Does HIPAA Apply to a Private-Practice Dietitian? It Depends on One Transaction

Is a private-practice dietitian a HIPAA covered entity?

Only if the practice transmits a covered transaction electronically. HIPAA's definition of "covered entity" is a closed list of three: a health plan, a health care clearinghouse, and "a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter". A dietitian is a "health care provider" in the definitional sense, and nutrition counseling is "health care", but neither fact alone makes the practice covered.

The covered transactions are the financial and administrative exchanges between a provider and a payer: claims, payment and remittance advice, coordination of benefits, claim status, enrollment, eligibility, premium payments, referral certification and authorization, first report of injury, health care electronic funds transfers, since May 26, 2026, health care claims attachments, and a residual twelfth item for anything else the Secretary prescribes by regulation. Emailing a client, storing records in cloud software, running a client portal and taking card payments are not on the list. None of them is a "transaction" in the regulation's sense.

CMS states the provider branch of the test as two questions in its covered-entity decision tool: does the person furnish, bill or receive payment for health care, and does the person "transmit (send) any covered transactions electronically?" If the answer to the second is no, the tool's conclusion is that the provider "is NOT a covered health care provider and therefore not a covered entity". HHS says the same thing in prose: a provider is covered "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard".

A dietitian who takes cash, card or HSA payment directly, hands the client a superbill to submit themselves, and never sends an eligibility check, claim, claim-status query or remittance in electronic form is not a covered entity, and no HIPAA rule applies to the practice. What that superbill has to carry, and why no federal field list exists, is in what goes on a US dietitian superbill.

What makes a cash-pay dietitian a covered entity?

Any one covered transaction sent electronically, once: a single claim to any payer, an eligibility or benefits check, a remittance advice received electronically, or a claims attachment. The regulation contains no "one claim only" or de minimis exception. Nothing in the rule reverses the status later, and once covered, the practice is covered for all of its protected health information, including the records of clients who pay cash.

CMS treats a billing service's transaction as the provider's own: its decision tool states that "if a healthcare provider uses another entity (such as a clearinghouse) to conduct covered transactions in electronic form on its behalf, the health care provider is considered to be conducting the transaction in electronic form". A practice that contracts a billing company to submit claims for its one or two insurance clients has crossed the line even though it never touched a claim itself. The regulation contemplates exactly that arrangement at 45 CFR 162.923(c).

Whether to cross the line is a business decision. Medicare medical nutrition therapy and in-network commercial work both require electronic claims in practice, and the trade-off is set out in which insurers cover dietitian services in the US and what billing them requires.

What does a HIPAA-covered dietitian have to do?

A covered practice has six core duties, and none has a solo-practice exemption. It must deliver a Notice of Privacy Practices with the prescribed header no later than the first service, make a good-faith effort to obtain written acknowledgment, and post the notice prominently on the practice website if the site describes the practice's services. It must carry out a risk analysis, which is a "Required" implementation specification, not an "addressable" one, along with risk management, a sanction policy and information-system activity review. It must name a security official. It must train its workforce on both the Security Rule and its own privacy policies, and document the training. It must designate a privacy official and a complaints contact. And it must keep its written policies and procedures for six years from creation or from when they were last in effect.

The six-year documentation duty is where the widely repeated "HIPAA requires six years" figure comes from. It attaches to the documentation of compliance, not to client records. HIPAA sets no medical-record retention period at all, and HHS says so in its own FAQ.

How long the clinical chart itself must be kept is a question of state law, and for a dietitian the answer is different from the one on most retention charts. See how long a US dietitian must keep client records. How the privacy decision fits with licensure, records, billing, entity and tax is mapped in starting a dietitian private practice in the US.

Does a dietitian need a business associate agreement with software vendors?

Only a covered dietitian does. The duty exists only "with respect to a covered entity". A business associate is any person who, on the covered entity's behalf, "creates, receives, maintains, or transmits protected health information" for a regulated function, and the definition names billing and practice management expressly. Practice-management software, a billing service, a cloud backup provider and a transcription service are all business associates of a covered practice. Before disclosing PHI to any of them the practice must obtain "satisfactory assurance" in the form of a written contract that establishes the permitted uses.

Another treating provider is not a business associate: the definition excludes "a health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual", so a referral to or from a physician needs no agreement. And a signed agreement that the practice knows is being breached does not protect it. A covered entity that "knew of a pattern of activity or practice of the business associate that constituted a material breach" must take reasonable steps to cure it or terminate the contract.

A practice that is not a covered entity owes no BAA under HIPAA, and a vendor cannot make it one by offering a BAA. Whether that practice should still hold vendors to equivalent terms is a matter of the state laws below, several of which reach it whether or not HIPAA does.

