HIPAA Compliance for Physical Therapy & Rehab Clinics: The Complete 2026 Guide

Physical therapy clinics operate under the same HIPAA rules as hospitals and physician offices. But the way PT is delivered — open treatment areas, hands-on care in shared spaces, home health visits, exercise video programs, and multi-location chains — creates privacy and security risks that most generic HIPAA guides never address.

If you’re a PT clinic owner or compliance lead, you’ve probably received generic HIPAA training that was written for a physician’s office. The examples don’t match your reality. Nobody in those training modules talks about what happens when a patient demonstrates their home exercise program on video in a gym-style treatment area, or how to handle ePHI when a therapist drives to three home health visits before returning to the clinic.

This guide covers the HIPAA challenges specific to physical therapy and rehabilitation settings — and what to do about them before the proposed 2026 Security Rule changes make the compliance bar significantly higher.

Why PT Clinics Face Unique HIPAA Challenges

Physical therapy is fundamentally different from most outpatient healthcare settings. A dermatologist sees patients in private rooms with closed doors. A PT clinic typically treats multiple patients simultaneously in a shared space, with therapists calling out exercise instructions, discussing progress, and coordinating with aides and techs — all within earshot of other patients.

This isn’t a design flaw. It’s how physical therapy works. Group treatment areas are efficient, allow therapists to supervise multiple patients, and are sometimes clinically necessary for functional training. But from a HIPAA perspective, every one of these operational realities is a potential violation waiting to happen.

The Office for Civil Rights (OCR) doesn’t give PT clinics a pass because open treatment is standard practice. If a patient files a complaint about overhearing another patient’s diagnosis discussed during treatment, OCR will investigate. And that investigation won’t stop at the complaint — it will review your entire compliance program.

Open Floor Plans and Shared Treatment Areas

This is the single biggest HIPAA challenge unique to physical therapy. Most PT clinics have some combination of open gym areas, treatment tables separated by curtains rather than walls, and shared exercise equipment. Patients are often within a few feet of each other during treatment.

The privacy risks are constant:

A therapist discusses a patient’s surgical history, diagnosis, or treatment plan within earshot of other patients
Computer screens at treatment stations display patient records visible to other patients or visitors
Whiteboards or scheduling boards in treatment areas show patient names and appointment details
Phone calls at the front desk about insurance authorizations, referrals, or test results are overheard in the waiting area

What you need to implement:

Reasonable safeguards for verbal communications. HIPAA doesn’t require absolute silence — it requires reasonable efforts to limit incidental disclosures. Use lower voices for clinical discussions. Move sensitive conversations (new diagnoses, psychological factors, insurance issues) to a private area. Train staff on what constitutes minimum necessary information during treatment.
Screen positioning and privacy filters. Every workstation in the treatment area must be positioned so that screens face away from patient traffic. Use privacy screen filters on monitors and tablets. Enable automatic screen lock after 60 seconds of inactivity — not five minutes.
Scheduling boards and patient identifiers. If you use a whiteboard to track the day’s schedule, use patient initials or ID numbers rather than full names paired with treatment details. Better yet, move to a digital scheduling display visible only to staff.
Documentation policies for the treatment floor. Paper documentation left on treatment tables, clipboards with patient information in shared areas, and printed home exercise programs sitting in the printer tray are all HIPAA exposures. Establish clear policies for when paper PHI can be on the treatment floor and how quickly it must be secured.

In 2016, the Minnesota-based Allina Health system paid $1.4 million to settle an OCR investigation that originated, in part, from the way patient information was handled in shared clinical spaces. The investigation revealed systemic failures in physical safeguards — the kinds of issues that open-plan PT clinics face every day.

Home Health Visits: Taking ePHI Outside the Facility

Physical therapists who provide home health services carry ePHI with them — on laptops, tablets, phones, and sometimes paper documentation. Every home visit creates HIPAA risk that doesn’t exist in a controlled clinic environment.

