Yes, chiropractors must follow HIPAA if the practice sends even one insurance claim, eligibility check, or other standard transaction electronically. That counts even when a billing service sends it for you. A cash-only practice that never does this can fall outside HIPAA. State privacy laws and board confidentiality rules still apply.
Chiropractic has one HIPAA question that comes up again and again: "I run a cash practice, does any of this even apply to me?" It is a fair question with a real answer, and the answer is a test, not a slogan. This article runs the test, then covers the compliance issues that are distinctly chiropractic: the testimonial wall, the personal injury attorney fax, the open adjusting bay, and the X-ray folder.
HIPAA Compliance for Chiropractors: Who Is Actually Covered
The Cash-Practice Test
HIPAA does not cover every healthcare provider. It covers providers who transmit health information electronically in connection with the standard transactions: claims, eligibility checks, claim status, remittance. Bill insurance electronically, even once, even through a billing service, and you are a covered entity. Full stop.
A pure cash practice that never runs an electronic standard transaction, no claims, no eligibility pings, no superbills submitted on the patient's behalf, can genuinely sit outside HIPAA. But three cautions before anyone celebrates. First, the test is fragile: one staff member submitting one electronic claim flips your status, and verifying eligibility electronically counts. Second, providing superbills that patients submit themselves does not trigger it, but the moment your software submits for them, it does. Third, sitting outside HIPAA is not sitting outside privacy law: state medical privacy statutes, board confidentiality rules, and ordinary negligence liability all still apply, a distinction covered in the covered entity definition guide. Run the test honestly, write down the result and the reasoning, and re-run it when your billing changes.
The Testimonial Wall
Chiropractic marketing loves patient stories, and that is where this specialty gets burned. A testimonial with a name and outcome, a before-and-after post, a Google review response that confirms someone is a patient: all disclosures of PHI (Protected Health Information), and all requiring written authorization, not verbal enthusiasm. The authorization needs the elements in the authorization requirements guide, and "they posted the review themselves" does not authorize your reply; the front desk rules cover the review-response trap in detail.
Personal Injury and the Attorney Fax
Chiropractic offices get a lot of attorney record requests, because motor vehicle and injury cases run through your notes. The rule: a signed patient authorization that meets 45 CFR 164.508 gets the records; a bare attorney letterhead request does not. Before anything leaves the office, check the authorization. It needs every required part.
That includes which records, who gets them, and why. It also needs an expiration date and the patient's signature and date. Some releases in PI work are defective, which means a required part is missing or the date has passed. If you send records on one, that is your violation, not the attorney's.
Open Adjusting Bays and the Floor
Multiple tables in one room follow the same rules as any shared treatment space: incidental overhearing is permitted under 45 CFR 164.502(a)(1)(iii) when reasonable safeguards exist under 164.530(c). Sensitive conversations move to a private room, the floor talk stays functional, and the day sheet does not sit face-up at the front desk. Keep it reasonable, write it down, and train staff on it.
X-Rays, Imaging, and the Software Stack
Digital X-rays are ePHI (electronic PHI), which pulls the Security Rule in: secure storage, access controls, and a plan for the imaging workstation that is not "everyone knows the password." Under the current rule, encryption is "addressable." That means you decide if it fits your office. If it does, you use it.
If it does not, you write down why and what you do instead. A January 2025 proposed rule would make encryption required. It is still only a proposal, not law. The vendor stack needs the same BAA (Business Associate Agreement) review as any practice: EHR, imaging software, billing service, reminder platform. If it touches patient data for you, it signs a BAA first.
The Program for a Small Chiropractic Office
For a covered practice, the baseline is the same five-document set every small practice needs: a real risk analysis (a thorough written look at the risks to your patient data), written policies, signed BAAs, training records, and an incident procedure. For a genuine cash practice, the baseline is smaller but not zero: the documented covered-entity analysis, following state confidentiality law, and getting written patient permission before any testimonial goes up, because the testimonial wall does not care how you bill.
FAQ
Does HIPAA apply to a cash-only chiropractic practice?
Only if the practice transmits electronic standard transactions like claims or eligibility checks. A pure cash practice with none of those can be outside HIPAA, but state privacy law and board confidentiality rules still apply, and the analysis should be documented.
Can we post patient testimonials in the office or online?
Only with a written HIPAA authorization that meets 45 CFR 164.508. A name plus an outcome is PHI, and the patient's verbal agreement or their own public review does not authorize your use of it.
What do we do with an attorney's request for records in a PI case?
Require a valid, signed patient authorization under 45 CFR 164.508. It needs every required part, including which records, who gets them, and why. It also needs an expiration date and the patient's signature and date. A letterhead request alone is not enough. If a release is missing a required part or has expired, it is not valid. Send it back to be fixed.
Are open adjusting rooms compliant?
Yes, with reasonable safeguards: private space available for sensitive conversations, functional-only talk on the floor, and no identifying paperwork in view. Write the safeguards into policy.
Are digital X-rays covered by the Security Rule?
For a covered practice, yes. They are ePHI and need access controls, secure storage, and vendor BAAs for the imaging software and any cloud storage behind it.
One Guy Consulting works with chiropractic offices at both ends of this: practices that bill insurance and need the whole program, and cash practices that need the analysis documented and the handful of rules that still apply. Flat pricing, $675 or $1,300 a year, no per-seat fees. Start with a free 30-minute intro call. No obligation, no pressure.
Sources
- 45 CFR 160.103 (covered entity and transaction definitions)
- 45 CFR 164.508 (authorizations)
- HHS: covered entities and business associates
Related Reading