HIPAA Compliance Requirements for Online Vision Test Companies

Online vision tests can collect sensitive information, including test results, symptoms, prescriptions, contact details, and device identifiers. But collecting health-related information does not automatically make a company subject to HIPAA. The key questions are what role the company plays, whether it handles protected health information (PHI) for a HIPAA-regulated organization, and what other federal or state laws apply.

When must an online vision test company comply with HIPAA?

HIPAA applies to covered entities and, for certain obligations, their business associates. A covered entity is a health plan, health care clearinghouse, or health care provider that conducts certain standard electronic transactions, such as electronic billing. An online vision test company is not automatically a covered entity simply because it provides a health-related service or collects eye-test data. See HHS guidance on covered entities.

A company may have to comply with HIPAA if it is itself a covered provider or if it performs services involving PHI on behalf of a covered entity as a HIPAA business associate. For example, a provider that operates online vision testing and submits standard electronic insurance transactions may meet the covered-provider definition. A technology company that supplies testing software to an optometry practice and handles patient data for that practice may instead be a business associate.

HIPAA applies to PHI held or transmitted by a covered entity or business associate. Eye-test results linked to an identifiable person can be PHI in that regulated context. The same kind of information collected directly from consumers by a company that is neither a covered entity nor a business associate is not automatically HIPAA-protected, although other privacy and consumer-protection laws may apply.

Companies should assess their actual transactions, contracts, data flows, and relationships—not rely only on whether they call their product a “vision test,” “screening,” or “wellness tool.” HHS explains that organizations outside the definitions of covered entity and business associate do not have to comply with the HIPAA Rules, but may still be subject to other laws. See HHS’s covered-entity and business-associate overview.

How do covered entity and business associate roles apply to online vision testing?

A HIPAA covered entity may be the optometry practice, clinic, health plan, or other qualifying provider that offers or uses an online vision test. A provider’s covered status depends on the HIPAA definitions and its applicable electronic transactions—not merely on using a website or communicating electronically.

An online testing platform may be a HIPAA business associate if it performs a service for a covered entity that involves creating, receiving, maintaining, or transmitting PHI. Examples may include hosting patient test results, supporting a clinic’s patient-management system, processing referrals, or providing testing software on the clinic’s behalf. A business associate’s subcontractor that handles PHI for it may also have business-associate obligations. See HHS guidance on business associates.

By contrast, a direct-to-consumer company that offers an independent online test is not a business associate merely because its data resembles information a clinic might collect. The business-associate relationship generally depends on the company performing services for a covered entity or another business associate, rather than simply selling its own service to consumers.

Role classification matters because business associates have direct responsibilities under applicable HIPAA Rules, and covered entities must obtain appropriate written assurances before allowing a business associate to handle PHI. If the company’s business includes both direct-to-consumer testing and services for clinics, it should separately map those activities, data flows, and contractual relationships.

What must a business associate agreement cover?

A business associate agreement (BAA) is a written contract or other permitted arrangement that sets the conditions for a business associate’s handling of PHI. It should describe the permitted and required uses and disclosures of PHI and prevent uses or disclosures outside the agreement or those required by law.

Under the federal rules, the agreement must also address requirements such as:

• Using appropriate safeguards and complying with applicable Security Rule requirements for electronic PHI.
• Reporting impermissible uses or disclosures, security incidents, and breaches of unsecured PHI to the covered entity.
• Requiring subcontractors that handle PHI to accept the same applicable restrictions and conditions.
• Supporting access, amendment, and accounting obligations when the business associate performs those functions for the covered entity.
• Making relevant internal practices, books, and records available to HHS for compliance review.
• Returning or destroying PHI at the end of the relationship when feasible, or continuing to protect it and limiting its use if return or destruction is not feasible.

The agreement must also authorize termination by the covered entity for a material breach. These contract requirements appear in 45 C.F.R. § 164.504(e). HHS also explains that a BAA does not replace the parties’ separate duty to comply with applicable HIPAA requirements. See HHS’s business associate guidance.

Online vision test companies should align the BAA with the actual product and data flow. For example, it should be clear whether the platform stores test results, sends them to a clinician, supports appointment scheduling, or uses a subcontractor to host or analyze data. A generic agreement that does not reflect the service may leave important responsibilities unclear.

Which privacy and security safeguards protect eye-test data?

When a company is a covered entity or business associate, the HIPAA Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards to protect electronic PHI’s confidentiality, integrity, and availability. The Rule is designed to be scalable: safeguards should account for the organization’s size, technical environment, resources, and risks rather than follow a single fixed technology checklist. See HHS’s Security Rule summary.

A HIPAA Security Rule risk analysis is a foundational step. The company should identify where electronic PHI is created, received, maintained, or transmitted; assess reasonably anticipated threats and vulnerabilities; evaluate existing protections; and document risks and decisions. It should revisit the analysis as systems, vendors, operations, or risks change. See HHS guidance on risk analysis.

Depending on the risk analysis and applicable Security Rule standards, safeguards for an online vision testing service may include:

• Role-based access controls and unique user identification so staff access only the PHI needed for their roles.
• Audit controls that record and support review of access to systems containing electronic PHI.
• Authentication measures, secure transmission protections, and appropriate encryption decisions.
• Workforce training, security policies, incident-response procedures, and processes for managing access when staff roles change.
• Backups and contingency planning to support data availability and recovery.
• Vendor oversight, including BAAs where required and review of how vendors protect or use the data.

