Is my practice actually covered by HIPAA?

Short answer: it depends on whether you send health information electronically in connection with certain standard transactions. Not on your license, not on your diagnosis, and not on the fact that you keep clinical records.

I am Scott Derby, I am an attorney, and this is the question almost nobody asks before they start buying compliance products. It is worth two minutes, because the answer surprises a lot of people.

HIPAA does not apply to everyone who holds health information. It applies to what the law calls covered entities. For a provider, that generally means you become covered when you send health information electronically in connection with certain standard transactions. Think electronic insurance claims, eligibility checks, or claim status inquiries.

Notice what is not on that list. Not your diagnosis. Not your license. Not the fact that you keep clinical records. Whether your practice becomes a covered entity generally turns on those transactions, not on the fact that you provide therapy.

So a private pay practice that conducts none of those transactions may fall outside HIPAA, while a practice that submits electronic claims, or has a billing service submit them on its behalf, is generally covered. That second half matters. Someone else doing it on your behalf still counts.

Now here is the part I do not want you to hear wrong. Being outside HIPAA does not mean your clients have no privacy protection. It means their protection comes from somewhere else: state privacy and confidentiality laws, licensing board rules, and professional ethics codes. Sometimes those rules are stricter than HIPAA.

So the answer is not that you can stop being careful. It is that you should find out which rules actually apply to your practice before you spend a dollar solving for the wrong ones.

This is general information about federal HIPAA. It is accurate as of writing and it can change. Your state very likely has its own privacy rules that sit on top of HIPAA and can be stricter, so treat this as a starting point rather than the final word, and check what applies where you practice. This is education, not legal advice for your specific situation.