Short answer: Usually it does not. HIPAA covers a provider only if it, or a billing company working for it, sends standard insurance transactions such as claims or eligibility checks electronically. A practice that is paid only by patients and sends none is generally not covered, but state privacy laws and the FTC still apply.
By Lu Haj, founder of HelpCo AI · Last updated
Checked against guidance from HHS (the federal health department) and the FTC (the Federal Trade Commission), plus the text of the state laws. General information, not legal advice.
Most owners who ask "does HIPAA apply to cash-only practices" hope the answer is no. Often it is, but "not covered" does not mean "no rules."
HIPAA covers a provider only if the practice, or a billing company working for it, sends standard insurance transactions electronically. HHS says that applies to every provider "regardless of size," and sending even one claim is enough (HHS; CMS). If you take only cash and cards and send nothing to insurers, you are generally not covered.
Not sure? Run the 5-question check in Does my practice need to be HIPAA compliant?
A superbill is an itemized receipt that a patient sends to their own insurer to ask for reimbursement. Because the patient sends it, the practice is not sending a claim, so handing out superbills generally does not make a practice covered.
That is an application of the general rule, not a rule written for superbills, so confirm it with a healthcare attorney. The answer changes if your staff, or a billing company, submits claims or eligibility checks for your patients.
Treatments by licensed nurses and physicians create medical records, so state law can reach a med spa or IV therapy clinic even when HIPAA does not. Three examples:
The Federal Trade Commission (FTC) says its ban on unfair or deceptive practices applies to businesses that HIPAA does not cover. It says that sharing health information for advertising without a person's clear consent may be an unfair practice, and it warns against claiming to be "HIPAA compliant" unless that is true (FTC).
If that day comes, read Covered by HIPAA? 5 First Steps for a Small Practice.
Please do not put patient information in any form, chat, or voicemail on this website.
Usually it does not. A provider is covered only if it, or a billing company for it, electronically sends standard insurance transactions such as claims or eligibility checks. A practice paid only by patients that sends none is generally not covered. State privacy laws still apply.
Generally it does not. A superbill is an itemized receipt the patient sends to their own insurer, so your practice is not transmitting a claim. If your staff or a billing company submits claims or eligibility checks for patients, that can make you covered. Ask a healthcare attorney.
A med spa needs to follow HIPAA only if it, or a billing company for it, electronically sends insurance claims or eligibility checks. Many cash-only med spas are not covered. But licensed clinicians create medical records, so state law can apply regardless. Confirm with a healthcare attorney.
Book a free 15-minute call. We will walk through the setup and the Business Associate Agreement. You do not need to share patient information.
Book a Free 15-min Demo