The risks specific to home health PT:

A laptop or tablet containing patient records is left in a car between visits, and the car is broken into
A therapist uses an unsecured home Wi-Fi network to access the EHR or submit documentation
Paper notes or printed home exercise programs with patient identifiers are transported in an unsecured bag
A therapist discusses one patient’s case on the phone while in another patient’s home

OCR has been clear that mobile device security failures are a leading cause of enforcement actions. In 2017, Lifespan Health System affiliated covered entities paid $1.04 million after an unencrypted laptop was stolen from an employee’s car. The device contained ePHI for over 20,000 patients. It didn’t matter that the theft wasn’t the employee’s fault — the failure was allowing unencrypted ePHI on a portable device in the first place.

What your home health PT program needs:

Full-disk encryption on every device. Laptops, tablets, and phones used for patient care must have full-disk encryption enabled. Under the proposed 2026 Security Rule, this moves from addressable to required — there’s no more documenting why you chose not to encrypt.
VPN for remote access. Therapists accessing your EHR from patient homes, coffee shops, or their own homes must use a VPN. Connecting over public or home Wi-Fi without a VPN exposes ePHI in transit.
Remote wipe capability. Every mobile device must be enrolled in a mobile device management (MDM) system that allows you to remotely wipe the device if it’s lost or stolen. You need to be able to act within hours, not days.
Prohibition on local storage. Patient information should be accessed through cloud-based systems, not downloaded and stored locally on devices. If local storage is necessary, it must be encrypted and automatically purged.
Vehicle security policy. If therapists transport devices between visits, the devices should be locked in the trunk — not left on the passenger seat. This sounds basic, but it’s the exact scenario behind multiple OCR enforcement actions.

Multi-Location PT Chains: Maintaining Consistency Across Sites

Physical therapy is one of the most fragmented specialties in terms of practice structure. Many PT businesses operate 3, 5, 10, or more locations. Each location may have its own workflows, its own front desk staff, and its own habits around patient data handling.

HIPAA doesn’t care that your Westside location has great compliance practices. If your Eastside location is using shared logins, leaving patient charts on treatment tables, and faxing records to the wrong number, the entire organization is liable.

The multi-site challenges for PT chains:

Inconsistent training. Staff at satellite locations often receive less thorough HIPAA training than headquarters staff. New hires at smaller locations may get a quick verbal overview instead of documented, role-specific training.
Different EHR workflows. If each location has developed its own shortcuts for documentation, scheduling, or billing, some of those shortcuts may bypass security controls.
Shared credentials across locations. Some multi-site practices use a single set of login credentials for a location rather than individual user accounts. This eliminates audit trail capability — a direct HIPAA violation.
Inconsistent physical safeguards. One location might have privacy screens on all monitors; another might have screens visible from the waiting room. One location locks printed records in a cabinet; another leaves them on a desk overnight.

What multi-site PT practices need:

A single, centralized compliance program with policies that apply uniformly across all locations. Each site can have location-specific procedures (e.g., where the secure shredding bin is located), but the core policies must be the same.
Annual compliance audits at every location, not just headquarters. Walk through each site and look at it through a patient’s eyes — what can they see, hear, and access?
Centralized access management. One system for creating, modifying, and terminating user accounts across all locations. When a therapist at your North location transfers to your South location, their access should be updated the same day — not three weeks later.
Standardized onboarding and offboarding procedures that are followed at every location, with documentation that can be produced during an audit.

For a deeper look at multi-site compliance, see our guide to HIPAA compliance for practices with multiple locations.

PT-Specific Documentation Requirements

Physical therapy documentation has its own HIPAA considerations that go beyond standard medical records.

Treatment notes in shared systems. Many PT clinics use EHR systems designed for general medical practice, with physical therapy-specific modules bolted on. These systems may not have granular enough access controls to limit what different staff roles can see. A front desk employee who needs access to scheduling shouldn’t automatically have access to detailed treatment notes, functional assessments, or psychosocial information documented by the therapist.

Functional outcome measures. PT documentation often includes detailed functional assessments — what a patient can and cannot do physically, their pain levels, their limitations in daily activities. This information is ePHI that requires the same protection as any medical record, but it’s also the type of information that gets casually discussed in treatment areas or left on clipboards.

Referral and communication with other providers. PTs frequently communicate with referring physicians, surgeons, primary care providers, and specialists. Each of these communications must use secure channels. Faxing treatment summaries to a referring physician’s office is common in PT — but misdirected faxes are one of the most common HIPAA breaches in healthcare. Verify fax numbers before every transmission, and consider moving to secure electronic messaging.

