What Does HIPAA Compliance Mean for a Small Therapy Practice?

For a small therapy practice, HIPAA compliance is not a single form, software subscription, or one-time project. It is an ongoing process for understanding where protected health information (PHI) exists, deciding how to protect it, documenting those decisions, and reviewing them as the practice changes.

This overview is educational and is not legal advice. HIPAA applicability and the measures appropriate for a practice depend on its activities, systems, vendors, risks, and applicable state law.

First, confirm whether HIPAA applies to the practice

HIPAA applies to covered entities and their business associates. Health care providers are covered entities when they transmit health information electronically in connection with certain standard transactions. A vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity may be a business associate.

This distinction matters: do not assume that every therapist, app, or wellness service has the same obligations. Start by documenting how the practice bills, exchanges information, and works with third parties. The HHS overview of covered entities and business associates is a useful starting point.

Build the program around a risk analysis

The HHS Office for Civil Rights describes risk analysis as foundational to Security Rule compliance. The analysis should account for all electronic PHI the organization creates, receives, maintains, or transmits—not only the electronic health record.

For a small practice, that inventory may include:

laptops, phones, removable media, and office workstations;
email, messaging, telehealth, scheduling, and billing systems;
cloud storage, backups, and electronic health records;
team members, contractors, and vendors who can access electronic PHI; and
the physical locations and networks used to access those systems.

After identifying threats and vulnerabilities, document the safeguards already in place, prioritize remaining risks, assign responsibility, and record the work completed. HHS notes that the Security Rule does not prescribe one universal risk-analysis method; the approach should fit the organization’s size, complexity, capabilities, and environment. Review the official HHS risk-analysis guidance for the required scope and elements.

Put administrative, physical, and technical safeguards into practice

A useful compliance plan connects written policies to daily behavior. Depending on the practice’s risk analysis, work may include assigning security responsibility, training team members, controlling access, planning for emergencies, protecting devices and workspaces, maintaining backups, and reviewing how electronic PHI is transmitted.

Small does not mean exempt. It does mean the Security Rule allows a covered entity to consider its size, capabilities, costs, and risks when selecting reasonable and appropriate measures. HHS provides additional Security Rule guidance for small providers.

Map every service that may handle PHI and determine whether a business associate agreement is required. A contract alone is not a security review: understand what the vendor does with the information, who can access it, how incidents are reported, and what happens to the data when the relationship ends.

Repeat the review when the practice adopts a new platform or materially changes how an existing tool is used.

Prepare for incidents before one happens

Create a clear internal path for reporting lost devices, misdirected messages, unauthorized access, malware, and other suspected incidents. Preserve relevant facts and involve qualified privacy, security, and legal professionals when an incident may involve PHI.

The HIPAA Breach Notification Rule can require notification after a breach of unsecured PHI. Whether notification is required depends on the facts and the applicable analysis, so avoid making that decision informally. Consult the official HHS Breach Notification Rule overview.

This video from the verified HHS Office for Civil Rights channel introduces the Security Rule and the need for a compliance plan.

If the embedded player is unavailable, watch the video on YouTube.

A practical next step

Choose one person to coordinate the work and begin with a documented inventory of systems, devices, people, and vendors that interact with PHI. From there, perform the risk analysis, create a prioritized remediation plan, and set dates for review. Keep evidence of decisions, training, assessments, contracts, and completed safeguards.

You can browse all Holveda articles or book a free discovery call to discuss the questions specific to your practice.