HIPAA does not apply to every person who provides hypnotherapy. Its application depends mainly on the provider’s legal status, the way the provider handles health information, and whether the provider conducts certain electronic health-care transactions.
Covered entities
HIPAA applies directly to three principal categories of covered entities:
Health plans
Health-care clearinghouses
Health-care providers that electronically transmit health information in connection with a transaction for which the U.S. Department of Health and Human Services has adopted a standard.¹
A hypnotherapist may therefore be a HIPAA-covered provider if the hypnotherapist is functioning as a health-care provider and electronically conducts covered transactions, such as electronic insurance claims, eligibility inquiries, claim-status inquiries, or authorization transactions.²
By contrast, a practitioner is not automatically a covered entity merely because the practitioner:
Uses email
Keeps electronic records
Has a website
Provides services related to mental health
Accepts payment by credit card
Uses a computer or electronic scheduling system
The important question is whether the practitioner electronically conducts a HIPAA-standard transaction. A provider can also remain a covered entity when a billing company or clearinghouse conducts the transaction on the provider’s behalf.³
Hypnotherapists who do not bill health insurance
Many independent hypnotherapists operate on a private-pay basis and do not submit electronic insurance claims or conduct other HIPAA-standard transactions. If such a practitioner is not otherwise part of a covered organization, HIPAA may not apply directly to the practitioner as a covered entity.
That does not mean that privacy obligations disappear. State professional-practice laws, consumer-protection laws, contracts, licensing rules, ethical standards, and other federal or state privacy requirements may still apply. In addition, a practitioner may choose to follow HIPAA-like safeguards as a matter of good privacy practice, even when HIPAA does not legally require it.
The legal question should be assessed carefully rather than answered solely from the title “hypnotherapist.” The same person could be outside HIPAA when operating an independent private-pay practice but subject to HIPAA when working for a covered clinic, hospital, physician practice, or other covered organization.
Business associates
A business associate is generally a person or organization that performs services for a covered entity and, in doing so, creates, receives, maintains, or transmits protected health information (PHI).⁴
Examples may include:
Billing and claims-processing companies
Outside transcription services
Certain attorneys, accountants, consultants, and administrators
Electronic-record or cloud-hosting companies that maintain PHI
Vendors that provide services involving a covered entity’s electronic PHI⁵
A covered entity generally must have a written business associate agreement with a business associate before allowing the business associate to handle PHI. The agreement must limit permitted uses and disclosures and require appropriate safeguards.⁶
A hypnotherapist working as an independent contractor for a covered clinic may therefore have HIPAA responsibilities even if the hypnotherapist does not personally submit insurance claims. Whether the practitioner is a workforce member, a business associate, or another type of contractor depends on the actual arrangement and the applicable regulations.
Electronic records and communication
HIPAA’s Security Rule applies to covered entities and business associates that create, receive, maintain, or transmit electronic protected health information, commonly called ePHI. It requires appropriate administrative, physical, and technical safeguards.⁷
For a hypnotherapy practice subject to HIPAA, this may involve safeguards for:
Electronic intake forms
Treatment records
Appointment systems
Email and messaging
Video-conferencing platforms
Cloud storage
Computers and mobile devices
Backups and access controls
Using an electronic system does not, by itself, determine whether the practitioner is a covered entity. If the practice is covered, however, the electronic system must be selected and used in a way that satisfies the applicable HIPAA requirements. A cloud provider that maintains ePHI for a covered entity will generally need to enter into a business associate agreement.⁸
Protected health information
HIPAA protects individually identifiable health information held or transmitted by a covered entity or business associate. The information may relate to a person’s:
Health condition
Provision of health care
Payment for health care
It may be written, electronic, or spoken.⁹
For a covered hypnotherapy practice, information such as a client’s name, appointment history, treatment documentation, symptoms, diagnosis, referral information, or payment information may be PHI if it is maintained or transmitted in the relevant covered-entity context.
Not every piece of information held by a covered entity is necessarily PHI. Information must meet the regulatory definition, including being individually identifiable and relating to health care, payment, or the individual’s health condition.
Psychotherapy notes
HIPAA provides special protection for psychotherapy notes. These are notes recorded by a mental-health professional documenting or analyzing the contents of a private counseling session, whether individual, group, joint, or family counseling, and kept separate from the rest of the medical record.¹⁰
The special category generally does not include:
Medication-prescription and medication-monitoring information
Session start and stop times
Treatment modalities and frequency
Clinical-test results
Summaries of diagnosis
Symptoms
Prognosis
Treatment plans
Functional status
Progress information¹⁰
A hypnotherapy note is not automatically a HIPAA psychotherapy note merely because hypnosis or hypnotherapy was used. The regulatory definition depends on the nature of the note, the professional context, and whether it is kept separately from the medical record.
