HIPAA Compliance Requirements for a Pelvic Floor Physical Therapy Practice

When is a pelvic floor physical therapy practice a HIPAA covered entity?

A pelvic floor physical therapy practice is a HIPAA covered entity if it is a health care provider that conducts certain standard transactions electronically, such as submitting health care claims or checking eligibility electronically. The rule applies whether the practice sends the transactions itself or uses a billing service or clearinghouse to send them on its behalf. Using email or other electronic technology alone does not make a provider a covered entity; the electronic communication must relate to a transaction for which HHS has adopted a standard. See the HHS overview of covered entities.

Once covered, the practice must protect protected health information (PHI) in all forms—not only electronic records. That includes information in treatment notes, intake forms, appointment communications, billing records, and conversations that identify a patient or relate to their health care. The clinical information may be especially sensitive to patients, but HIPAA’s basic protections apply because it is identifiable health information, not because of the particular specialty.

What privacy policies and patient rights must the practice support?

The practice should maintain written policies for permitted uses and disclosures of PHI, patient requests, complaints, and safeguards against improper access or disclosure. The Privacy Rule generally permits use or disclosure for treatment, payment, and health care operations, subject to its requirements. For many other purposes, the practice needs the patient’s authorization or another permission under the Rule. The practice should also limit many uses, disclosures, and requests to the minimum necessary for the purpose; this standard generally does not apply to disclosures to or requests by a health care provider for treatment. See HHS guidance on treatment, payment, and health care operations and the minimum necessary standard.

Give patients a Notice of Privacy Practices that explains how the practice may use and disclose their PHI and describes their rights. Patients generally have rights to access and request amendments to information in their designated record set, request an accounting of certain disclosures, request restrictions, and request confidential communications. The practice must respond to rights requests under applicable HIPAA procedures and deadlines. It generally must make a good-faith effort to obtain an acknowledgment that the patient received the notice. See HHS’s model Notice of Privacy Practices for health care providers and Privacy Rule summary.

Document how staff route requests, verify identity when appropriate, meet response deadlines, and record decisions. A restriction request does not generally have to be accepted, but the practice must follow restrictions it agrees to, subject to the Rule’s exceptions. A provider must accommodate a reasonable request for confidential communications, such as using a different phone number or mailing address.

Which administrative, physical, and technical safeguards protect electronic PHI?

The Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI). It is scalable: the practice should choose measures based on its size and capabilities, systems, costs, and risks. The rule establishes standards rather than a single technology checklist. See the HHS summary of the Security Rule.

• Administrative safeguards: Assign responsibility for security; establish workforce, access, incident-response, contingency, and evaluation procedures; and provide security awareness and training.
• Physical safeguards: Control physical access to facilities and devices; define appropriate workstation use; and manage the receipt, movement, reuse, and disposal of electronic media.
• Technical safeguards: Use access controls, activity review and audit mechanisms, integrity protections, identity verification, and transmission security appropriate to the practice’s systems and risks.

Examples may include unique staff accounts, screen locks, controlled access to treatment and administrative workstations, secure backups, procedures for lost devices, and protected transmission of ePHI. These are practical measures to assess—not a claim that one particular product or configuration guarantees compliance.

Some Security Rule implementation specifications are “addressable,” not optional: the practice must assess whether each is reasonable and appropriate, implement it when appropriate, or document its decision and take an appropriate alternative step when required. Encryption is addressable; the practice must assess it in light of its risks and document its decision. See HHS guidance on encryption under the Security Rule and addressable implementation specifications.

How should the practice conduct a security risk analysis and manage workforce access?

Conduct and document an accurate, thorough HIPAA security risk analysis covering the ePHI the practice creates, receives, maintains, or transmits. Start by identifying where ePHI resides and how it moves—for example, through the electronic health record, scheduling and billing systems, email, telehealth tools, mobile devices, backups, and vendors’ systems. Assess reasonably anticipated threats and vulnerabilities, the likelihood and potential impact of harm, and the safeguards already in place. HHS’s risk analysis guidance explains that the Rule does not prescribe one methodology or a fixed schedule.

Use the analysis to create a risk-management plan: prioritize identified risks, assign responsibility, choose safeguards, set target dates, and record how the practice will check whether the actions worked. Revisit the analysis when systems, vendors, operations, or risks change, and as part of an ongoing process—not just as a one-time exercise.

