By DK, Riverd Founder. Last updated: 2026-10-21.
Does HIPAA apply to massage therapists? For most solo cash-pay LMTs, no: a massage therapist who never sends insurance claims or other covered transactions electronically is generally not a HIPAA covered entity. Your state licensing board's confidentiality rules almost certainly do apply, and those are the rules that shape day-to-day practice.
Below: a decision table by how you get paid, the situations that bring a solo practice inside HIPAA, the privacy baseline every practice should run either way, and what your state board likely requires on top.
This article is for informational purposes only and does not constitute legal advice. HIPAA and state confidentiality rules are jurisdiction-specific and change. Consult an attorney licensed in your state for specific guidance.
Does HIPAA apply to massage therapists?
HIPAA applies to a massage therapist only if the practice is a covered entity, which for a provider means transmitting health information electronically in connection with a covered transaction, such as sending a claim to a health plan. A solo LMT paid by cash, card, or HSA card who never bills a health plan electronically is generally outside HIPAA. State board confidentiality rules still apply to every licensed therapist.
The definition lives in 45 CFR 160.103. A covered entity is a health plan, a health care clearinghouse, or "a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter." The same section lists those transactions, and they are administrative and financial: health care claims, eligibility checks, payment and remittance advice, claim status, referral authorization, and similar exchanges with a health plan. The U.S. Department of Health and Human Services summarizes this on its covered entities and business associates page, and the Centers for Medicare and Medicaid Services publishes guidance on whether you are a covered entity.
A note for international readers: this post covers United States federal and state rules. If you practice in Canada, the United Kingdom, the European Union, or elsewhere, your privacy regime is different (PIPEDA, UK GDPR, GDPR, and others), and you should look up the rules where you practice.
Covered entity or not: a decision table by how you get paid
Find the row that matches how money reaches your practice. If more than one row applies, the strictest row wins.
| How you get paid | Covered entity under HIPAA? | What governs your records |
|---|---|---|
| Cash, card, Venmo, or similar, no insurance at all | Generally no | Your state board's confidentiality and records rules |
| HSA or FSA card, used as a payment card | Generally no, on its own | State board rules |
| Superbill you hand to the client, who files the claim | Generally no, because you do not transmit the claim | State board rules |
| Paper claims you mail to a health plan yourself | Generally no, because the claim is not electronic | State board rules; check again if you ever switch to electronic |
| Electronic claims to a health plan, sent by you or by a billing service or clearinghouse | Yes | HIPAA plus state board rules |
| Auto-injury (PIP or med-pay) or workers' compensation billing only | Possibly not, since these insurers are not "health plans" under HIPAA; confirm with an attorney | State rules, plus the insurer's own requirements |
| Working inside a clinic, chiropractic office, or hospital department that bills a health plan | Usually covered through that clinic's program or an agreement with it | The clinic's HIPAA program plus state board rules |
The auto and workers' compensation row surprises people. HIPAA's definition of a health plan excludes "excepted benefits" listed in 42 U.S.C. 300gg-91(c)(1), and that list includes workers' compensation and automobile medical payment insurance. So a practice that only bills those insurers may sit outside HIPAA. In practice, many LMTs who take auto-injury referrals also bill a health plan at some point, and the first electronic health plan claim changes the answer.
What makes a massage therapist a HIPAA covered entity?
A massage therapist becomes a HIPAA covered entity by transmitting health information electronically for a covered transaction, most often an insurance claim or an eligibility check sent to a health plan. That includes claims a billing service or clearinghouse sends for you. Employment by, or a contract with, a covered clinic usually brings you under that clinic's HIPAA program instead.
Four common paths bring a solo practice inside HIPAA:
1. You send claims to a health plan electronically. Billing a private health plan, Medicare, or Medicaid through an online portal or practice software makes you a covered entity for the whole practice, even if most of your schedule is cash-pay.
2. A billing service or clearinghouse submits claims for you. You never touch the claim file, and the result is the same: the claim is sent electronically on your behalf.
3. You work inside a covered entity. If you practice inside a physical therapy clinic, chiropractic office, or hospital outpatient department that bills a health plan, you are probably working under their HIPAA program as part of their workforce or under a written agreement with them. Ask the practice owner which applies to you.
4. You check eligibility electronically. Looking up a client's benefits through a health plan's portal is a covered transaction too, even before any claim is sent.
Combinations are where practices get caught out. A solo LMT who takes auto-injury referrals, uses a billing service for the occasional health plan claim, and rents a room one day a week inside a chiropractic office that bills Medicare is firmly inside HIPAA scope. If any one of these applies, treat your records the way HIPAA expects and write the decision down. Building the program once is easier than retrofitting it after a complaint.
Does taking an HSA or FSA card make me a covered entity?
No, not on its own. Accepting an HSA or FSA card is a way for a client to pay you. You are not sending a claim, an eligibility check, or any other covered transaction to a health plan when the card is swiped. If your card processor or a client's plan asks you for anything beyond the payment, ask the processor in writing what it is and whether it changes your status.
