HIPAA Requirements Every Wellness Practice Needs to Know
Information current as of November 2026. General information only, not legal advice. HIPAA questions depend on how your specific practice bills, stores, and shares information, so confirm your situation with a healthcare attorney or compliance professional.
The short answer: HIPAA doesn't automatically apply to every wellness practice. It applies to health care providers that send health information electronically for standard transactions like insurance claims, and to the vendors that handle health information on their behalf. If that's you, HIPAA comes with a specific set of requirements: a documented risk analysis, written policies, staff training, business associate agreements, a Notice of Privacy Practices, patient access rights, security safeguards, and breach notification. If it isn't you, you're still not free to handle client health information however you want. Federal and state privacy laws written for businesses outside HIPAA can still apply.
Wellness is one of the few corners of health care where both mistakes are common. Some practices assume they're covered and spend money on things that don't apply to them. Others assume they're exempt and find out otherwise after a breach. This guide walks through how to tell which one you are, then what each path requires.
Step 1: Does HIPAA apply to your practice?
HIPAA's rules apply to two kinds of organizations.
Covered entities. For a practice, that means a health care provider who transmits health information electronically in connection with a standard transaction, the most common one being an insurance claim. Billing insurance electronically, directly or through a billing company, is usually what pulls a provider in. Once you're a covered entity, HIPAA applies to all the protected health information (PHI) you handle, not just the insurance-billed part.
Business associates. Vendors that create, receive, maintain, or transmit PHI on behalf of a covered entity: EHR and portal software, billing companies, IT providers, cloud storage, and similar services. Business associates have their own direct obligations under the Security Rule and Breach Notification Rule.
Here's how that tends to shake out across wellness practice types. Treat this as a starting point for a conversation with counsel, not a determination.
Usually a covered entity
- Physical therapy clinic: Most bill insurance electronically.
- Chiropractic office: Same reason: insurance billing.
Depends
- Med spa with physician, NP, or PA services: Covered if anyone bills insurance electronically for medical services. Many cash-pay med spas are not, but some providers working there may be covered through their other practices.
- Recovery clinic or multi-location wellness clinic: Turns on whether licensed providers bill insurance electronically.
- Registered dietitian: Covered if billing insurance (some RDs bill for medical nutrition therapy); not if purely cash-pay.
Usually not a covered entity
- Personal trainer or gym: Trainers generally aren't health care providers billing insurance.
- Health or nutrition coach (non-licensed): Same reason.
Two things trip people up here. First, "we take HSA/FSA cards" or "we're cash-only but give superbills" is a different question from electronic insurance billing, and it's worth having counsel look at your exact setup. Second, a practice that isn't a covered entity can still end up handling PHI as a business associate if it does work on behalf of one, for example, a gym running a program under contract with a clinic or health plan.
Step 2: If you're covered, these are the core requirements
HIPAA is three main rules: the Privacy Rule (how PHI can be used and shared, and what rights patients have), the Security Rule (how electronic PHI has to be protected), and the Breach Notification Rule (who you tell, and when, if something goes wrong). In practice, that adds up to this list.
1. Name a privacy officer and a security officer
Someone has to own this. In a small practice it can be the same person, often the owner or office manager. What matters is that it's written down and that person actually does the job.
2. Do a real risk analysis, then act on it
The Security Rule requires an accurate and thorough assessment of risks to the electronic PHI you hold: where it lives (EHR, laptops, phones, email, portal, paper scanned into a shared drive), who can reach it, and what could go wrong. Then you have to manage the risks you find.
This is the single most enforced requirement right now. OCR, the HHS office that enforces HIPAA, launched a Risk Analysis Initiative in October 2024 and has kept producing settlements under it. It has also said the initiative is expanding in 2026 to look at whether organizations actually fixed the risks they identified, not only whether they did the analysis. Small and wellness-adjacent organizations aren't exempt: in 2025, OCR settled with Health Fitness Corporation, a corporate wellness company, for $227,816 over a risk analysis violation.
A risk analysis isn't a one-time project. Redo it when something changes: a new EHR, a new location, a new texting tool, a new vendor.
