HIPAA Compliance Requirements for Aquatic Therapy Rehabilitation Centers

Which aquatic therapy centers must comply with HIPAA?

HIPAA applies based on an organization’s role and activities—not simply because it provides therapy or handles health information. An aquatic therapy center is generally a covered entity if it is a health care provider that conducts certain standard transactions electronically, such as submitting electronic health care claims. This covered entity determination applies whether the center sends transactions itself or uses a billing service. Using email or keeping electronic records alone does not automatically make a provider a covered entity. HHS’s Summary of the HIPAA Privacy Rule

A center that is not a covered entity may still have HIPAA obligations if it performs services involving protected health information (PHI) on behalf of a covered entity as a business associate. A community pool or other facility is not subject to HIPAA merely because a covered provider rents space there; its role and access to PHI matter. HHS guidance on covered entities and business associates

How does the HIPAA Privacy Rule protect patient information?

The Privacy Rule protects individually identifiable health information held or transmitted by a covered entity or its business associate, in any form—including spoken conversations, paper records, and digital files. For a therapy center, that can include a patient’s diagnosis, treatment plan, appointment details, progress notes, and billing information when linked to the patient. HHS’s Summary of the HIPAA Privacy Rule

The Rule permits many uses and disclosures for treatment, payment, and health care operations, while requiring safeguards against uses or disclosures that are not permitted. When the minimum necessary standard applies, the center should limit access, use, and disclosure to what is reasonably needed for the purpose. That standard does not apply to disclosures between health care providers for treatment purposes. HHS guidance on the minimum necessary requirement

Covered entities are also responsible for responding to patients’ HIPAA rights, including applicable requests to access or amend information and to receive an accounting of certain disclosures. Centers should have a process for routing and handling these requests, including when records are maintained by a business associate. HHS guidance on individual rights and business associates

What safeguards does the Security Rule require for electronic health information?

The HIPAA Security Rule requires covered entities and business associates to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI). The center should conduct a documented HIPAA Security Rule risk analysis covering ePHI it creates, receives, maintains, or transmits; identify threats and vulnerabilities; and implement reasonable and appropriate measures to address the risks. The analysis should reflect the center’s actual systems and operations, including scheduling, billing, documentation, mobile devices, and any systems used at the pool. HHS guidance on Security Rule risk analysis

Security measures should include administrative, physical, and technical safeguards. Relevant examples include assigning unique user access, protecting devices and records from unauthorized access, verifying user identity, securing electronic transmissions, maintaining backups and contingency procedures, and reviewing security measures as risks or operations change. The Rule is flexible about how safeguards are selected, but requires covered organizations to document and maintain their security policies and procedures. HHS’s Summary of the HIPAA Security Rule

Use access controls and audit controls to limit ePHI access to authorized workforce members and record or examine activity in systems that contain ePHI. For example, role-based permissions can keep pool staff who do not need clinical records from viewing them, while access logs can help identify inappropriate use. HHS’s Security Rule safeguards overview

How should centers manage business associates and written agreements?

A business associate is generally a person or organization outside the covered entity’s workforce that performs a function or service involving PHI on the entity’s behalf. Depending on its role, this may include a billing service, an electronic records vendor, or a cloud provider that stores ePHI. A center should assess what information each vendor handles and whether the relationship meets the HIPAA definition before sharing PHI. HHS Business Associates guidance

When HIPAA requires it, the center must have a written business associate agreement (BAA) or other written arrangement. The agreement should define the permitted uses and disclosures of PHI, require appropriate safeguards, address reporting of security incidents and breaches, and set out obligations when the relationship ends. A BAA does not by itself establish that the center or vendor is compliant; each party remains responsible for the requirements that apply to it. HHS guidance on business associate contracts

If the center learns of a material breach or violation of the agreement, it must take reasonable steps to address it and, if those steps do not resolve the problem, terminate the agreement when feasible. HHS guidance on responding to business associate violations

How can centers protect patient privacy and safety at community pools?

