HIPAA for OT, PT, and SLP: covered entities, the Privacy Rule, and the Security Rule

HIPAA’s Privacy and Security Rules apply to covered entities and their business associates. HHS names three kinds of covered entity: health plans, health care clearinghouses, and health care providers who conduct certain transactions electronically. For a provider, HHS ties coverage to those electronic transactions, not to the profession. HHS’s list of example providers does not name occupational therapy, physical therapy, or speech-language pathology. The Privacy Rule protects patients’ health information and gives them rights over it. The Security Rule covers electronic health information. This page quotes HHS and does not say whether any particular practice is covered.

Quoted from official pages checked November 10, 2026. Confirm current requirements, fees, and dates on those sites. This page is not legal advice and does not guarantee eligibility, certification, or licensure.

HHS’s HIPAA for Professionals pages were read on November 10, 2026. The HHS pages show their own “Content last reviewed” dates, and this page quotes them as they read that day.

What HIPAA set up

HHS’s HIPAA for Professionals page says HIPAA “included Administrative Simplification provisions that required HHS to adopt national standards for electronic health care transactions and code sets, unique health identifiers, and security.” It says the Privacy Rule “set national standards for the protection of individually identifiable health information by three types of covered entities: health plans, health care clearinghouses, and health care providers who conduct the standard health care transactions electronically.” One of those unique identifiers is the National Provider Identifier.

Who is a covered entity

HHS’s Covered Entities and Business Associates page states: “The HIPAA Rules apply to covered entities and business associates.” It also states: “If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules.” Its list of providers ends with this condition: “but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.”

HHS’s Summary of the HIPAA Privacy Rule states: “Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity.” It also states: “Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction.” And: “The Privacy Rule covers a health care provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf.”

HHS links a question-and-answer decision tool for working out whether an organization or individual is a covered entity. This site does not apply that test to anyone’s practice.

Business associates

The covered entities page states that if a covered entity engages a business associate, “the covered entity must have a written business associate contract or other arrangement with the business associate”. It adds: “In addition to these contractual obligations, business associates are directly liable for compliance with certain provisions of the HIPAA Rules.”

The Privacy Rule

HHS’s Privacy Rule page states: “The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other individually identifiable health information (collectively defined as ‘protected health information’) and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically.” It also states: “The Rule also gives individuals rights over their protected health information, including rights to examine and obtain a copy of their health records, to direct a covered entity to transmit to a third party an electronic copy of their protected health information in an electronic health record, and to request corrections.”

On sharing, the summary states: “A central aspect of the Privacy Rule is the principle of ‘minimum necessary’ use and disclosure.” It continues: “A covered entity must make reasonable efforts to use, disclose, and request only the minimum amount of protected health information needed to accomplish the intended purpose of the use, disclosure, or request.” The summary lists exceptions, beginning with “disclosure to or a request by a health care provider for treatment”.

The Security Rule

HHS’s Security Rule page states: “The HIPAA Security Rule establishes national standards to protect individuals' electronic protected health information that is created, received, used, or maintained by a covered entity or its business associate.” It continues: “The Security Rule requires implementation of appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic protected health information.”

HHS’s Summary of the HIPAA Security Rule states that the rule “is designed to be flexible, scalable, and technology neutral, enabling a regulated entity to implement policies, procedures, and technologies that are appropriate for the entity’s particular size, organizational structure, and risks to ePHI.” The Security Rule page also lists a January 6, 2025 proposed rule to strengthen cybersecurity. This page does not describe proposed changes.

Schools

School-based therapists may work under FERPA, the education records law, as well as HIPAA. HHS’s FERPA and HIPAA page states: “The U.S. Department of Education and the Office for Civil Rights at the U.S. Department of Health and Human Services released updated joint guidance in December 2019 addressing the application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to records maintained on students.” The joint guidance itself was not opened for this page. See working in schools.

What ASHA adds about state law

ASHA’s HIPAA page, checked November 10, 2026, states: “Many states have enacted their own privacy legislation; these regulations can have broader definitions of covered entities and covered transactions.” APTA and AOTA HIPAA pages were not read for this site.

Telehealth

HHS lists a separate HIPAA and Telehealth topic, which was not opened for this page. Association telepractice guidance is quoted on telepractice and telehealth.

What this page does not do

It copies no civil or criminal penalty amounts, settlement figures, or enforcement statistics, and it does not tell you whether you or your practice are a covered entity. It is not legal, billing, or compliance advice. Confirm current rules with the agency that publishes them, your employer, and your state board.