3. Write policies and procedures, and train your staff on them
You need written policies covering how your practice handles PHI, and every workforce member who touches it needs training, including front desk staff and part-timers. Document who was trained and when. HIPAA generally requires you to keep this kind of documentation for six years.
4. Sign a business associate agreement (BAA) with every vendor that touches PHI
If a vendor handles PHI for you, you need a BAA with them before they do. Common ones for wellness practices: EHR or practice management software, client portals and intake form tools, billing companies, email and texting platforms used for client communication, cloud storage, IT support, and any platform that routes client information to a physician or pharmacy.
A good test: if a vendor won't sign a BAA, don't put PHI into their product. That rules out a lot of free consumer tools, including standard versions of many form builders, schedulers, and messaging apps.
5. Give patients a Notice of Privacy Practices (NPP)
Covered providers must give patients a Notice of Privacy Practices explaining how their information is used and what rights they have, post it in the office, and post it on the website if you have one.
If you create, receive, or maintain substance use disorder records covered by the federal Part 2 rules, your NPP had to be updated by February 16, 2026 to address those records. OCR published updated model notices around that deadline. If you added language in 2024 for the reproductive health privacy rule, that rule was vacated by a federal court in 2025, and benefits and compliance advisers have recommended removing that language from notices.
6. Honor patients' rights, especially the right of access
Patients have the right to get copies of their records, generally within 30 days of the request (with one possible 30-day extension), at a reasonable cost-based fee. They also have rights to request amendments, request restrictions, and get an accounting of certain disclosures.
Right of access sounds simple, and it's still one of OCR's most enforced areas. OCR has issued more than 50 financial penalties under its Right of Access Initiative. A practice that sits on a records request for months is exposed even if nothing was ever breached.
7. Use and share only what's needed
The minimum necessary standard means you share the least PHI needed for the task. Treatment-related sharing with other providers is more flexible, but sending a whole chart when a single note would do, or giving every staff member access to every client, works against you.
8. Put the right safeguards in place
The Security Rule's safeguards fall into three buckets:
- Administrative: risk analysis, policies, training, access management, contingency planning.
- Physical: locked rooms and cabinets, device controls, screen positioning in a busy front desk area.
- Technical: unique user logins, access controls, audit logs, automatic logoff, and encryption.
Under the current rule, some of these are "addressable" rather than strictly required, which means you can document why an alternative is reasonable. In practice, encryption, multi-factor authentication, and role-based access are what OCR and most compliance advisers expect to see, and they're what the proposed Security Rule update (see below) would make mandatory.
9. Have a breach response plan, and know the deadlines
If unsecured PHI is breached, you must notify affected individuals without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people also require notice to HHS within that window and, if 500 or more residents of a state are affected, to prominent media in that state. Smaller breaches go into a log you report to HHS within 60 days of the end of the calendar year.
Most states have their own breach notification laws too, and some have shorter deadlines. Your plan should cover both.
What changed in 2026
There's been a lot of noise about "new HIPAA rules for 2026." Here's what actually moved.
ItemStatus as of November 2026What it means for you
Penalty amounts
Final. Adjusted for inflation effective January 28, 2026.
Civil penalties now run from $145 to $2,190,294 per violation depending on culpability tier. OCR's 2019 enforcement discretion keeps lower annual caps for the less serious tiers.
Part 2 / NPP update
Final. Compliance date was February 16, 2026.
Update your NPP if you handle Part 2 substance use disorder records. OCR now enforces Part 2 and accepts Part 2 complaints.
Security Rule overhaul
Still proposed. Published January 2025; final action now listed for July 2027 on the federal regulatory agenda.
The current Security Rule is fully in force. The proposal would make things like MFA and encryption mandatory, so they're worth doing now either way.
OCR enforcement focus
Ongoing.
Risk analysis (now including risk management), ransomware, and right of access remain the priorities.
Reproductive health privacy rule
Vacated by a federal court in 2025.
Remove related language from your NPP if you added it.
The practical read: nothing in 2026 changed the basics for a small practice. The rule with the biggest headline, the Security Rule overhaul, hasn't taken effect, and enforcement is still mostly about whether you did the fundamentals.
