Does HIPAA apply to hypnotherapists?

HIPAA applies to a hypnotherapist only if you are a “covered entity”: a health care provider who sends health information electronically as part of a HIPAA transaction, such as an insurance claim. Most hypnotherapists in the US are paid directly by clients and never bill a health plan, so HIPAA usually does not apply to them. That does not make client records a free-for-all: state privacy laws, the FTC Act and your own written promises still bind you.

This post explains how to tell which side of the line you are on, which other rules may still apply, and what good practice looks like either way. It is not legal advice. Privacy law varies by state, and a lawyer who knows your state and your billing setup should make the final call.

What is a HIPAA covered entity?

The HIPAA rules apply to three kinds of organization. The regulation, 45 CFR 160.103, defines a covered entity as:

1. A health plan.
2. A health care clearinghouse.
3. “A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.”¹

The third one is the one that matters for you. It has two parts, and you need both to be covered.

Part 1: are you a health care provider?

The same section defines a health care provider broadly, as any person “who furnishes, bills, or is paid for health care in the normal course of business.” Health care includes “counseling, service, assessment, or procedure with respect to the physical or mental condition” of a person.¹ A hypnotherapist helping a client with anxiety, sleep or pain could well fit that definition. Assume you might.

Part 2: do you send HIPAA transactions electronically?

This is where most hypnotherapists drop out. A “transaction” under HIPAA is a specific list of electronic exchanges about the money side of health care:¹

HIPAA transaction	In plain words
Health care claims or encounter information	Billing an insurer for a session
Payment and remittance advice	The insurer telling you what it paid
Claim status	Checking where a claim is
Eligibility for a health plan	Checking a client’s coverage
Referral certification and authorization	Getting prior approval for treatment
Coordination of benefits, enrollment, premium payments and others	Mostly insurer and employer business

The CMS Covered Entity Decision Tool asks the same two questions in order. Does the provider furnish, bill or receive payment for health care in the normal course of business? Does it send any covered transactions electronically? If the answer to the second is no, the tool’s answer is “NOT a covered health care provider and therefore not a covered entity.”²

One detail catches people out. The tool’s notes say that if a provider uses another entity, such as a clearinghouse, to send transactions on its behalf, the provider is treated as sending them itself.² Hiring a billing service does not keep you outside HIPAA.

Why most cash-pay hypnotherapists are not covered entities

A typical solo hypnotherapist works like this:

• The client pays by card, cash or a payment link.
• No claim goes to an insurer.
• Nobody checks the client’s insurance eligibility.
• No billing service sends anything on the practice’s behalf.

None of those steps is a HIPAA transaction, so the second test fails. That practice is not a covered entity, and the HIPAA Privacy and Security Rules do not apply to it.

You may be covered, or should get advice, if any of these is true:

• You hold a license (LPC, LMFT, LCSW, psychologist, physician, nurse) and bill insurance for any client, even if hypnosis is only part of what you do.
• You or a billing service submit claims, check eligibility or request prior authorization electronically.
• You work inside a clinic, hospital or group practice that is a covered entity. Your records there are its records, and its rules apply.
• You plan to start billing insurance. Becoming covered later changes how you must handle the records you already hold, so plan before the first claim.

Superbills are a gray area worth one sentence. If you give a client a receipt and the client files their own claim, you have not sent a transaction yourself on a plain reading of the rule. If you file it for them electronically, you have. Ask your advisor before you rely on either reading.

If HIPAA doesn’t apply, what does?

Falling outside HIPAA removes one set of rules. Several others remain.

The FTC Act

The Federal Trade Commission says its Act applies to “companies that collect, use, or share health information that aren’t required to comply with HIPAA.” Section 5 of the Act forbids unfair or deceptive practices. The FTC’s guidance is direct: “Representations to consumers must be consistent with your practices and clear and conspicuous.”³

For a hypnotherapist, the practical risk is your own privacy notice. If your website says “your information is never shared” and you email intake forms to a third-party transcription service, what you do no longer matches what you promised. Write a privacy notice you actually follow. Our post on the hypnotherapy consent form covers what to put in it.

The FTC Health Breach Notification Rule

This rule is often mentioned in the same breath as HIPAA, so it is worth being precise. The FTC says it covers three kinds of business that HIPAA does not: vendors of personal health records, “PHR related entities,” and third-party service providers to them. A health app that syncs with a fitness tracker is the FTC’s example.⁴ A personal health record, in the FTC’s description, is an electronic record of identifiable health information that can draw on several sources and is managed mainly for the individual.

A practitioner’s own client file is not that kind of record, so the rule is unlikely to apply to a typical hypnotherapy practice. It could matter if you build and run your own client-facing health app. If you do, read the FTC page in full.