Workers’ compensation documentation. PT clinics that handle workers’ comp cases must navigate the intersection of HIPAA and state workers’ compensation laws. Workers’ comp cases often involve communication with employers, insurers, and attorneys — each interaction requires careful attention to what information can be disclosed, to whom, and under what authorization.

This is a rapidly growing risk area that many PT clinics haven’t addressed. The use of video and photography in physical therapy is expanding — for clinical purposes, patient education, and marketing.

Clinical use of video and photos:

Recording a patient’s gait pattern for analysis
Photographing wound healing progress
Creating custom exercise videos for a patient’s home program
Before-and-after documentation of functional improvement

Every one of these creates ePHI. A video of a patient performing exercises in your clinic, paired with any identifying information (even if it’s just stored in a folder with the patient’s name), is protected health information under HIPAA.

What you need:

Written consent that covers the specific use. A general consent-to-treat form does not cover photography or video recording. You need a separate, specific authorization that explains what will be recorded, how it will be stored, who will have access, and how long it will be retained.
Secure storage. Patient videos and photos must be stored in HIPAA-compliant systems — not on a therapist’s personal phone camera roll, not in a personal iCloud or Google Photos account, and not on an unencrypted USB drive. If therapists use their personal phones to record clinical video, you need a clear policy that requires immediate upload to a secure system and deletion from the personal device.
Marketing use requires separate authorization. If you want to use a patient’s photo or video in marketing materials, social media, or your website, you need a separate HIPAA authorization specifically for that purpose. This is distinct from clinical consent. The authorization must describe the specific content, the intended use, and the patient’s right to revoke.
Background patients. If you record a video of one patient in your open treatment area, other patients may be visible or audible in the background. Those background patients have not consented to being recorded. This is a violation. Record in private areas, or ensure no other patients are identifiable in the recording.

The social media trap: Many PT clinics post patient success stories, transformation photos, or exercise demonstrations on Instagram, Facebook, or TikTok. Even with the patient’s verbal permission, this is a HIPAA violation without a written authorization that specifically covers social media use. “They said it was fine” is not a defense in an OCR investigation.

Third-Party Billing Companies and BAAs

Physical therapy billing is notoriously complex — different payer requirements, prior authorization workflows, the 8-minute rule, and constant claim denials make outsourced billing common in PT. Over a third of PT practices use a third-party billing company or revenue cycle management service.

Every one of these billing companies is a business associate under HIPAA. They handle patient names, dates of birth, insurance information, diagnosis codes, treatment codes, and payment data. You need a signed Business Associate Agreement with each one.

But a signed BAA is not enough. Under the proposed 2026 Security Rule, covered entities would be required to verify that business associates have actually implemented the required safeguards. This means you can’t just sign the BAA and file it away — you need to understand how your billing company protects your patient data, whether they encrypt it, how they control access, and whether they’ve had any breaches.

What to verify with your billing company:

Do they encrypt ePHI at rest and in transit?
Do they use multi-factor authentication for staff accessing your patient data?
Do they have their own HIPAA compliance program, including a risk analysis?
How do they handle data when you terminate the relationship — is it returned to you, destroyed, or retained?
Have they experienced any breaches? If so, what was the scope and what remediation occurred?

Don’t forget your other business associates. Beyond billing, PT clinics commonly have BA relationships with EHR vendors, cloud storage providers, IT support companies, telehealth platforms, patient engagement apps, secure messaging services, and — increasingly — AI-powered documentation tools. Each one needs a current BAA.

How the Proposed 2026 Security Rule Changes Affect PT Clinics

The proposed 2026 HIPAA Security Rule update represents the most significant overhaul in over two decades, and several changes hit PT clinics particularly hard. The final rule is expected around mid-2026, with a compliance deadline approximately 240 days after publication.