Your website, intake forms, and messaging
This is where wellness practices tend to get exposed, because the tools are often marketing tools first.
Tracking pixels. In 2024, a federal court vacated part of OCR's online tracking guidance, specifically the part saying that tracking a visitor's IP address on a public, unauthenticated webpage about a health condition creates PHI. OCR dropped its appeal. That doesn't make pixels safe everywhere. Pages behind a login, intake and booking forms, and client portals are a different story: if a tracking tool collects identifiable health information there, HIPAA's rules on disclosure still apply. Keep ad and analytics pixels off any page where a client enters health information.
Intake forms. If clients type health history into a form, that form tool needs to be one that will sign a BAA, and the submissions need to land somewhere secure, not in a shared inbox.
Email and texting. Patients can ask to receive unencrypted communications after you explain the risk, but your default for PHI should be a secure channel. Appointment reminders are usually lower risk than clinical details; keep the clinical details in the portal.
Chat widgets. Website chat tools are often run by vendors that won't sign a BAA. Tell clients plainly not to put health details in chat, and don't ask them to.
If HIPAA doesn't apply to you, you still have rules
This is the part that most HIPAA content skips, and it's the part most trainers, coaches, and cash-pay studios need.
HIPAA protection doesn't follow the information. Health details a client tells their trainer or coach generally aren't HIPAA-protected, because the trainer isn't a covered entity. That's not a loophole to celebrate. It means the client's information has fewer legal protections in your hands than in a clinic's, which is a good reason to handle it carefully.
The FTC's Health Breach Notification Rule. The FTC updated this rule in 2024 to make clear it applies to health apps and similar technologies that aren't covered by HIPAA. If your practice runs an app or online tool that holds client health records, a breach (which the FTC defines to include unauthorized sharing, not just hacks) can trigger notice to clients and the FTC.
State health privacy laws. Several states now regulate health data held by businesses outside HIPAA. Washington's My Health My Data Act is the best-known example: it covers "consumer health data" that isn't PHI, applies to businesses handling Washington residents' data, and lets consumers sue. Other states have passed or proposed similar laws, and general consumer privacy laws like California's can apply too.
Your certifying body. Organizations like ACE, NASM, and NSCA have confidentiality expectations in their codes of ethics. Breaking client confidentiality can cost you your certification even where no privacy law applies.
Contracts. If you partner with a clinic, health plan, or employer wellness program, your contract may require HIPAA-level handling, and you may become a business associate.
A sensible default for non-covered practices: collect only the health information you actually need, store it somewhere with real access controls, don't put it into free consumer tools, and don't share it with ad platforms.
Common mistakes wellness practices make
- Assuming "HIPAA-compliant software" makes the practice compliant. A compliant tool helps. It doesn't do your risk analysis, train your staff, or answer records requests.
- Treating the risk analysis as a template. OCR's settlements keep citing analyses that were missing, outdated, or didn't cover every system holding PHI.
- Running client communication through personal phones and texts with no policy, no BAA, and no way to retrieve or delete messages when a staff member leaves.
- Leaving marketing pixels on booking and intake pages because the agency that built the site installed them everywhere.
- Slow records requests. A client asking for their file is a deadline, not a favor.
- No breach plan. The 60-day clock starts at discovery, and a lost laptop on a Friday is a bad time to start writing one.
Where Doc Connect fits
Doc Connect is built for practices that sometimes need a physician to review a client request, so client information is handled with HIPAA-grade protections inside the platform: data is encrypted at rest and in transit, access is role-based, every submission, review, and message is logged in an exportable audit trail, and Doc Connect signs a BAA with every provider. No prescription leaves the platform without a licensed physician's review and signature.
What the platform doesn't do is make your whole practice compliant. If you're a covered entity, your risk analysis, policies, training, NPP, records requests, and everything you handle outside the platform are still yours. If you're not a covered entity, using a HIPAA-grade platform for physician review is a sound way to protect the information that flows through it, but it doesn't change whether HIPAA applies to the rest of your practice.
A quick HIPAA checklist for covered wellness practices
- Confirm whether you're a covered entity, a business associate, or neither, and write down why.
