Plenty of practices read the scope of HIPAA, notice they do not conduct the covered electronic transactions, and conclude the law does not reach them. That conclusion is technically defensible but practically dangerous. Courts across the United States use HIPAA to establish the standard of care for medical privacy in ordinary state tort cases, which means a practice can lose a lawsuit over HIPAA even when HIPAA does not directly apply to it. On top of that, many states have their own privacy laws that are stricter than HIPAA and that apply to every provider, with no scope exemption at all.<\/p>\n
A little knowledge can be a dangerous thing, and this is definitely true when it comes to HIPAA. At Spruce, we sometimes hear from healthcare providers who think that they are exempt from HIPAA, but this is almost never fully accurate and it can be a costly regulatory mistake to make.<\/p>\n
If you’re involved with healthcare in the United States and you believe that HIPAA doesn’t apply to you, you might want to reconsider that position. Read on to learn why and to make sure that you’re protected.<\/p>\n
HIPAA is a federal law, and its resultant regulations are therefore developed and enforced by the federal Department of Health and Human Services (HHS) and its Office for Civil Rights (OCR). This situation means that HIPAA has potential implications for everybody in the country, but as per HHS<\/a>, the scope of the law is generally limited to “health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically.”<\/p>\n We’ve spent time on this blog discussing the ins and outs of this scope limitation<\/a>, including the specifics of which “electronic transactions” put you under the purview of HIPAA, and the government even provides a clickable flowchart<\/a> to help you determine if the law might apply to you.<\/p>\n If you read all of this guidance, you could easily get the idea that HIPAA doesn’t hold any sway over many types of medical practices, such as those that don’t accept health insurance or those that use paper charts.<\/p>\n This, however, would be a huge mistake.<\/p>\n This gets a little technical, but bear with me.<\/p>\n As we discussed, HIPAA is federal law and doesn’t apply directly to all medical practices. There are, however, many common state laws that patients and other parties can use to bring lawsuits against medical practices. Many of these fall under tort law<\/a>, which is the branch of law that addresses civil wrongs that have caused damages, and it includes colloquially familiar entities like “negligence,” “invasion of privacy,” and “intentional infliction of emotional distress,” among many others.<\/p>\n While formal actions under HIPAA itself can only be pursued by state attorneys general or the Secretary of HHS, private individuals, such as patients, are free to file tort claims (primarily in state courts) without any direct governmental involvement. Let’s look at a “negligence” tort claim as an example.<\/p>\n If a patient brings a negligence claim against a medical practice, there are typically four elements that they must establish in order to be successful (this can vary by state, but it is a common framework):<\/p>\n So how can HIPAA factor into a negligence case? HIPAA has been used successfully to establish the “duty” element of negligence claims against medical organizations.<\/strong> For some years now, courts in many states have accepted HIPAA as the standard of care for the duties that healthcare providers owe to their patients, including the law’s provisions for security and privacy.1\u20134<\/sup><\/p>\n Importantly, the success of these cases did not depend on the parts of HIPAA that determine who it applies to in its capacity as a federal law. In these negligence cases, it only mattered that there was a doctor\u2013patient relationship; that fact alone was enough for the courts to decide that the practices owed their patients a duty of HIPAA compliance, at least for the purposes of tort law.5<\/sup><\/p>\n First of all, rude: the law is fascinating. But, yes, it can be a little confusing or even daunting.<\/p>\n Here’s the take-home summary:<\/p>\n Key Takeaways:<\/b><\/p>\n It’s also critical to remember that many states have passed their own medical privacy and security laws<\/a>. In general, HIPAA provides a “floor” of privacy protection<\/a>, meaning that states cannot have laws that are more lenient than HIPAA. They can, however, have laws that are more strict or far-reaching than HIPAA, and many do. They are also free to make their laws apply to all healthcare providers, rather than following the scope limitations that are present in HIPAA.