State laws

States are where most of the extra duties come from, and they differ. Some examples of what to look for:

• State consumer health data laws. Washington’s My Health My Data Act is the clearest example. It covers businesses that serve Washington consumers, including small businesses, and protects health data “that falls outside the ambit of” HIPAA.⁵ Under the Act, a regulated entity or small business “may not collect any consumer health data except” with the consumer’s consent for a specified purpose, or where the data is needed to provide a product or service the consumer asked for.⁶ Washington’s Attorney General says a violation can be enforced by the Attorney General and through private lawsuits.⁵
• Breach notification laws. States have their own rules on telling people when their personal information is exposed. Check your state’s rule, and the rules of the states your online clients live in.
• General privacy laws. California and other states give residents rights to know about, correct and delete personal data. Whether a small practice meets their thresholds depends on the law, so check each one that could apply.
• Licensing and record-keeping rules. If you hold a state license, your licensing board may set confidentiality and retention rules of its own.

If you see clients online, remember that the client’s state can matter as much as yours. See online hypnotherapy over Zoom for more on working across state lines.

What good privacy practice looks like anyway

Even when no law requires a specific safeguard, your clients are telling you about their health, their habits and sometimes their trauma. A leak would hurt them and your practice. These habits cost little and cover most of the risk.

Keep records in private storage

• Store intake answers, notes and recordings in a system with its own sign-in, not in a shared drive folder or your phone’s camera roll.
• Turn on two-factor sign-in wherever you keep client records.
• Never post a public link to a client recording. Use links that expire.

Keep client details out of email

Email is easy to misaddress and stays in inboxes for years. Send clients a link to a form instead of asking them to email health details. When you must email, leave out the presenting issue and anything clinical.

Example: “Hi Dana, your intake form for Thursday is ready. You can fill it in here: [link]. See you at 2:00 pm.” The email names no condition, and the answers never sit in either inbox.

Know who looked at what

An access log lets you answer “has anyone else been in my account?” with evidence rather than a guess. It also helps you spot a stolen password early. If your software keeps one, check it now and then.

A short checklist

• Client records live in one system with two-factor sign-in.
• Health details come in through forms, not email or text.
• Recordings are shared through expiring links.
• You can see a log of sign-ins and exports.
• Your written privacy notice matches what you actually do.
• You know how long you keep records and how you delete them.
• You have named someone to take over your records if you can’t practice.

Collecting less is the simplest safeguard of all. Our hypnotherapy intake form post covers what you need to ask and what you can leave out.

Where does Hypnocube stand on HIPAA?

Plainly: Hypnocube does not sign HIPAA Business Associate Agreements. A covered entity that lets a vendor hold protected health information needs that agreement in place. If you are a covered entity, or you work inside a covered practice, do not use it for protected health information. Use a system whose provider signs a BAA.

Hypnocube is built for the cash-pay practitioners this post describes, and it follows the habits above. Client files, recordings and attachments sit in private storage that has no public address and opens only through signed links that expire. Settings shows a log of sign-ins, failed sign-ins, password changes, exports and deletions, with the IP address and browser. Two-factor sign-in is available, and you are signed out after 3 hours without activity. Intake and consent forms go to clients as links, so their answers are not sent back and forth by email. The security page lists the details, and the privacy policy explains which providers process data and why.

None of that makes Hypnocube HIPAA compliant software, and we do not describe it that way. It means the records are handled with care for practices that HIPAA does not cover. If you are unsure which kind of practice you run, settle that first with the two questions above. If you are looking at tools more broadly, see hypnotherapy practice management software.

The short version

• HIPAA covers you only if you send claims or other HIPAA transactions electronically, yourself or through a billing service.
• Most cash-pay hypnotherapists don’t, so HIPAA doesn’t cover them.
• The FTC Act still requires you to keep your privacy promises, and state laws such as Washington’s My Health My Data Act can apply.
• The FTC Health Breach Notification Rule is aimed at health apps and personal health record vendors, not at a practitioner’s own client file.
• Good practice is the same either way: private storage, no health details by email, and an access log you actually check.

This is general information, not legal advice. Check your state’s rules, and the rules of the states your clients live in, with a lawyer who knows health privacy.

Footnotes

1. U.S. Code of Federal Regulations — 45 CFR 160.103, Definitions. Electronic Code of Federal Regulations, current. eCFR ↩ ↩² ↩³

2. Centers for Medicare & Medicaid Services — Covered Entity Decision Tool. CMS.gov, 2016. PDF. See also Are You a Covered Entity? ↩ ↩²

3. Federal Trade Commission — Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule. FTC Business Guidance, 2024. ftc.gov ↩

4. Federal Trade Commission — Complying with FTC’s Health Breach Notification Rule. FTC Business Guidance, 2024. ftc.gov ↩

5. Washington State Office of the Attorney General — Protecting Washingtonians’ Personal Health Data and Privacy. atg.wa.gov. atg.wa.gov ↩ ↩²

6. Revised Code of Washington — RCW 19.373.030, Collecting and sharing of consumer health data. Washington State Legislature. app.leg.wa.gov ↩