If HIPAA does not apply to my practice, what does?

The FTC Act, the state breach law, and in several states a health-privacy or consumer-health-data statute drafted without reference to HIPAA at all. Section 5 of the FTC Act prohibits "unfair or deceptive acts or practices in or affecting commerce", and the Commission's power runs against "persons, partnerships, or corporations", so a sole proprietor is reachable. The FTC and HHS have said jointly that the Act's obligations apply to "companies that collect, use, or share health information that aren't required to comply with HIPAA", and in 2023 they wrote to around 130 hospital systems and telehealth providers about web-tracking disclosures on that basis. The health-privacy enforcement docket to date is apps and platforms, not solo clinical practices.

The FTC's Health Breach Notification Rule is narrower than its name suggests for a clinical practice. It reaches vendors of "personal health records", and a personal health record must be "managed, shared, and controlled by or primarily for the individual". A chart in a practice-controlled system does not fit that description on the plain words, and the 2024 amendment's worked examples are all health apps. Whether a client-facing portal in which the client manages their own record and connects a wearable changes the answer is unresolved.

Texas is the state that reaches a cash-pay dietitian most directly. Health and Safety Code chapter 181 defines "covered entity" as any person who, for professional gain or fees, "engages, in whole or in part, and with real or constructive knowledge, in the practice of assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information". There is no small-practice exemption and no non-HIPAA exemption. The only entities carved out are insurers and employers. A Texas covered entity must train each employee within 90 days of hire and again within a year of any material change in the law, keep the signed training statements for six years, provide an electronic health record within 15 business days of a written request if its system can, and post on its website and in its office instructions for requesting records, contacting the licensing board and filing a complaint. The 60-day and every-two-years training figures still printed by compliance vendors were repealed in 2013. A companion chapter added in 2025 also requires that electronic health records be physically maintained in the United States.

Washington, Nevada and Connecticut have consumer-health-data statutes with no revenue or volume floor. Washington's My Health My Data Act reaches any entity that conducts business in the state and determines the purpose and means of collecting consumer health data. A "small business" is a sub-class with a later compliance date, not an exemption. The Act requires separate consent for sharing and a deletion right that reaches backups within 45 days, and it is enforced through the Consumer Protection Act. Nevada's statute mirrors it with a 45-day response deadline and no private right of action. Connecticut's consumer-health-data provisions apply "notwithstanding" the general threshold, and from July 1, 2026, the general volume threshold is gone for anyone processing sensitive data, which consumer health data is. In all three, the HIPAA carve-out is written for entities HIPAA already regulates.

California is unresolved. The Confidentiality of Medical Information Act reaches "a person licensed or certified pursuant to Division 2" of the Business and Professions Code. The dietitian chapter sits inside Division 2, but it issues no license or certificate. The qualifications it sets are validated by the Commission on Dietetic Registration, not by a California board. Whether that makes a California RDN a "provider of health care" under the Act is a question the text does not answer, and a practice there should take advice rather than assume either way. Florida, by contrast, is clear: its definition of "health care practitioner" enumerates the dietetics licensure part expressly, so a Florida licensed dietitian is a "records owner" with the statute's confidentiality and access duties.

How quickly must a dietitian report a data breach?

Under HIPAA, to the individual without unreasonable delay and "in no case later than 60 calendar days after discovery", where discovery is constructive: the clock starts on the first day the breach "by exercising reasonable diligence would have been known". A breach is presumed unless the practice can demonstrate a low probability that the information was compromised, and the practice bears the burden of proving it notified. Breaches of 500 or more individuals go to HHS at the same time. Smaller ones go into a log reported within 60 days of year-end.

State breach laws apply alongside HIPAA, and the assumption that HIPAA compliance satisfies them is wrong in every one of the five states examined. Texas contains no HIPAA provision at all. California relieves only the content of the notice. New York excuses the individual notice but still requires notice to the Attorney General, the Department of State, the State Police and the Department of Financial Services whenever any New York resident is notified. Florida's relief is keyed to the practice's federal regulator and covers the department notice only if a copy is sent to the department on time. Illinois offers the broadest deeming and forfeits it unless the Attorney General is told within five business days of HHS.

The deadlines have also tightened. California's business breach notice has carried a hard 30-calendar-day limit since January 1, 2026. New York's is 30 days from discovery. Florida's is 30 days on an access-based trigger, the lowest bar of the five. Texas allows 60 days for individuals but requires Attorney General notice within 30 days at 250 or more residents. Illinois alone sets no numeric outer limit.