Does My Practice Need to Be HIPAA Compliant?

By Lu Haj, founder of HelpCo AI · Last updated October 14, 2026

Checked against guidance from HHS (the federal health department) and CMS (the federal Medicare agency), plus the rule text. General information, not legal advice.

Most owners who ask "does my practice need to be HIPAA compliant" expect a yes. The law cares about billing, not treating patients.

What makes a practice a covered entity?

HIPAA applies to "covered entities," the law's term for the organizations it governs. A practice is one if it is a health care provider that sends certain insurance transactions electronically (45 CFR 160.103). If you treat patients, you are a provider, so the sending is what matters.

HHS says every provider "regardless of size" that sends those transactions electronically is covered, even when "a billing service or other third party" does the sending (HHS; CMS). Sending just one is enough.

Once you are covered, HIPAA protects all of your patients' identifiable health information, which it calls protected health information (PHI). That includes your cash-pay patients, not only the insured ones (HHS).

Which transactions make you a covered entity?

These are the standard electronic transactions (CMS; 45 CFR Part 162):

Claims: requests for payment
Eligibility checks: asking if a patient has coverage
Claim status requests: asking where a claim stands
Referral certification and authorization: asking a plan to approve care in advance
Payment and remittance advice: the plan's payment and explanation of benefits
Coordination of benefits: deciding which plan pays first
Enrollment and disenrollment: signing someone up for a plan or dropping them
Health plan premium payments: payments to a health plan for coverage

E-prescribing standards, the rules for sending prescriptions electronically, also include electronic eligibility checks (CMS). Ask your software vendor whether your system runs them.

Does HIPAA apply to my practice? Five examples

Cash-only med spa with a medical director. It is probably not covered, but state law can still apply (see our cash-only guide).
Cash-only IV therapy clinic. The answer is the same as for the med spa.
Nurse practitioner who sends one electronic insurance claim a month. This practice is covered. Sending just one claim is enough, and HIPAA then protects every patient record.
Practice that only gives patients superbills. The patient sends a superbill, an itemized receipt, to their own insurer, so the practice is generally not covered. Confirm that with an attorney, and see our cash-only guide.
Dental practice whose billing company sends claims electronically. This practice is covered, because you are treated as sending whatever your billing company sends for you (CMS). The company is your "business associate," a vendor that handles patient information for you, and you need a signed Business Associate Agreement (BAA), a contract requiring it to protect that information (HHS).

Does my practice need to be HIPAA compliant? A 5-question check

Do you provide, bill, or get paid for health care?
Do you or your software send claims, eligibility checks, or requests for insurer approval electronically?
Does a billing company or your practice software send any of those for you?
Does a tool you use, such as e-prescribing software, run insurance eligibility checks?
Will you bill insurance, or hire a billing company, in the next year?

If you answered yes to question 1 and yes to any of questions 2, 3, or 4, you are very likely covered. If you answered yes only to question 5, plan ahead. Otherwise, you are probably not covered today. A healthcare attorney can confirm.

What should I read next?

If you are not covered, read Does HIPAA apply to cash-only practices? for the state laws that still apply. If you are covered, read Covered by HIPAA? 5 First Steps for a Small Practice.

How HelpCo AI handles it

HelpCo AI builds an AI Receptionist, texting, and website chat for healthcare practices as a HIPAA-compliant setup. We sign a Business Associate Agreement and use only vendors that also sign BAAs. HHS does not certify anyone as HIPAA compliant, so we never claim a certification. See our HIPAA page and how compliance works, or book a free 15-minute call.

Please do not put patient information in any form, chat, or voicemail on this website.

Frequently asked questions

What is a covered entity?

A covered entity is an organization that HIPAA applies to directly: a health plan, a clearinghouse (a company that converts claims into a standard electronic format), or a health care provider that sends standard insurance transactions electronically. For a practice, the provider test is the one that matters.

Does a billing company make my practice a covered entity?

Yes, if the billing company sends your claims or eligibility checks electronically. CMS says a provider that uses another entity to send covered transactions on its behalf is treated as sending them itself. The billing company becomes your business associate, so you also need a signed Business Associate Agreement.

Is my practice covered if it bills insurance only once a month?

Yes, if it sends even one standard transaction, such as a claim, electronically. HHS says every provider, regardless of size, that does so is covered. Once you are covered, HIPAA protects all of your patient information, including the records of your cash-pay patients.

Not legal advice. The answer depends on your facts and your state. For a definitive answer, ask a healthcare attorney. HelpCo AI is not a law firm.

Sources

HHS: Covered Entities and Business Associates; Summary of the Privacy Rule; Business Associates; Misleading Marketing Claims
CMS: Are You a Covered Entity?; Covered Entity Decision Tool (PDF); E-Prescribing Standards
Federal rules: 45 CFR 160.103; Part 162

Does my practice need to be HIPAA compliant?