Is my physical therapy clinic a HIPAA covered entity?

Generally yes if you bill insurance, Medicare, or Medicaid electronically or check eligibility electronically, directly or through a billing service. The trigger in 45 CFR 160.103 is the electronic covered transaction. A purely cash-based practice that never files electronically may fall outside HIPAA, but confirm carefully, especially around Medicare-eligible patients, where PT billing rules can pull you back in.

I run a cash-based PT practice. Am I exempt from HIPAA?

Possibly, but be careful. If you never electronically transmit a covered transaction, you may not be a covered entity. However, PTs generally cannot privately contract out of Medicare, so seeing Medicare-eligible patients can drag you into electronic transactions. Document exactly whether and how you ever bill electronically, and confirm your status before assuming you're exempt. State privacy laws apply either way.

How do I handle records for workers' comp and physician referrals?

Disclosures to referring physicians for treatment are generally permitted, while releases to employers, workers'-comp insurers, and case managers usually require authorization and the minimum-necessary standard. Workers'-comp also has state-specific rules. Your policies and Notice of Privacy Practices should describe how these recurring outside requests are handled.

Does WebPT or Prompt being HIPAA-compliant cover my obligations?

No. Your EHR is a business associate that should sign a BAA and secure the ePHI it holds, but it doesn't provide your Notice of Privacy Practices, written policies, Security Risk Analysis, or breach procedure. The software manages clinical data; the compliance documentation layer is the practice's responsibility.

Made to order · Founding pricing · Built on HHS guidance

The HIPAA forms every physical therapy practice actually needs, in one place

Insurance-based PT clinics are generally HIPAA covered entities. Cash-based PT is the genuinely ambiguous case: never transmit a covered transaction electronically and you may fall outside HIPAA, but Medicare rules can pull a cash practice back in. HIPAA Binder builds every required document to order, including a written covered-entity determination for your exact billing setup, delivered within 30 days at founding pricing with a full refund anytime before then. You only enter your practice details, never any patient information.

Or see a sample, or jump to the documents and pricing.

What is inside the binder?

A covered PT practice is generally responsible for all of the following. Miss one and it tends to surface at the worst moment: an OCR complaint, a payer audit, or a workers'-comp records request you cannot fulfill.

Notice of Privacy Practices

The notice you must give patients and post in your clinic and online, written for a PT practice, not a hospital system.

45 CFR 164.520

Business Associate Agreements

Required with every vendor that can touch patient data: your EMR, billing service, clearinghouse, telehealth platform, cloud backup. Most clinics are missing at least one.

45 CFR 164.502(e)

Security Risk Analysis

The most-cited deficiency in OCR enforcement. It is required, it is annual, and it must cover every system your plans of care and outcome measures live in.

45 CFR 164.308(a)(1)(ii)(A)

Privacy & Security Policies

Your written rulebook for access, minimum-necessary use, and sanctions, including oral PHI and visible documentation on a shared gym floor.

Privacy & Security Rules

Patient-rights & authorization forms

Access, amendment, and release forms, built for the recurring requests PT generates: referring physicians, workers'-comp insurers, employers, and case managers.

45 CFR 164.508

Breach procedure & Privacy Officer docs

A breach-notification procedure and log, plus the Privacy/Security Officer designation. In a small clinic, that is you, and you need it on paper.

Breach Notification Rule

Why not just use the free HHS templates?

You can, and we cite them. But the free model documents are written for hospitals and every covered entity at once. They do not answer the cash-based PT question, they do not handle workers'-comp and referral disclosures, and they do not update themselves when the rules change. You are paying for documents customized to a physical therapy practice, complete, and kept current.

Am I even a covered entity?

It depends on your billing, not your title. Electronic claims or eligibility checks, directly or through a billing service, generally make you covered under 45 CFR 160.103. A deliberately cash-based practice that never files electronically may not be, but PTs generally cannot privately contract out of Medicare, so Medicare-eligible patients can pull you back into electronic transactions. Your binder includes a written covered-entity determination for your billing setup, so you stop guessing.

