Most health coaches are not legally bound by HIPAA, but working with medical clients and healthcare teams changes that. Here's the honest breakdown.
TL;DR
- Most independent health coaches are NOT HIPAA-covered entities. HIPAA applies to healthcare providers, health plans, and healthcare clearinghouses.
- HIPAA does apply if you work as a business associate for a covered entity (like a hospital, clinic, or health plan).
- Even without a HIPAA obligation, health coaches have strong ethical and practical reasons to protect client health information.
- State privacy laws and GDPR may apply regardless of HIPAA status.
- This article is general information, not legal advice. Consult a qualified attorney for your situation.
The question of HIPAA compliance for health coaches causes a lot of confusion, and the confusion makes sense. You're working with people on deeply personal health information. You know HIPAA exists as the privacy law for health data. It seems like it should apply to you.
But the connection is less direct than most health coaches assume. HIPAA's reach is specific, and whether it applies to your coaching practice depends almost entirely on who you work with and how.
Here's the clear breakdown.
What HIPAA Actually Is
HIPAA, the Health Insurance Portability and Accountability Act of 1996, established privacy and security standards for "protected health information" (PHI). PHI is individually identifiable health information held or transmitted by a covered entity or its business associates.
The critical term is "covered entity." HIPAA only directly applies to:
- Healthcare providers who transmit health information electronically (doctors, hospitals, clinics, dentists, pharmacies, mental health practitioners)
- Health plans (insurance companies, employer-sponsored health plans, Medicare, Medicaid)
- Healthcare clearinghouses (businesses that process health information between providers and payers)
And it applies to business associates: companies or individuals who handle PHI on behalf of covered entities. A billing company, an EHR software provider, or a researcher who accesses a hospital's patient records would be a business associate.
If you're an independent health coach running your own practice, working directly with individual clients who found you independently, you are almost certainly not a covered entity. HIPAA does not directly govern your practice.
When HIPAA Does Apply to Health Coaches
There are real situations where HIPAA becomes relevant for health coaches:
Working with Healthcare Organizations as a Contractor
If a hospital, clinic, insurance company, or other covered entity contracts with you to provide health coaching services to their patients or members, you may become a business associate of that covered entity. Business associates are required to:
- Sign a Business Associate Agreement (BAA) with the covered entity
- Protect PHI using HIPAA-compliant security practices
- Report breaches of PHI to the covered entity
- Not use or disclose PHI beyond the purposes permitted by the BAA
This is an increasingly common scenario as healthcare systems recognize coaching as a complement to clinical care. Coaches working in hospital wellness programs, corporate health programs administered by insurers, or chronic disease management programs through health plans need to understand whether a BAA is required.
If a potential partner organization asks you to sign a BAA, take it seriously. It imposes real legal obligations.
Working as Part of an Integrated Care Team
Some health coaches work alongside licensed healthcare providers in integrated care settings. A functional medicine practice that employs both an MD and a health coach, a mental health clinic that offers coaching alongside therapy, or a physical therapy practice that includes lifestyle coaching components.
In these settings, the question of whether the health coach is acting as a business associate depends on whether they access or handle PHI created or maintained by the covered entity. If the coach uses the clinic's patient records, has access to the EHR, or discusses patient medical information as part of the care team, they're likely operating as a business associate.
The organization you work within is responsible for ensuring you have a BAA in place and understand your obligations. But knowing this applies to you is your responsibility too.
Referral Networks with Healthcare Providers
If a physician or therapist regularly refers patients to your coaching practice and sends you medical records or clinical notes about those patients, there's a HIPAA-adjacent question worth asking. Strictly speaking, the physician sending you records is the one with HIPAA obligations. But handling records from covered entities warrants some thought about your data handling practices.
In practice, most coaches in this situation just keep clinical records secure, return or destroy them after use, and treat them with the same confidentiality they'd apply to any sensitive client information.
What Health Coaches Should Do Even Without a HIPAA Obligation
Even if HIPAA doesn't directly apply to your practice, you're working with sensitive health information. The ethical and practical arguments for protecting it well don't disappear just because a federal law doesn't compel you.
Treat Client Health Information as Confidential
Session notes, intake forms, health history questionnaires, progress tracking data. All of this is sensitive. Clients are sharing it in a relationship of trust. The way you handle it says something about how seriously you take that relationship.
The coaching confidentiality agreement guide covers confidentiality in coaching more broadly. For health coaches, this is especially important to get right in your coaching agreement.
Secure Your Data Storage
Wherever you store client health information, apply reasonable security: