Does HIPAA apply to massage therapists?

Asked by: Dr. Trent Treutel Jr.  |  Last update: July 18, 2025
Score: 4.9/5 (60 votes)

However, massage therapists operate like healthcare providers in most respects, and therefore must adhere to HIPAA regulations.

Are massage therapists bound by confidentiality?

Yes, massage therapy businesses are generally bound by confidentiality. Massage therapists are generally not considered covered entities under HIPAA unless they electronically transmit health information for specific transactions like insurance claims.

Does HIPAA apply to spas?

HIPAA compliance is mandatory for medical spas that handle physical and electronic Protected Health Information (ePHI/PHI), including personal client details (e.g. name, address, ID number) and treatment details (e.g. medical records, facial images, notes).

Who is exempt from HIPAA?

HIPAA does not apply to all healthcare providers or all insurance companies that cover the cost of medical care. For example, HIPAA does not apply to healthcare providers that only bill clients directly or to auto insurance companies that cover the cost of medical care if a plan member is injured in an auto accident.

Are therapists protected by HIPAA?

HIPAA requirements help protect not only people in therapy, but also the therapists providing treatment. The protections offered by HIPAA not only protect confidentiality of people receiving health care, they can also lead to improved treatment by allowing health care professionals and family members to collaborate.

What You Need to Know About HIPAA as a Massage Therapist

34 related questions found

What would make a therapist break confidentiality?

When there is an indication of abuse of a child, dependent adult or elderly adult. If you become gravely disabled. If information is required by a court subpoena or court order.

What happens when a therapist violates HIPAA?

Covered entities and specified individuals, as explained below, who "knowingly" obtain or disclose individually identifiable health information, in violation of the Administrative Simplification Regulations, face a fine of up to $50,000, as well as imprisonment up to 1 year.

Who isn't covered by HIPAA?

This includes employers, life insurance companies (when not acting as health plans), workers' compensation carriers, many schools and school districts, many state agencies like child protective services, and many law enforcement agencies.

Can non-medical professionals violate HIPAA?

If, for example, a non-medical member of a covered entity's workforce (such as a member of the IT team) disclosed PHI without authorization, they would be in violation of HIPAA – although it would be their employer who would have to notify the affected individual and report the disclosure to HHS' Office for Civil ...

Who is restricted by HIPAA?

Who must comply with the HIPAA Privacy Rule? HIPAA applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically (e.g., billing a health plan). These are known as covered entities.

Is massage covered by HIPAA?

HIPAA applies to massage therapy in many situations. There's often confusion over whether HIPAA applies to massage therapy. That's because not all massage therapists act as healthcare providers. However, if the massage therapist handles sensitive personal information, like health history, then HIPAA does apply.

What Cannot be disclosed under HIPAA?

Protected health information (PHI) cannot be shared under HIPAA. So what exactly is considered PHI according to HIPAA? It's information that can identify a particular patient, including health records, lab reports, bills, or even verbal conversations.

Are wellness programs subject to HIPAA?

Wellness programs that are offered by employers directly and not as part of a group health plan are not subject to HIPAA privacy and security rules. However, other federal or state laws may apply and regulate the collection and/or use of employee health information.

How do I protect myself as a massage therapist?

7 Safety Measures for Massage Therapists to Use
  1. Good Hygiene. Of course, the first thing any massage therapist should do is practice good hygiene. ...
  2. Give Plenty of Time Between Appointments. ...
  3. Prepare Your Room Correctly. ...
  4. Limit What You Touch. ...
  5. Use High-Quality Oils and Lotions. ...
  6. Use Good Ventilation. ...
  7. Don't Overwork Yourself.

Under which circumstances can massage practitioners legally breach confidentiality?

Circumstances in which we can legally breach confidentiality—and, in fact, are often obligated to—are those in which there is clear and imminent danger to the client or others, there is suspicion of abuse or neglect of a child or incapacitated person, or there is a medical emergency.

Do massage therapists judge their clients?

Short answer: We do not judge if your body is fat, thin, hairy, or tatooed. However one thing that we do appreciate is if the body is clean. While it may be nice to work out and then immediately recover with a massage, sweat and dirt can make it harder to do the needed massage strokes and manipulations.

What can override HIPAA?

In contrast to State laws that authorize higher or different fees than are permitted under HIPAA, HIPAA does not override those State laws that provide individuals with greater rights of access to their health information than the HIPAA Privacy Rule does. See 45 CFR 160.202 and 160.203.

What qualifies as a HIPAA violation?

HIPAA violations occur when an organization runs afoul of the standards defined by this 1996 U.S. Federal legislation. Many HIPAA violations are related to accessing or sharing patients' protected health information (PHI). However, violations can also include items such as not training staff or monitoring access logs.

Does HIPAA apply to non-healthcare professionals?

The requirement to protect health information also applies to business associates. This implies that non-medical staff also need to receive HIPAA training.

What are the three exceptions to HIPAA?

The Three Exceptions to a HIPAA Breach
  • Unintentional Acquisition, Access, or Use. ...
  • Inadvertent Disclosure to an Authorized Person. ...
  • Inability to Retain PHI.

Do estheticians have to follow Hippa?

The Health Insurance Portability and Accountability Act (HIPAA) stands as a cornerstone in ensuring the privacy and security of patient data. Aesthetic clinics, despite not being traditional healthcare facilities, handle sensitive patient information and thus must adhere to HIPAA regulations.

What kind of health information is not protected by HIPAA?

The Privacy Rule excludes from protected health information employment records that a covered entity maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g. De-Identified Health Information.

Does HIPAA apply to therapists?

Therapists employed by a covered entity are required to comply with HIPAA to the extent that their employer is responsible for developing HIPAA-compliant policies and procedures, and therapists are required to comply with the policies and procedures.

What can therapists not keep confidential?

Are there any exceptions to confidentiality? Yes, there are some circumstances where confidentiality cannot be maintained. For example, a therapist must report suspected child abuse, neglect, or imminent harm to self or others. Therapists may also have to release records if subpoenaed by a court of law.

Does a HIPAA violation go on your record?

A HIPAA violation will show up in a background check if the violation relates to §1177 of the Social Security Act.