purpose unrelated to treatment, payment, or health care operations. An authorization is more specific than a general consent form. HHS guidance on permitted uses and disclosures and its explanation of consent versus authorization provide further detail.

What administrative, physical, and technical safeguards protect electronic PHI?

The HIPAA Security Rule requires covered entities and business associates to use reasonable and appropriate administrative, physical, and technical safeguards to protect ePHI’s confidentiality, integrity, and availability. The rule is scalable: safeguards should reflect the clinic’s size, systems, resources, and risks, rather than relying on a one-size-fits-all checklist. See the HHS summary of the HIPAA Security Rule.

• Administrative safeguards: Assign security responsibility; maintain written policies; manage workforce access; provide security awareness training; and plan for security incidents and continuity of operations.
• Physical safeguards: Control access to rooms and equipment that contain ePHI; secure workstations and screens; and manage devices and media, including their return, disposal, and reuse.
• Technical safeguards: Use appropriate access controls and authentication; record and review system activity; protect data integrity; and assess transmission security and encryption needs.

Encryption is an important security measure to assess, but the Security Rule does not prescribe identical technology for every clinic. Document how selected safeguards address identified risks and review whether they remain reasonable and appropriate as systems and operations change.

How can clinics assess risks, reduce security threats, and train staff?

Conduct and document a thorough security risk analysis covering ePHI the clinic creates, receives, maintains, or transmits. Map where patient information lives—including electronic health records, TMS equipment and logs, email, backups, mobile devices, and vendor systems—and assess potential threats and vulnerabilities. HHS describes risk analysis as a required and ongoing part of Security Rule compliance in its guidance on HIPAA risk analysis.

Use the findings to prioritize corrective actions, assign responsibility, and track completion. Review safeguards when the clinic adds technology, changes workflows, experiences an incident, or identifies new vulnerabilities. Train workforce members on the clinic’s privacy and security procedures, including how to avoid misdirected disclosures, protect login credentials, recognize suspicious messages, and report a suspected incident promptly. Keep training and risk-management documentation current.

What should business associate agreements cover?

A vendor may be a business associate when it creates, receives, maintains, or transmits PHI to perform services for a covered clinic. Examples can include billing, practice-management, cloud-hosting, IT support, transcription, or patient-messaging services, depending on the work and access involved. Before sharing PHI with a business associate, the clinic generally needs a written business associate agreement (BAA). HHS describes the relationship and examples in its Business Associates FAQ.

The BAA should describe permitted and required uses and disclosures of PHI, limit other uses and disclosures, and require appropriate safeguards. It must also address relevant Security Rule obligations, reporting of security incidents and breaches, and the business associate’s responsibility to obtain appropriate written assurances from subcontractors that handle PHI. Check that the agreement matches the actual service and data flows; signing a BAA does not by itself make a vendor or clinic compliant.

How can clinics protect PHI during telehealth TMS care?

For telehealth consultations, follow-up visits, or remote review of treatment information, include the platform, devices, communications, and any stored recordings or transcripts in the clinic’s privacy and security risk analysis. Use an appropriate platform and secure connection, restrict access to authorized users, and verify the patient’s identity and the identities of others who join the visit. If a vendor handles PHI on the clinic’s behalf, determine whether a BAA is required.

Conduct visits in a private space where staff cannot be overheard, avoid recording unless necessary, and secure any recording or transcript that is created. Tell patients how to join privately and protect their own devices, and use secure channels for follow-up messages. These are practical measures reflected in HHS telehealth privacy and security guidance; assess them against the clinic’s own risks and workflows.

In summary: Determine whether HIPAA applies to the clinic and its vendors, treat identifiable treatment and device information as PHI, honor patient rights, and protect ePHI through documented risk-based safeguards, staff training, suitable BAAs, and secure telehealth workflows.

FAQs

Does HIPAA apply to every transcranial magnetic stimulation clinic?

No. A TMS clinic is generally a covered entity if it is a health care provider that conducts certain standard transactions electronically, such as electronic claims or eligibility inquiries. A clinic may also have HIPAA duties as a business associate when it handles PHI for a covered entity. Other privacy laws may apply even when HIPAA does not. See HHS guidance on covered entities.

Do TMS stimulation parameters and device logs count as PHI?

They can. If settings or logs are linked or reasonably linkable to an identifiable patient and relate to that patient’s care, they may be PHI; when stored or transmitted electronically, they may be ePHI. Device data that is not identifiable and cannot reasonably be linked to a patient may be treated differently.

When does a TMS clinic need a patient authorization?

Generally, when a use or disclosure is not otherwise permitted or required by HIPAA. A separate authorization is usually not needed for permitted treatment, payment, and health care operations activities, though special rules and exceptions may apply. The authorization must meet HIPAA’s content requirements; a general consent form is not necessarily enough. See HHS guidance on consent and authorization.

What safeguards are needed for telehealth TMS sessions?

Assess the telehealth workflow’s risks, select appropriate safeguards, use secure systems and connections, verify authorized participants, and conduct visits in private spaces. Protect any session recordings or transcripts and use secure follow-up communications. If a vendor handles PHI on the clinic’s behalf, determine whether a BAA is needed. See HHS guidance on telehealth privacy and security.