When records do qualify as psychotherapy notes, a covered entity generally must obtain the individual’s written authorization before using or disclosing them. This is a more demanding rule than the ordinary HIPAA rules for many treatment, payment, and health-care-operations disclosures.¹¹
There are limited exceptions, including use by the originator for treatment, use for the originator’s training, certain legal proceedings, specified oversight activities, certain public-safety situations, and disclosures required by law.¹⁰
Ordinary clinical records are different
A treatment plan, progress note, diagnosis, symptom description, or summary of a session may be part of the ordinary medical record rather than a separately maintained psychotherapy-notes file. Such information can still be PHI and must be protected, but it does not necessarily receive the special psychotherapy-notes treatment.¹⁰
This distinction matters because the special authorization rule applies to records meeting the regulatory definition of psychotherapy notes—not to every mental-health record or every note written by a hypnotherapist.
Marketing and testimonials
HIPAA also restricts certain uses and disclosures of PHI for marketing. A covered entity generally must obtain an individual’s written authorization before using PHI to market a product or service, subject to regulatory exceptions.¹²
A covered hypnotherapy practice should be especially careful with:
Client testimonials
Before-and-after stories
Social-media posts
Client photographs
Reviews that identify a person as having received hypnotherapy
Case descriptions that could reasonably identify a client
A client’s public review does not necessarily give a covered provider permission to confirm the person’s status as a client or publicly discuss the person’s treatment. Written authorization should be obtained when HIPAA requires it, and the authorization should be specific enough to describe the information, purpose, and recipient.
State law and professional rules
HIPAA is a federal privacy floor, not a complete statement of every privacy obligation. State law may provide stronger protections for mental-health information, psychotherapy records, substance-use records, minors’ records, or communications between a client and a licensed professional.¹³
A hypnotherapist should therefore consider:
Whether the practice is a HIPAA covered entity.
Whether the practice is acting as a business associate.
Whether any employer or contracting clinic is a covered entity.
Whether the records contain ePHI.
Whether a vendor needs a business associate agreement.
Whether state law imposes additional privacy duties.
Whether the practitioner’s license or professional rules impose confidentiality obligations.
Bottom line
HIPAA does not automatically regulate every hypnotherapist. An independent, private-pay practitioner who does not conduct HIPAA-standard electronic transactions may not be a HIPAA covered entity. A hypnotherapist working for a covered clinic, electronically submitting covered transactions, or handling PHI for a covered organization may have HIPAA obligations.
For a covered hypnotherapy practice:
Protect PHI with appropriate safeguards.
Use business associate agreements when required.
Limit disclosures to permitted purposes.
Obtain written authorization when required.
Treat psychotherapy notes as a specially protected category when they meet the regulatory definition.
Check applicable state law and contractual requirements.
Because the answer can depend on the practice structure, billing arrangements, professional license, vendors, and state law, a practitioner with a specific compliance question should consult a qualified health-care attorney or privacy professional.
Notes
U.S. Department of Health and Human Services, “Summary of the HIPAA Privacy Rule,” Office for Civil Rights, 2013; 45 C.F.R. § 160.103.
U.S. Department of Health and Human Services, “Transactions and Code Sets,” Office for Civil Rights, 2003; 45 C.F.R. §§ 162.110–162.180.
U.S. Department of Health and Human Services, “Who Is a Covered Entity?,” Office for Civil Rights, 2003; 45 C.F.R. § 160.103.
U.S. Department of Health and Human Services, “Business Associates,” Office for Civil Rights, 2013; 45 C.F.R. § 160.103.
U.S. Department of Health and Human Services, “Business Associate Contracts,” Office for Civil Rights, 2013; 45 C.F.R. §§ 164.502(e), 164.504(e).
45 C.F.R. § 164.504(e); U.S. Department of Health and Human Services, “Business Associate Contracts,” Office for Civil Rights, 2013.
45 C.F.R. §§ 164.302–164.318; U.S. Department of Health and Human Services, “Security Standards for the Protection of Electronic Protected Health Information,” Office for Civil Rights, 2013.
U.S. Department of Health and Human Services, “Guidance on HIPAA & Cloud Computing,” Office for Civil Rights, 2013; 45 C.F.R. §§ 164.308(b), 164.314(a).
45 C.F.R. § 160.103; U.S. Department of Health and Human Services, “Summary of the HIPAA Privacy Rule,” Office for Civil Rights, 2013.
45 C.F.R. § 164.501; U.S. Department of Health and Human Services, “Psychotherapy Notes,” Office for Civil Rights, 2013.
45 C.F.R. § 164.508(a)(2); U.S. Department of Health and Human Services, “Uses and Disclosures of Psychotherapy Notes,” Office for Civil Rights, 2013.
45 C.F.R. §§ 164.501, 164.508(a)(3); U.S. Department of Health and Human Services, “Marketing,” Office for Civil Rights, 2013.
U.S. Department of Health and Human Services, “Preemption,” Office for Civil Rights, 2013; 45 C.F.R. §§ 160.202–160.205.