Key changes that matter for PT:

No more “addressable” safeguards. Under the current rule, PT clinics could document why certain safeguards (like encryption or automatic logoff) weren’t feasible and implement alternative measures. Under the proposed rule, every safeguard would be required. No exceptions without a formal HHS waiver.
Mandatory encryption everywhere. Every device that touches ePHI — the tablet a home health therapist carries, the laptop at the front desk, the workstation in the treatment area — must have full-disk encryption. This is no longer optional.
Mandatory multi-factor authentication. Every system containing ePHI must require MFA. For PT clinics with shared workstations in treatment areas, this means rethinking how therapists log in between patients. Speed matters in a clinical setting, but convenience can’t override security.
Business associate verification. You’ll need to obtain written verification from every business associate that they’ve implemented the required safeguards. For a PT clinic with a billing company, EHR vendor, telehealth platform, and IT support provider, this means managing verification for multiple vendors annually.
72-hour incident reporting to HHS. The proposed rule would require notification to HHS within 72 hours of activating your incident response plan — not 72 hours after discovering a breach (the current requirement for large breaches is 60 days). This compressed timeline means your incident response plan must be rehearsed and ready, not sitting in a binder on a shelf.

For the full breakdown, see our detailed analysis of the proposed 2026 HIPAA Security Rule changes.

PT Practice HIPAA Compliance Checklist

Use this as a starting point to evaluate your practice’s current compliance posture. This is not exhaustive — a full risk analysis covers significantly more — but it addresses the PT-specific gaps that most clinics miss.

Physical Safeguards

Treatment area workstations are positioned so screens face away from patients
Privacy filters are installed on monitors and tablets in shared treatment areas
Automatic screen lock is set to 60 seconds or less on all devices
Scheduling boards in treatment areas use patient initials or ID numbers, not full names with diagnoses
Paper PHI (treatment notes, home exercise programs) is never left unattended in treatment areas
Secure shredding bins are available and used for all paper containing PHI

Home Health and Mobile Devices

All laptops, tablets, and phones used for patient care have full-disk encryption
Therapists use VPN when accessing EHR from outside the clinic
Mobile device management (MDM) with remote wipe is deployed on all devices
Vehicle security policy is documented and followed for devices transported between visits
Patient data is not stored locally on personal devices

Photos and Video

Separate written consent is obtained before recording any patient photos or video
Clinical photos and videos are stored in HIPAA-compliant systems, not personal devices
Social media use of patient images has specific written authorization
Background patients are not identifiable in any recordings

Business Associate Agreements

Current BAA on file with billing company
Current BAA on file with EHR vendor
Current BAA on file with cloud storage and backup providers
Current BAA on file with IT support provider
Current BAA on file with telehealth platform (if used)
Current BAA on file with patient engagement or exercise prescription apps

Training and Documentation

All staff receive documented HIPAA training at hire and annually
Training includes PT-specific scenarios (open treatment areas, home health, patient photos)
Training records include date, content covered, and signed acknowledgment
Policies cover verbal communications in shared treatment spaces

Multi-Location (if applicable)

Same compliance policies apply at every location
Annual compliance walkthrough conducted at each site
Centralized access management across all locations
Standardized onboarding and offboarding at every site

For a more comprehensive assessment, take our HIPAA Risk Assessment Quiz or download our 93-Point HIPAA Compliance Checklist.

How ComplyMD Helps PT Clinics Stay Compliant

Physical therapy practices don’t need another binder of generic HIPAA policies that were written for a hospital. You need compliance guidance that understands open treatment areas, home health workflows, multi-site operations, and the specific ways PT clinics create, store, and share patient information.

ComplyMD is built for practices like yours. Our platform provides:

Risk analysis tailored to your practice type — including PT-specific risk factors like shared treatment areas, mobile devices for home health, and patient video programs
Policy templates that match how PT clinics actually operate — not generic hospital policies you have to rewrite
Business Associate Agreement tracking — know which BAAs are current, which are expiring, and which vendors you haven’t covered yet
Staff training with PT-relevant scenarios — so your therapists and front desk staff learn from examples that match their daily work, not abstract compliance lectures
Multi-location compliance management — one dashboard to track compliance status across every site
2026 Security Rule readiness assessment — understand exactly where your practice stands relative to the proposed requirements, so you’re not scrambling when the final rule drops

HIPAA compliance for PT clinics isn’t about checking boxes. It’s about building systems that protect your patients and your practice in the specific environment where you deliver care. The open gym, the home visit, the exercise video, the multi-site scheduling system — each one requires thought, not just a form.

Join the ComplyMD early access waitlist to get PT-specific compliance tools before the 2026 Security Rule changes take effect.