Who does HIPAA apply to? Compliance for therapists

HIPAA regulations apply to certain types of organizations, known as "covered entities.” They’re required to follow specific guidelines set forth by the Department of Health and Human Services to safeguard sensitive health information. 

A covered entity is an individual or organization that processes health information or provides healthcare services. In a behavioral health context, these typically include providers like therapists, healthcare plans, and healthcare clearinghouses. Here are some examples of covered entities.

1. Providers

As a provider, you are considered a "covered entity" under HIPAA. This means you are legally obligated to protect your clients' health information by ensuring privacy, security, and confidentiality. HIPAA compliance for therapists requires careful attention to how client data is stored, transmitted, and shared. 

In a behavioral health setting, this could include securely storing client records, using encrypted telehealth platforms, and ensuring confidentiality in communication. Any sharing of client data for treatment, billing, or other purposes must be done with explicit consent and with safeguards in place.

For example, if you're providing therapy via telehealth, it’s essential that the platform you use is HIPAA-compliant, ensuring it encrypts your clients' data to protect it from unauthorized access.

2. Healthcare plans

Healthcare plans, such as insurance companies, are also considered covered entities under HIPAA. While they don’t directly provide healthcare services, they handle PHI and must comply with the privacy and security rules of HIPAA. As a provider, you may need to share certain client information with insurance companies for billing or treatment purposes, but this must always be done securely and with the proper consent.

3. Healthcare clearinghouses

Healthcare clearinghouses process nonstandard health information, such as converting paper records into electronic formats. These entities play an essential role in simplifying administrative tasks like billing and payment processing. While you may not interact directly with a healthcare clearinghouse on a day-to-day basis, it's important to ensure they follow HIPAA guidelines when dealing with your clients' health data.

4. Business associates

Business associates are individuals or organizations that perform services for or on behalf of a covered entity and have access to PHI. This could include billing services, IT providers, or contracted administrative staff. Even though they are not directly providing therapy, if they handle or have access to your client’s data, they must comply with HIPAA.

For instance, if you work with an outside billing service, they must sign a Business Associate Agreement (BAA) ensuring they handle PHI in compliance with HIPAA regulations. This includes maintaining secure systems for storing and transmitting information.

5. Subcontractors

Subcontractors work under a business associate agreement and may also have access to PHI, meaning they must comply with HIPAA as well. For example, if your billing service hires a third-party contractor to manage patient records, that contractor is considered a subcontractor and must be HIPAA-compliant. Ensuring that subcontractors meet these standards protects your clients’ sensitive information from potential breaches.

6. Hybrid entities

Hybrid entities are organizations that are part healthcare provider and part non-healthcare provider. For example, a community health center that provides therapy services but also runs a wellness store is a hybrid entity. HIPAA applies only to the healthcare portion of the organization. It’s important to ensure that the non-healthcare parts of an organization are properly segmented and do not mishandle protected health information.

7. Researchers

In certain contexts, researchers may also be subject to HIPAA compliance if they are handling PHI as part of their studies. If a researcher collects mental health data for a study, they must ensure that the data is anonymized or protected to maintain confidentiality. This is particularly relevant in behavioral health research, where sensitive client information is often involved.

For example, if you're involved in research about treatment outcomes in therapy and need to access client records, you must ensure that the data is de-identified to comply with HIPAA’s privacy rule.