- Name a privacy officer and a security officer.
- Complete a risk analysis covering every system that holds PHI, and track how you're fixing what it finds.
- Write policies and train every workforce member. Keep records for six years.
- Inventory your vendors and get a BAA from each one that touches PHI.
- Post and distribute a current Notice of Privacy Practices (Part 2 language if it applies; reproductive health language removed).
- Set a process to answer records requests within 30 days.
- Turn on MFA, encryption, unique logins, and audit logging.
- Pull tracking pixels off intake, booking, and portal pages.
- Write a breach response plan that covers federal and state deadlines.
Frequently asked questions
Does HIPAA apply to personal trainers?
Usually not. HIPAA applies to health care providers that bill insurance electronically and to vendors working for them. Most personal trainers don't fit either category. That means client health details a trainer holds generally aren't HIPAA-protected, though state privacy laws, FTC rules for health apps, and certifying-body ethics codes can still apply.
Do med spas have to be HIPAA compliant?
It depends on billing. A med spa is a covered entity if it or its providers transmit health information electronically for standard transactions like insurance claims. Many cash-pay med spas are not, but individual physicians, NPs, or PAs working there may be covered through other practices. Have counsel review your setup.
Are physical therapists covered by HIPAA?
Most are, because most PT practices bill insurance electronically. Once covered, HIPAA applies to all the PHI the practice handles.
What is the most common HIPAA violation OCR enforces?
Failing to do an accurate and thorough risk analysis has been OCR's most frequent finding in recent settlements, and OCR has said its risk analysis enforcement is expanding in 2026 to cover risk management. Right of access violations are the other big category.
Did HIPAA change in 2026?
Partly. Penalty amounts were adjusted for inflation in January 2026, and practices handling Part 2 substance use disorder records had to update their Notice of Privacy Practices by February 16, 2026. The larger Security Rule overhaul is still a proposal, with final action now targeted for July 2027.
How much are HIPAA fines in 2026?
Civil penalties range from $145 to $2,190,294 per violation, depending on how much the organization knew and how quickly it fixed the problem. Most OCR cases end in settlements with corrective action plans rather than maximum fines.
Do I need a BAA with my client portal or intake form software?
If you're a covered entity and the software handles PHI, yes. If a vendor won't sign one, don't put PHI into their product.
Can I text clients about their care?
You can, with care. Use a secure channel by default for clinical details, document any client request to use regular text or email after explaining the risk, and make sure your texting tool fits into your policies and BAAs.
Disclaimer: This article is general information for wellness practice owners and operators. It is not legal or compliance advice and does not account for how your specific practice bills, stores, or shares information, or for your state's laws. Content is current as of November 2026; HIPAA rulemaking and state health privacy laws are changing, and parts of this may be out of date by the time you read it. Talk to a healthcare attorney or qualified compliance professional before making decisions about your HIPAA program.
Sources: HHS: Covered Entities and Business Associates; HHS: Part 2 (Confidentiality of Substance Use Disorder Patient Records); Federal Register: HIPAA Security Rule NPRM (Jan. 6, 2025); Federal Register: Annual Civil Monetary Penalties Inflation Adjustment (Jan. 28, 2026); Paubox: HHS pushes final HIPAA Security Rule update to 2027; McDermott Will & Schulte: Final action on HIPAA Security Rule modifications now projected for July 2027; Coalfire: The HIPAA Security Rule update is delayed to July 2027; Nixon Peabody: Updated model HIPAA and Part 2 notices released; Davis Wright Tremaine: HIPAA Notices of Privacy Practices update; OneDigital: HIPAA Notice of Privacy Practices update required by February 16, 2026; HIPAA Journal: HIPAA Violation Fines; HIPAA Guide: Four Healthcare Orgs Fined for Risk Analysis Failures; Scrut: What 100 OCR settlements reveal; HIPAA Journal: OCR drops appeal in AHA tracking technology case; Holland & Hart: Court vacates HIPAA online tracking guidance; Perkins Coie: FTC Expands Health Breach Notification Rule; Fredrikson: The non-HIPAA regulation of health data.