See the full covered-entity breakdown for physical therapists

Or read the guide: Do I need HIPAA forms for my physical therapy practice?

What is the best HIPAA compliance option for physical therapists?

It depends on your size, and the honest answer is that none of these three is right for everyone. A free generator is enough if a privacy notice is genuinely all you need. A subscription platform earns its price once you have coordination problems. In between sits the case we built for.

Free template versus compliance platform versus HIPAA Binder
What you need	A free template or generatore.g. NPP Generator	A compliance platforme.g. Compliancy Group, Accountable	HIPAA Binder
What you pay	Free, or a one-time fee for a single document	Recurring subscription, commonly in the low hundreds of dollars a month	One-time, with an optional annual refresh
How many of the required documents you get	Usually one, most often the Notice of Privacy Practices	The full set, generated inside the platform	The full set, written to your practice and state
Whether policies cite the rule that requires them	Rarely	Varies by platform	Every policy, so you can check it against the regulation
Built for your profession and state	Generic by design	Templated, with some profession presets	Made to order for both
What happens if you stop paying	You keep the file	Access typically ends with the subscription	You keep everything
Who it genuinely suits better	A practice that only needs a privacy notice and nothing else	Larger organisations with real coordination problems: distributing policies to dozens of staff, tracking training completions, managing long vendor lists	A solo or small practice that needs the documents proportionate to its size

We sell the third column, so read the first two with that in mind. The detailed vendor-by-vendor comparisons are on NPP Generator and compliance software, including when each is the better buy.

The binder is hand-prepared and customized to your physical therapistpractice, with the same documents, organized to your specialty’s records and vendors.

Made to order · Founding pricing: first 25 practices

Lock in founding pricing

Every document is made to order at locked-in founding pricing, built from your practice details and delivered within 30 days, with a full refund anytime before then. Each binder is built by hand, so founding pricing is limited to the first 25 practices; after that the Complete Binder is $249. Preview any document free before you decide.

Single document

$49one-time

Founding price · $79 after the first 25 practices

Just the one document you need, built for your practice.

Choose your document

Notice of Privacy PracticesBusiness Associate AgreementSecurity Risk Assessment

Instant: answer a short wizard, watch your document fill in live, and unlock the files for the same $49.

Built for your practice: profession, state, and billing setup shape every clause
Every policy cites the regulation that requires it
Editable Word + annotated PDF
See your finished notice before you pay
Instant download after checkout

Generate your NPP

The Complete Binder

Most complete

$129one-time

Founding price · $249 after the first 25 practices

Every HIPAA document a private practice needs, in one place.

Notice of Privacy Practices (current rules)
Covered-entity determination for your billing setup
BAA template + filled vendor table for your actual stack
Security Risk Analysis workbook + full policy set
Breach procedure: federal + your state's statute
Print-ready patient forms, annotated PDF, editable Word
Free revisions for 30 days after delivery

Order The Complete Binder

Binder + Always-Current

Stays current

$129+ $99/yr after 30 days

Founding price · $249 after the first 25 practices

The full binder, plus an annual refresh that keeps it current.

Everything in the Complete Binder
When a cited rule changes, we update the affected documents and send them to you
Every update comes with a note: what changed, why, and the citation
Annual refresh: every citation in your binder re-verified
Annual risk-assessment and training reminders
BAA tracker for your vendors
First year of updates starts 30 days after your order
Cancel anytime, the binder is yours

Order Binder + Always-Current

Opening a dental office? HIPAA + OSHA Binder Bundle: $299 $328 separately

Add the OSHA binder: exposure control plan, hazard communication, sharps and training documentation, every policy citing the regulation that requires it.

Founding price · $449 after the first 25 practices

Order both binders

Your documents are built to order and delivered within 30 days, with a full refund anytime before delivery. The subscription then keeps every document current as HIPAA rules change and reminds you when your annual risk assessment is due. Cancel anytime.

Questions physical therapists ask

Want to see what you are missing first?

Enter your email and we will send a preview of the physical therapist binder, so you can judge the quality before you pay a cent.