Give workforce members access based on their job duties and the information they need. Use individual accounts rather than shared credentials where feasible, review access periodically, promptly change or remove access when roles change or someone leaves, and establish a process for handling urgent access. Review system activity in a way suited to the practice’s systems and risk. HHS describes risk analysis and risk management as complementary steps: identify and assess risk, then implement measures to reduce it. See HHS guidance on risk analysis and risk management.

Which vendors need business associate agreements?

A vendor generally needs a business associate agreement (BAA) when it creates, receives, maintains, or transmits PHI on the practice’s behalf while performing a service. Examples can include a billing company, an IT or cloud service provider that maintains ePHI, a transcription service, or a records-management vendor handling PHI. The specific service and information access matter; evaluate each vendor rather than relying only on its industry label.

A vendor that does not create, receive, maintain, or transmit PHI on the practice’s behalf generally is not a business associate for that service. HIPAA also recognizes a narrow conduit exception for certain transmission-only services that have only transient access to PHI. When a BAA is required, it must set out permitted uses and disclosures, require appropriate safeguards, address reporting of security incidents and breaches, and require relevant subcontractors to protect PHI. See HHS’s business associate guidance.

Do not treat a signed BAA as proof that a vendor is secure or that the practice itself is compliant. Assess the vendor’s role and risks, confirm that the agreement fits the service, and include vendor-related ePHI in the practice’s risk analysis.

What breach notification deadlines and procedures apply?

An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the practice documents that an exception applies or demonstrates, through a risk assessment, a low probability that the PHI was compromised. The assessment considers the type and amount of PHI, who received or used it, whether it was actually acquired or viewed, and steps taken to reduce the risk.

After discovering a breach of unsecured PHI, notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. If a breach affects 500 or more residents of a state or jurisdiction, the practice must also notify prominent media outlets serving that area without unreasonable delay and within that 60-day limit. Notify HHS within the same deadline for breaches affecting 500 or more individuals. For breaches affecting fewer than 500 individuals, the practice may report to HHS annually, no later than 60 days after the end of the calendar year in which the breach was discovered.

If a business associate discovers a breach, it must notify the practice without unreasonable delay and no later than 60 days after discovery; the BAA may require faster reporting so the practice has time to investigate and meet its own deadline. Maintain written response procedures, investigate promptly, document the breach analysis and decisions, take steps to mitigate harm, and keep evidence of required notifications or the basis for determining notification was not required. See the HHS Breach Notification Rule guidance.

What HIPAA training and documentation must the practice maintain?

Train all workforce members on the practice’s privacy policies and procedures as necessary and appropriate for their roles. Provide training to new workforce members within a reasonable period after they join, and retrain people whose functions are affected by a material policy or procedure change within a reasonable period after the change takes effect. The Security Rule also requires a security awareness and training program. Set refresher training as appropriate for the practice’s risks and policies, but do not mistake an employer’s annual training policy for a universal federal requirement for annual HIPAA certification.

Keep records showing who received training and when, along with relevant training materials. A course-completion certificate can document that an individual completed that course; it does not establish that the practice has met all HIPAA requirements. Staff also need to understand the practice’s own procedures for sensitive records, patient requests, disclosures, incident reporting, and access to ePHI. See HHS’s HIPAA audit protocol for training and documentation requirements.

Maintain written policies and procedures, risk analyses and risk-management records, security and breach incident documentation, business associate agreements, and other required assessments and actions. HIPAA generally requires Security Rule documentation to be retained for six years from its creation or the date it was last in effect, whichever is later. See the HHS Security Rule summary.

In short, a pelvic floor physical therapy practice should determine whether it is a covered entity, support patient privacy rights, protect ePHI through risk-based safeguards, control workforce and vendor access, prepare for breach response, and keep evidence of its training and compliance activities.

FAQs.

Does a pelvic floor physical therapy practice qualify as a HIPAA covered entity?

It qualifies if it is a health care provider that conducts a HIPAA-standard electronic transaction, such as submitting claims electronically. The practice’s specialty does not change that test.

What security safeguards are required for electronic PHI?

The Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards to protect ePHI’s confidentiality, integrity, and availability. The safeguards should reflect the practice’s risks and systems; the Rule does not mandate one universal set of products or technologies.

When does a vendor need a business associate agreement?

A vendor generally needs a BAA when it creates, receives, maintains, or transmits PHI on the practice’s behalf while providing a service. Assess the vendor’s actual role and access to information, including whether a narrow exception applies.

How soon must a practice notify patients after discovering a breach?

For a breach of unsecured PHI, the practice must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Other notices—to HHS and, for certain larger breaches, the media—may also be required.