When you are unsure, treat your records as if HIPAA applied. A tight privacy routine costs a solo practice little, and getting it wrong after a complaint costs a lot.
What privacy steps apply whether or not HIPAA covers you?
Every massage therapist, covered or not, should keep digital records encrypted and access-controlled, give clients a written confidentiality policy at intake, keep records for the period your state board sets, and have a short plan for a lost laptop or a compromised account. If HIPAA applies, add Business Associate Agreements with every vendor that handles client health information.
Here is the working checklist:
- Encrypted storage for digital client records. Ask any software vendor two questions: is data encrypted in transit and at rest, and will you sign a Business Associate Agreement if HIPAA applies to me? Turn on full-disk encryption on your own laptop (FileVault on macOS, BitLocker on Windows).
- Access control. Client notes should sit behind your own sign-in, and anyone on your staff should have their own. A device the whole family uses is not access control.
- A written confidentiality policy clients sign at intake. One page in plain language: what you collect, who can see it, how long you keep it, and how a client can request a copy.
- Records retention set by your state board. Look up your board's number, which is often several years from the last session and longer for minors. See client records retention for a solo practice for how to work it out.
- A breach response plan. For a solo practice, one paragraph is enough: who you call if a laptop is lost or an account is compromised, what you tell affected clients, and by when.
- Business Associate Agreements with vendors that handle client health information. Required if HIPAA applies to you, and a useful question to ask any vendor even if it does not.
Two items deserve a closer look. Records retention is the one solo LMTs most often get wrong, because the clinical number comes from your state, not from HIPAA. HIPAA's own six-year rule in 45 CFR 164.316(b)(2) covers HIPAA documentation such as policies and procedures, which is a different thing. The breach plan is the other item that gets skipped, because it sounds bigger than it is. Name the device, the account, the client list, and the notification timeline, then walk through it once a year. For more on the everyday side, see protecting client privacy in a solo practice and calendar privacy for wellness providers.
What practice software can and cannot do here
Software handles the technical controls. You still run the privacy program: the retention decision, the confidentiality policy, and the breach plan are yours. No software makes a practice HIPAA compliant by itself, whatever its marketing says.
On Riverd, your clients, your notes, and your bookings belong to your account. No other practitioner on Riverd can reach them, and that separation is enforced by the database itself. A client who signs in to book or to view their own appointments cannot open your session notes or your private client notes. Riverd's website and app load only over an encrypted connection, and your records sit on encrypted storage at our database provider. If you use Riverd's AI, for example to format a note as SOAP, the text you give it goes to an outside AI provider for that task. You sign in with a text code, an email link, or Google, so there is no password to steal, and you can ask us to export your data or delete it.
Riverd is not a HIPAA-covered entity and does not sign Business Associate Agreements. If HIPAA applies to your practice, talk to a compliance advisor before you store client health information in any tool that will not sign one, Riverd included. The details are on Riverd's security and privacy page, and Riverd for massage therapists covers the rest of the product.
State board rules: what your license actually requires
This is the part most solo LMTs skip and later regret. Every state's massage board sets its own confidentiality and records rules, and they apply to your license whether or not HIPAA does. Some states also have health privacy laws that can reach a practice HIPAA does not, such as Texas's medical records privacy law (Health and Safety Code chapter 181), so check your state's law as well as your board's rules.
The Federation of State Massage Therapy Boards publishes a Model Practice Act that many boards adapt. It covers client records, confidentiality, and when records can be released. Read your own board's statute and rules; the model act is a starting point.
Some examples. The California Massage Therapy Council sets CAMTC standards of practice and ethics for certified massage therapists, including client confidentiality and when records can be released. The Texas Department of Licensing and Regulation publishes massage therapy program rules that include client record requirements and written consent for disclosure. The Florida Board of Massage Therapy publishes its statutes and rules. Retention periods, release conditions, and required intake disclosures vary by state, so read your own board's rules.
If a rule reads as ambiguous, call the board and ask. Board offices will usually answer plain-language questions about confidentiality, retention, and records release, and many publish FAQ pages. Write down the answer, the date, and the name of the person you spoke with. That note is exactly what you want in front of you if a complaint ever arrives.
A related habit: write SOAP notes that make sense to any reader who is allowed to see them. For a refresher, see how to write SOAP notes faster or try the free SOAP note generator. The Massage Therapy Complete Practice Guide collects the operational side in one place, and the compliance hub lists every post on this topic.
Key Takeaways
- HIPAA applies to a massage therapist only if the practice transmits a covered transaction electronically, most often a claim or eligibility check sent to a health plan.
- Cash, card, and HSA or FSA payments alone do not make you a covered entity; auto and workers' compensation billing may not either, so confirm your case with an attorney.
- Encrypted records, access control, a written confidentiality policy, state-board retention, and a short breach plan are the baseline either way.
- State board confidentiality rules bind every licensed therapist, so read your own board's statute and rules.
Ready to simplify your practice? Start Free →