<\/p>\n Understanding HIPAA is a good starting point, but it’s also important to be informed about any\u00a0health privacy laws<\/a> that your state has. Since these laws are guaranteed to be at least as strict as HIPAA, they end up functioning as a de facto mechanism to require HIPAA compliance, even from providers who might otherwise be exempt on a federal level.<\/p>\n We’ve got a HIPAA-compliance checklist<\/a> to get you started and help make it easy! It’s not so bad; we promise. \ud83d\ude42<\/p>\n Not always in the strict federal sense. HIPAA’s scope covers health plans, health care clearinghouses, and health care providers that conduct certain transactions electronically. A practice outside that scope can still be held to the HIPAA standard through state courts and state privacy law.<\/p>\n Effectively, yes. Only state attorneys general and the Secretary of HHS can bring formal actions under HIPAA itself, but patients can file state tort claims for things like negligence and invasion of privacy, and many courts use HIPAA as the standard of care in deciding those cases.<\/p>\n They cannot be more lenient. HIPAA sets a floor, and states are free to pass laws that are stricter or broader, including laws that apply to every healthcare provider rather than only those inside HIPAA’s federal scope. Many states have done exactly that.<\/p>\n Assume the HIPAA standard applies to your practice and build around it, then check your own state’s health privacy law, which is guaranteed to be at least as strict. Spruce is a cloud-based platform for HIPAA-compliant communication, and every eligible organization receives a BAA as part of the terms of service at signup.<\/p>\n This article is part of a series of posts relating to HIPAA law and regulation. The information provided is\u00a0meant as general guidance only and is not intended to be legal advice.<\/em><\/p>\n References:<\/strong><\/p>\n Plenty of practices read the scope of HIPAA, notice they do not conduct the covered electronic transactions, and conclude the law does not reach them.<\/p>\n","protected":false},"author":1,"featured_media":1980,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"slim_seo":{"title":"Does HIPAA Apply to Your Practice? Probably, Yes (2026) - Spruce Blog","description":"You can be outside HIPAA's federal scope and still lose a lawsuit over it. Why cash-only and paper-chart practices are not exempt in practice."},"footnotes":""},"categories":[14],"tags":[16,15],"different-template":[],"class_list":["post-1960","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hipaa","tag-compliance","tag-hipaa"],"acf":[],"_links":{"self":[{"href":"https:\/\/sprucehealth.com\/blog\/wp-json\/wp\/v2\/posts\/1960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sprucehealth.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sprucehealth.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sprucehealth.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sprucehealth.com\/blog\/wp-json\/wp\/v2\/comments?post=1960"}],"version-history":[{"count":2,"href":"https:\/\/sprucehealth.com\/blog\/wp-json\/wp\/v2\/posts\/1960\/revisions"}],"predecessor-version":[{"id":6173,"href":"https:\/\/sprucehealth.com\/blog\/wp-json\/wp\/v2\/posts\/1960\/revisions\/6173"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sprucehealth.com\/blog\/wp-json\/wp\/v2\/media\/1980"}],"wp:attachment":[{"href":"https:\/\/sprucehealth.com\/blog\/wp-json\/wp\/v2\/media?parent=1960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sprucehealth.com\/blog\/wp-json\/wp\/v2\/categories?post=1960"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sprucehealth.com\/blog\/wp-json\/wp\/v2\/tags?post=1960"},{"taxonomy":"different-template","embeddable":true,"href":"https:\/\/sprucehealth.com\/blog\/wp-json\/wp\/v2\/different-template?post=1960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}The Catch: HIPAA Can Be Used to Establish the Standard of Care in Non-HIPAA Lawsuits<\/h2>\n
\n
That Is Confusing and Boring. Give Me the Summary!<\/h2>\n
\n
A Bonus Reminder About HIPAA Compliance and State Law<\/h2>\n
And How Can I Be HIPAA Compliant?<\/h2>\n
Frequently Asked Questions<\/h2>\n
Does HIPAA apply to cash-only or paper-chart practices?<\/h3>\n
Can a practice be sued over HIPAA if HIPAA does not apply to it?<\/h3>\n
Do state privacy laws override HIPAA?<\/h3>\n
What is the practical takeaway?<\/h3>\n
\n\n