These are examples, not a substitute for a tailored assessment. The Security Rule’s technical safeguard standards address access control, audit controls, integrity, authentication, and transmission security. See 45 C.F.R. § 164.312. HHS also notes that no single strategy is right for every organization and that compliance is an ongoing process. See HHS’s Security Rule compliance FAQ.

How should companies assess online tracking technologies?

Cookies, tracking pixels, analytics scripts, session-replay tools, and mobile-app code can collect information about a user’s interactions. On a vision-testing site, that information could include what a user enters or selects, test-related pages viewed, an IP address, or a device identifier. Companies should inventory these technologies and examine what data each one collects, where it sends the data, and whether it can capture identifiable eye-test or patient information.

If a HIPAA-regulated company’s tracking technology discloses PHI to a vendor, the disclosure must be permitted by the Privacy Rule. A vendor that handles PHI on behalf of a regulated entity may be a business associate and require a BAA. A website privacy notice or cookie banner alone does not authorize a HIPAA disclosure of PHI. HHS describes these issues in its guidance on online tracking technologies.

Companies should carefully account for a legal development affecting that HHS guidance: on June 20, 2024, a federal district court vacated the portion that treated an IP address linked to a visit to an unauthenticated public webpage about a health condition or provider as triggering HIPAA obligations in the circumstances described. HHS’s page notes that it is evaluating next steps. The narrower ruling does not eliminate the need to protect PHI when tracking tools collect or disclose it in other circumstances; assess the actual information and context rather than assuming every page visit is PHI or that tracking is always outside HIPAA.

A practical review should identify tracking tools on public pages, test flows, login and registration screens, appointment pages, and apps; inspect the data sent to third parties; and disable or configure tools that collect PHI without an applicable HIPAA permission and appropriate safeguards. Direct-to-consumer companies outside HIPAA should also assess whether the Federal Trade Commission’s Health Breach Notification Rule applies to their products or services. The FTC explains that the Rule can cover certain health apps and related services that are not covered by HIPAA. See FTC guidance on the Health Breach Notification Rule.

What patient consent and state-law requirements may apply?

HIPAA consent and authorization are distinct. The Privacy Rule generally permits covered entities to use or disclose PHI for treatment, payment, and health care operations without obtaining a separate HIPAA authorization, subject to applicable rules and exceptions. An authorization is generally required for uses or disclosures not otherwise permitted or required by the Privacy Rule. See HHS’s explanation of consent and authorization.

HIPAA privacy permission is also different from a patient’s informed consent to the vision test or treatment itself. State law may govern informed consent, telehealth disclosures, provider-patient relationships, professional licensing, and whether a remote test may support a diagnosis or prescription. The applicable requirements depend on where the patient is located and what the company and clinician do.

Certain state consumer-health privacy laws may impose requirements beyond HIPAA, particularly for health information collected by businesses outside HIPAA’s scope. For example, Washington’s My Health My Data Act can require covered businesses to publish a consumer health data privacy policy and obtain consent for certain collection and sharing, with separate consent for sharing in specified circumstances. See the Washington consumer health data privacy policy statute and Washington collection and sharing statute. Nevada law likewise sets requirements for consumer health data, including consent and disclosures, subject to its scope and exceptions. See Nevada Revised Statutes Chapter 603A.

These are examples, not a complete survey of state law. Coverage, definitions, exemptions, consent standards, consumer rights, and effective requirements differ by jurisdiction. An online vision test company should assess the states where it operates or targets consumers, what data it collects or infers, whether it shares that data, and which state optometry and telehealth rules may apply.

In short, HIPAA obligations turn on the company’s covered-entity or business-associate role and its handling of PHI, while security safeguards, vendor contracts, tracking practices, patient consent, and state laws must be evaluated in context. A company should map its data flows and legal roles first, then build protections and disclosures around the rules that apply to each service.

FAQs

Does every online vision test company have to comply with HIPAA?

No. HIPAA applies to covered entities and business associates, not every company that collects health-related information. A company may be covered if it is a qualifying health care provider that conducts certain standard electronic transactions, or if it handles PHI for a covered entity as a business associate. Other privacy laws may still apply to companies outside HIPAA.

When does an online vision test company need a business associate agreement?

A BAA is generally needed when the company is a business associate handling PHI for a covered entity, or when it engages a subcontractor to handle PHI on its behalf. The parties should evaluate what the service actually does and whether identifiable patient information is created, received, maintained, or transmitted in performing that service.

Is eye-test data protected health information under HIPAA?

It can be. Identifiable eye-test data may be PHI when it is held or transmitted by a HIPAA covered entity or business associate. Similar data collected by an independent direct-to-consumer company that is neither may fall outside HIPAA, though state privacy laws or other federal requirements may protect it.

Can website tracking technologies disclose protected health information?

Yes. Tracking tools can transmit identifying details together with test answers, appointment information, or other data related to a person’s health or care. A HIPAA-regulated company must assess what the tools collect and disclose, ensure any PHI disclosure is permitted, and meet applicable BAA and security requirements. A cookie banner or general privacy notice alone is not a HIPAA authorization.