HIPAA does not require a community pool to close to the public during therapy or require a center to eliminate every possibility that someone might overhear a conversation. It does require covered entities to use reasonable safeguards to protect PHI and limit incidental disclosures. HHS explains that safeguards should be appropriate to the circumstances and that structural changes such as private rooms are not universally required. HHS guidance on reasonable privacy safeguards

At a shared pool, practical safeguards can include discussing diagnoses and treatment details away from other swimmers, using discreet language when giving instructions, keeping paper records and screens out of public view, securing devices when not in use, and avoiding visible patient lists or treatment notes in public areas. Staff should also use only the patient information needed for their role and follow the center’s policies for consent, photography, and communications. These are risk-based practices, not a HIPAA-mandated pool-closure checklist.

Privacy measures should support, not obstruct, safe clinical care. The center can coordinate with pool management on access to treatment areas, equipment storage, emergency procedures, and how staff can communicate during a session without unnecessarily disclosing patient details. HIPAA’s allowance for certain incidental disclosures depends on the underlying use being permitted and reasonable safeguards being in place. HHS guidance on incidental uses and disclosures

What are the breach notification deadlines and reporting requirements?

An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity or business associate demonstrates, through the required assessment, that there is a low probability the information was compromised or an applicable exception applies. The assessment considers the type of PHI, who received or used it, whether it was actually acquired or viewed, and steps taken to reduce risk. HHS Breach Notification Rule

When notification is required, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. A breach is treated as discovered when it is known—or would have been known through reasonable diligence—to the covered entity. A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery; a BAA may set a shorter reporting period. HHS breach notification deadlines

The covered entity must also notify the HHS Secretary. Breaches affecting 500 or more individuals must be reported without unreasonable delay and within 60 days of discovery. Breaches affecting fewer than 500 individuals may be reported to HHS annually, no later than 60 days after the end of the calendar year in which they were discovered. If a breach affects more than 500 residents of a state or jurisdiction, the center must also notify prominent media outlets serving that area, within the same outside limit of 60 days. HHS guidance on HHS and media reporting

What breach procedures, staff training, and documentation should centers maintain?

Maintain written breach-response procedures that explain how staff report suspected incidents, who investigates them, how the center contains and mitigates harm, and who decides whether notifications are required. Staff should know how to promptly report events such as a misplaced tablet, a misdirected patient message, unauthorized access to a record, or a vendor’s security incident. HIPAA requires covered entities to train workforce members on breach-notification policies and procedures; it does not establish a universal annual certificate-renewal requirement. Training should also address the center’s own policies and workflows. HHS administrative requirements for breach notification

Keep breach notification documentation that records the incident, discovery date, affected information and individuals, investigation and risk assessment, mitigation, decision-making, and any notifications made. If the center determines notification is not required, retain the assessment and rationale supporting that conclusion. Document policies, procedures, staff training, and relevant security evaluations as well. HHS guidance on breach documentation HHS guidance on Security Rule documentation

In practice, an aquatic therapy center’s HIPAA program should connect its covered entity determination, patient privacy practices, ePHI safeguards, vendor agreements, pool-specific workflows, staff training, and breach notification documentation. The exact safeguards depend on the center’s role, systems, and risks; HIPAA compliance is an ongoing process rather than a one-time certificate. HHS guidance on ongoing Security Rule compliance

FAQs

Does HIPAA apply to every aquatic therapy rehabilitation center?

No. A center generally must comply if it is a covered entity—such as a health care provider conducting certain standard transactions electronically—or if it acts as a business associate for a covered entity. Providing aquatic therapy or maintaining electronic records alone does not determine whether HIPAA applies. HHS guidance on who must comply with HIPAA

Must a community pool close to the public during therapy sessions?

No. HIPAA does not require a community pool to close during therapy sessions. A covered center must instead take reasonable steps to protect patient information in the shared setting, such as limiting public access to records and avoiding unnecessary disclosure of treatment details. HHS guidance on reasonable privacy safeguards

How soon must a center notify patients after discovering a breach?

If notification is required, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. HHS Breach Notification Rule

When is media notification required for a HIPAA breach?

Media notification is required when a breach affects more than 500 residents of a state or jurisdiction. The covered entity must notify prominent media outlets serving that area without unreasonable delay and no later than 60 days after discovery. HHS guidance on media notice