Question 1

Do all healthcare practices need a HIPAA Risk Analysis?

Accepted Answer

Yes, if the practice is a HIPAA covered entity or business associate. The HIPAA Security Rule at 45 CFR 164.308(a)(1)(ii)(A) requires every covered entity and business associate, regardless of size or specialty, to conduct an accurate and thorough Risk Analysis of the risks and vulnerabilities to electronic PHI. Solo dentists, single-provider therapy practices, chiropractic offices, med spas that bill insurance, and telehealth providers are all in scope. OCR cites missing or stale Risk Analyses in resolution agreements year after year. The analysis must be documented, updated when systems or workflows change, and feed directly into the Risk Management plan under 45 CFR 164.308(a)(1)(ii)(B).

Question 2

Are telehealth platforms HIPAA-compliant?

Accepted Answer

A telehealth platform is HIPAA-compliant only if the vendor signs a Business Associate Agreement and implements the safeguards required by the HIPAA Security Rule (45 CFR Part 164, Subpart C). HHS ended its COVID-era enforcement discretion on non-compliant video tools in August 2023, so platforms like consumer Zoom, Skype, or FaceTime are no longer acceptable for telehealth. Compliant options include Zoom for Healthcare, Doxy.me, SimplePractice, and other vendors that will sign a BAA and document their administrative, physical, and technical safeguards. The covered entity is still responsible for conducting its own Risk Analysis covering the telehealth workflow and training staff on secure use.

Question 3

Are tracking pixels on patient portals a HIPAA violation?

Accepted Answer

They often are. OCR issued a bulletin in December 2022 (updated March 2024) clarifying that online tracking technologies like Meta Pixel, Google Analytics, and ad pixels can transmit protected health information to third parties when used on patient portals, appointment scheduling pages, or even unauthenticated pages that address specific health conditions. If the third party receives PHI without a Business Associate Agreement, that disclosure is impermissible under 45 CFR 164.502. Multiple hospital systems have faced class-action lawsuits and OCR scrutiny over Meta Pixel deployments. Practices should audit every tracking script on patient-facing pages and remove or replace any that cannot be covered by a BAA.

Question 4

What HIPAA rules apply specifically to dental practices?

Accepted Answer

Dental practices that transmit any health information electronically in connection with a HIPAA-covered transaction (claims, eligibility, referrals, treatment authorization) are covered entities and must comply with the full HIPAA Privacy, Security, and Breach Notification Rules. There is no dental-specific carve-out. Common dental practice gaps include: missing or stale Risk Analyses, unencrypted laptops and backup drives, Business Associate Agreements never executed with cloud-based practice management or imaging vendors, and Notice of Privacy Practices that are out of date. OCR has fined dental practices for Right of Access failures, social-media disclosures of patient information, and unauthorized PHI postings in response to online reviews.

Question 5

Do mental health practices have stricter privacy rules?

Accepted Answer

Yes in two respects. First, HIPAA itself provides extra protection for psychotherapy notes (45 CFR 164.508(a)(2)), which require specific patient authorization for most uses and disclosures and do not have to be released under the Right of Access. Second, the federal substance use disorder regulations at 42 CFR Part 2 impose much stricter restrictions on records from federally assisted SUD treatment programs, including consent requirements, redisclosure prohibitions, and patient notice. Many state laws (California, New York, Illinois, and others) also add mental health record protections that exceed HIPAA. Practices should map which records fall under each regime and train staff on the differences. North Privacy Advisors helps mental health practices align HIPAA, Part 2, and state law requirements.

Question 6

What is a HIPAA covered entity?

Accepted Answer

Under 45 CFR 160.103, a covered entity is one of three things: a health plan, a health care clearinghouse, or a health care provider who transmits any health information electronically in connection with a transaction for which HHS has adopted a standard (such as claims submission, eligibility verification, or referral authorization). Most physician practices, dental offices, mental health providers, chiropractors, optometrists, podiatrists, and hospitals become covered entities the moment they bill electronically. A purely cash-only practice that never submits an electronic transaction may technically fall outside HIPAA, but state laws like California's CMIA or New York's SHIELD Act often impose parallel duties, and most practices end up in scope anyway.

Data Privacy Guidance by Healthcare Specialty

All articles in this topic

HIPAA Compliance for Telehealth Practices: BAAs, Pixels, and State Rules

OCR Is Now Targeting Parental Access to Children's Records. Here Is What Pediatric Practices Need to Check.

Texas Mental Health Practices and HIPAA: The Tracking Code Gap

Houston Dermatology Practice Owners: Your HIPAA Tracking Pixel Risk

HIPAA Risk Analysis for Small Dental Practices in Houston: A Local Owner's Guide