HIPAA for physical therapists and chiropractors
What PT and chiropractic practices need in place under HIPAA — with the two issues they meet most often: open treatment areas and patient photos or testimonials in marketing.
On this page
HIPAA for physical therapists and chiropractors: at a glance
Physical therapy and chiropractic practices are HIPAA covered entities when they, or a billing service, submit insurance claims or other standard transactions electronically. Two issues come up more often than in other practices: open treatment areas where patients can overhear each other, and using patient photos, videos or testimonials in marketing. Conversations in open gyms are allowed with reasonable safeguards; marketing with patient information requires the patient's written authorization.
| HIPAA applies if | You or your billing service submit claims or check eligibility electronically |
|---|---|
| Open treatment areas | Allowed with reasonable safeguards — lower voices, private room for sensitive talks |
| Photos, videos, testimonials | Need the patient's written HIPAA authorization before marketing use |
| Home exercise and scheduling apps | Need a BAA if the vendor handles patient information for you |
| Common gap | No documented risk analysis |
Does HIPAA apply to your practice?
A physical therapy or chiropractic practice is a covered entity if it transmits health information electronically in connection with a standard transaction — an insurance claim, an eligibility check, a remittance — directly or through a billing service (45 CFR 160.103). Most practices that bill insurance or Medicare are covered. A fully cash-pay practice that never conducts these transactions may not be; check with Does HIPAA apply? rather than assume.
Open treatment areas
PT gyms and open adjustment rooms mean patients overhear each other. HIPAA does not require private rooms. Disclosures that happen as a by-product of an otherwise permitted conversation are incidental and allowed, as long as the practice applies reasonable safeguards and the minimum necessary standard (45 CFR 164.502(a)(1)(iii), 164.530(c)).
In practice, HHS guidance points to things like speaking quietly, not discussing details others don’t need to hear, and keeping a private space for sensitive conversations. Whiteboards and schedules visible to patients should show no more than needed.
Photos, videos and testimonials
Before-and-after photos, exercise videos with recognizable patients and success stories are popular in PT and chiropractic marketing. Using a patient’s information for marketing requires their written authorization (45 CFR 164.508(a)(3)) — a valid HIPAA authorization that names the use, not a verbal OK or a line in an intake form. Patients can revoke it, so keep a record of what each one agreed to.
Photos taken for treatment, kept in the record, are a normal part of care and don’t need a separate authorization.
Apps and devices
Home exercise platforms, scheduling and reminder tools, texting services and telehealth used for follow-ups are business associates when they handle patient information for you — you need a BAA with each. Tablets used in the treatment area should have their own logins or lock automatically.
What to put in place first
- A written risk analysis covering the EHR, apps, tablets, email and backups.
- BAAs with the EHR, home exercise, scheduling, texting and telehealth vendors that handle patient information.
- A marketing authorization form and a rule that nothing identifiable is posted without it.
- Safeguards for open areas, written down and part of staff training.
- Your Notice of Privacy Practices given at the first visit and posted in the clinic and on the website.
Main risks
- Posting patient photos, videos or success stories without a signed HIPAA authorization.
- Discussing diagnoses at full volume in an open gym with no private room for sensitive conversations.
- Home exercise, scheduling or reminder apps that hold patient data without a BAA.
- No documented risk analysis covering the EHR, apps, tablets and email.
- Shared tablets or logins in the treatment area.
Requirements that matter most here
- Security risk analysis →§ 164.308(a)(1)(ii)(A)Every covered entity and business associate must document an accurate and thorough assessment of risks to the ePHI it holds — and then act on it. It is one of the most commonly missing pieces of HIPAA compliance, including in small practices.
- HIPAA authorization →§ 164.508When you need a patient's written authorization to use or share their health information, what the form must contain to be valid, and how patients can revoke it.
- Minimum necessary →§ 164.502(b)What the HIPAA minimum necessary standard requires, when it does not apply, and how small practices put it into practice with role-based access and standard disclosure limits.
- Business associate agreements (BAAs) →§ 164.502(e)A vendor that creates, receives, maintains or transmits PHI on your behalf is generally a business associate, and you need a signed BAA with it before it touches patient data. No BAA means you should not put PHI in that tool.
- Notice of Privacy Practices →§ 164.520What the Notice of Privacy Practices must say, when and how a practice must provide it, where it must be posted, and what changed in 2026.
- Access control and sign-in →§ 164.312(a)(1)Only the right people should reach ePHI, each under their own account, with a reliable way to confirm who is signing in. In practice: unique user accounts, strong authentication such as MFA, and automatic logoff.
- HIPAA training requirements →§ 164.530(b)Who must be trained under HIPAA, on what, how often, and how to document it — and what the rule does not actually require.
- Right of access →§ 164.524Patients' right to see and get copies of their health records: deadlines, formats, fees, third-party requests, and what a small practice needs in place.
Solutions to look at
- Practice management and EHR →ToolPractice management and EHR systems for therapy and small medical practices — how each puts its BAA in place, from which plan, and what that agreement covers.
- Patient texting and messaging →ToolPhone, text and messaging platforms for practices that sign a BAA — what's included in the price, how the agreement is put in place, and what to watch for when texting patients. A BAA is necessary for a vendor that handles PHI, but it does not by itself make texting patients secure or appropriate — that also depends on your own safeguards and policies.
- HIPAA email services →ToolEmail services that sign a BAA, compared on what actually protects patient messages — and what you still have to configure yourself.
- Telehealth and video visits →ToolVideo platforms for therapy and medical visits that sign a BAA — on which plans, how you get the agreement, and what you still have to set up.
- Online HIPAA training courses →ToolOnline HIPAA training for staff — what each course covers, how long it takes, what it costs, and whether owners get completion records that help document the workforce training HIPAA requires.
If something happens
- You had a data breach →A misdirected email, a lost laptop, a hacked mailbox. What to do, in order, in the first days — and the deadlines that start running when you discover it.
- HIPAA training for new employees — and the rest of onboarding →What HIPAA training a new employee needs, when, and how to document it — plus the access steps when someone joins your practice or company and when they leave.
- You received a letter from OCR →A complaint investigation or compliance review from the HHS Office for Civil Rights. What the letter means, what to send, and how these cases usually end.
Your path to compliance
- Confirm HIPAA applies to you and in which role — Does HIPAA apply?
- Put the requirements above in place, starting with a documented risk analysis.
- Choose how to do the work — yourself, with templates, software, a consultant or an attorney — compare every route.
Frequently asked questions
Is it a HIPAA violation if other patients overhear in a PT gym?
Not by itself. HHS guidance treats overheard conversations as incidental disclosures when the practice uses reasonable safeguards, such as speaking quietly and moving sensitive discussions to a private room.
Can a clinic post a patient's success story on social media?
Only with the patient's signed HIPAA authorization that covers that use. A verbal OK or a general consent form is not enough.
Do cash-only chiropractors need to follow HIPAA?
If neither the practice nor anyone acting for it conducts standard electronic transactions, it may not be a covered entity. Confirm that before relying on it — state privacy laws apply either way.