Chiropractic has a HIPAA question no other specialty asks with the same frequency: "I run a cash practice, does any of this even apply to me?" It is a fair question with a real answer, and the answer is a test, not a slogan. This article runs the test, then covers the compliance issues that are distinctly chiropractic: the testimonial wall, the personal injury attorney fax, the open adjusting bay, and the X-ray folder.
HIPAA Compliance for Chiropractors: Who Is Actually Covered
The Cash-Practice Test
HIPAA does not cover every healthcare provider. It covers providers who transmit health information electronically in connection with the standard transactions: claims, eligibility checks, claim status, remittance. Bill insurance electronically, even once, even through a billing service, and you are a covered entity. Full stop.
A pure cash practice that never runs an electronic standard transaction, no claims, no eligibility pings, no superbills submitted on the patient's behalf, can genuinely sit outside HIPAA. But three cautions before anyone celebrates. First, the test is fragile: one staff member submitting one electronic claim flips your status, and verifying eligibility electronically counts. Second, providing superbills that patients submit themselves does not trigger it, but the moment your software submits for them, it does. Third, sitting outside HIPAA is not sitting outside privacy law: state medical privacy statutes, board confidentiality rules, and ordinary negligence liability all still apply, a distinction covered in the covered entity definition guide. Run the test honestly, write down the result and the reasoning, and re-run it when your billing changes.
The Testimonial Wall
Chiropractic marketing loves patient stories, and that is where this specialty gets burned. A testimonial with a name and outcome, a before-and-after post, a Google review response that confirms someone is a patient: all disclosures of P.H.I. (Protected Health Information), and all requiring written authorization, not verbal enthusiasm. The authorization needs the elements in the authorization requirements guide, and "they posted the review themselves" does not authorize your reply; the front desk rules cover the review-response trap in detail.
Personal Injury and the Attorney Fax
Chiropractic sees more attorney record requests than almost any small-practice specialty, because motor vehicle and injury cases run through your notes. The rule: a signed patient authorization that meets 45 CFR 164.508 gets the records; a bare attorney letterhead request does not. Check the authorization for an expiration date, a description of what is requested, and the patient's signature before anything leaves the office. Defective releases are the norm in PI work, and sending records on a defective release is your violation, not the attorney's.
Open Adjusting Bays and the Floor
Multiple tables in one room follow the same rules as any shared treatment space: incidental overhearing is permitted under 45 CFR 164.502(a)(1)(iii) when reasonable safeguards exist under 164.530(c). Sensitive conversations move to a private room, the floor talk stays functional, and the day sheet does not sit face-up at the front desk. Reasonable, written down, trained once a year.
X-Rays, Imaging, and the Software Stack
Digital X-rays are ePHI, which pulls the Security Rule in: encrypted storage, access controls, and a plan for the imaging workstation that is not "everyone knows the password." The vendor stack needs the same B.A.A. (Business Associate Agreement) review as any practice: EHR, imaging software, billing service, reminder platform. If it touches patient data for you, it signs a BAA first.
The Program for a Small Chiropractic Office
For a covered practice, the baseline is the same five-document set every small practice needs: a real risk assessment, written policies, signed BAAs, training records, and an incident procedure. For a genuine cash practice, the baseline is smaller but not zero: the documented covered-entity analysis, state-law confidentiality compliance, and the marketing authorization habit, because the testimonial wall does not care how you bill.
---
FAQ
Does HIPAA apply to a cash-only chiropractic practice?
Only if the practice transmits electronic standard transactions like claims or eligibility checks. A pure cash practice with none of those can be outside HIPAA, but state privacy law and board confidentiality rules still apply, and the analysis should be documented.
Can we post patient testimonials in the office or online?
Only with a written HIPAA authorization that meets 45 CFR 164.508. A name plus an outcome is PHI, and the patient's verbal agreement or their own public review does not authorize your use of it.
What do we do with an attorney's request for records in a PI case?
Require a valid signed patient authorization: specific description, expiration date, signature. A letterhead request alone is not enough, and a defective release must be sent back for correction.
Are open adjusting rooms compliant?
Yes, with reasonable safeguards: private space available for sensitive conversations, functional-only talk on the floor, and no identifying paperwork in view. Write the safeguards into policy.
Are digital X-rays covered by the Security Rule?
Yes. They are ePHI and need access controls, secure storage, and vendor BAAs for the imaging software and any cloud storage behind it.
Conclusion
One Guy Consulting works with chiropractic offices at both ends of this: fully-insured practices that need the whole program, and cash practices that need the analysis documented and the handful of rules that still apply. Flat pricing, $675 or $1,300 a year, no per-seat fees. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 45 CFR 160.103 (covered entity and transaction definitions)
- 45 CFR 164.508 (authorizations)
- HHS: covered entities and business associates
Related Reading