Which professions are HIPAA covered entities?

A health care provider becomes a HIPAA covered entity by transmitting any health information electronically in connection with a HIPAA covered transaction (45 CFR 160.103): filing electronic claims, checking eligibility, or receiving electronic remittance. The trigger is the electronic transaction, never the job title. A practice that never transmits one is generally not covered.

Researched and written by Larry Osakwe · Last verified July 15, 2026

Checked against 45 CFR 160.103 and CMS guidance. Not a lawyer, not a certified compliance professional, and not affiliated with HHS.

How we research this Report an error

The covered-entity decision table, by profession

Typical status for each field, what actually triggers it, and the trap that most often catches that profession. Every row reduces to the same test: does a covered transaction ever move electronically, by you or for you?

Profession	Typical status	What triggers it	Common trap
Dentist	Almost always covered	Electronic dental claims, eligibility checks, or claim attachments (X-rays sent to payers)	An all-paper office is still covered if its billing service or clearinghouse converts its claims to electronic form.
Physical therapist	Usually covered	Electronic claims to insurance, Medicare, or Medicaid	Cash-based PTs generally cannot privately contract out of Medicare, so Medicare-eligible patients can pull the practice back into electronic transactions.
Therapist / counselor	Usually covered	Electronic claims or eligibility checks, directly or via a clearinghouse	Joining your first insurance panel flips your status; handing clients a paper superbill to self-submit does not.
Psychologist	Usually covered	Electronic claims, eligibility verification, or electronic remittance	A billing service that files electronically on your behalf makes you covered, even if you never touch the software.
Chiropractor	Usually covered	Electronic claims to insurers or Medicare (which covers spinal manipulation)	A cash or membership practice can still be covered if its EHR or billing service transmits even one covered transaction.
Optometrist / eye care	Almost always covered	Electronic vision-plan claims (VSP, EyeMed) or medical-insurance claims; either channel counts	Assuming vision-plan-only billing doesn't count. Filed electronically, it does.
Massage therapist	Often NOT covered	Electronically billing health insurance (rare in cash practices)	HSA/FSA cards and SOAP notes do not trigger HIPAA; working inside a clinic that bills insurers for you does.
Dietitian / nutritionist	Often NOT covered: it depends	Filing claims or running eligibility checks electronically, directly or via a billing service	An EHR that auto-submits claims or eligibility pings can flip your status without an obvious decision point.
Med spa	It depends	Billing a health plan electronically for any medical service the practice provides	The 'spa' branding is irrelevant. If any covered transaction moves electronically, the practice is covered; a purely cash med spa generally is not.
Cash-only / no-insurance practice	Generally NOT covered	Nothing, so long as no covered transaction is ever transmitted electronically by you or for you	One electronic claim or eligibility check, including by a billing service, makes you a covered entity, and the rules then cover all your patient information in any form.

Typical statuses, not determinations. CMS publishes a Covered Entity Decision Tool (PDF) you can walk for your own practice; when in doubt, ask an attorney.

Does using a billing service make me a covered entity?

Often, yes: this is the trap that catches “paper only” practices. Per CMS guidance, a provider whose paper claims are submitted to a billing service or clearinghouse that converts them into standard electronic transactions and transmits them to a health plan IS a covered entity. The electronic transmission on your behalf counts as yours.

The same guidance draws the other line: a provider who sends paper claims directly to a health plan, where the plan itself converts them to electronic form to process payment, is NOT a covered entity on that basis. Who converts and transmits the claim is the whole question, which is why your billing arrangement, not your specialty, decides your status.

Under 45 CFR 160.103, billing and claims processing are core business-associate functions, and a covered transaction transmitted electronically by anyone acting for you triggers the covered-entity definition. Educational, not legal advice; confirm your own arrangement.

The cash-only nuance: outside HIPAA is not outside the law

A truly all-cash practice that never transmits a covered transaction electronically is generally not a covered entity, and none of the HIPAA document requirements technically bind it. But three caveats keep this from being a free pass. First, state privacy and medical records laws, plus professional-board confidentiality rules, apply regardless of HIPAA status, and are often stricter. Second, many “cash” practices trip the test without noticing, through an EHR that runs eligibility checks or a billing service that files the occasional claim.

Third, the switch effectively flips one way. Transmit a single covered transaction electronically and the practice meets the covered-entity definition, and HIPAA then protects its patient information in every form, paper and conversation included, not just the electronic claim. The regulation defines no procedure for shedding covered-entity status afterward, so the conservative reading, and ours, is to treat one electronic claim as a permanent commitment and document your status either way.

Are dentists covered by HIPAA?

Almost always. A dental practice becomes a covered entity the moment it transmits any covered transaction electronically, and nearly every office files electronic claims, checks eligibility electronically, or sends claim attachments. Even an all-paper office is covered when its billing service or clearinghouse converts its claims to electronic form.

HIPAA forms for dentists

Are physical therapists covered by HIPAA?

Generally yes. Most PT clinics bill insurance, Medicare, or Medicaid electronically, which makes them covered entities. A deliberately cash-based PT who never transmits a covered transaction may fall outside HIPAA, but PTs generally cannot privately contract out of Medicare, so Medicare-eligible patients can pull a cash practice back into electronic billing.

HIPAA forms for physical therapists

Are therapists covered by HIPAA?

Usually. A therapist, counselor, or clinical social worker who bills insurance electronically, verifies benefits electronically, or uses a clearinghouse is generally a covered entity. A strictly private-pay therapist who only hands clients superbills to self-submit is generally not, though state mental-health confidentiality laws still apply either way.

HIPAA forms for clinical social workers

Are chiropractors covered by HIPAA?

Generally yes. Chiropractic billing is heavily insurance-driven, and Medicare covers manual spinal manipulation, so most chiropractors transmit electronic claims and are covered entities. A genuine cash-only or membership practice that never files electronically, and gives patients only paper superbills, may fall outside HIPAA. Confirm before assuming.

HIPAA forms for chiropractors

Are optometrists covered by HIPAA?

Almost always. Most optometrists electronically bill vision plans, medical insurance, or both, and either channel filed electronically makes the practice a covered entity. A purely retail optical shop that never transmits a covered transaction could fall outside the test, but that is unusual for a practice that examines patients.

HIPAA forms for optometrists

Is a cash-only practice covered by HIPAA?

Generally no. A practice that never transmits a covered transaction electronically, by itself or through anyone acting for it, does not meet the covered-entity definition. But state privacy laws and professional-board rules still apply, and a single electronic claim or eligibility check changes the answer, after which HIPAA covers all the practice's patient information in any form.

Covered? Here’s what your practice needs next

If your practice is (or should operate as) a covered entity, the document set is the same nine items for every field. See exactly what goes in a HIPAA binder, generate your Notice of Privacy Practices, read the full definition of covered entity in the glossary, or start from your profession:

Psychologists Dentists Chiropractors Massage Therapists Physical Therapists Optometrists Dietitian / Nutritionists Speech-Language Pathologists Acupuncturists Occupational Therapists Clinical Social Workers Podiatrists

Sources

Last verified July 15, 2026. Educational self-help information, not legal advice and not a covered-entity determination for any specific practice. Statuses above are typical patterns for each profession; your practice’s status turns on its actual billing arrangements. Confirm with the HHS/CMS resources above and, where appropriate, a qualified attorney. State law may add stronger requirements.

Covered entity? Get every required document, done for you

The complete nine-document binder, built to order for your practice and state, with every policy citing the rule that requires it.

See the binder and pricing