6.2 Laws, Regulations & HIPAA
Key Takeaways
HIPAA (Health Insurance Portability and Accountability Act) protects client health information and applies to massage therapists who bill insurance
Protected Health Information (PHI) includes any individually identifiable health data: name, address, diagnosis, treatment records
Informed consent must be obtained before treatment and documented in the client's file
Massage therapists are mandatory reporters of suspected child abuse and elder abuse in most states
Scope of practice is defined by state law and varies — therapists must know their specific state's regulations
License renewal typically requires continuing education credits (CE hours) every 1-2 years
Sexual misconduct by a massage therapist is both an ethical violation and a criminal offense in most states
Client records must be stored securely and retained for the period specified by state law (typically 7-10 years)
Massage therapists must understand the legal framework governing their practice. Ignorance of the law is not a defense — therapists are responsible for knowing and following all applicable federal, state, and local regulations.
HIPAA — Health Insurance Portability and Accountability Act
Who Does HIPAA Apply To?
HIPAA applies to covered entities and their business associates. Massage therapists are subject to HIPAA if they:
- Bill health insurance for services
- Transmit health information electronically
- Work in a healthcare setting that is a covered entity
Even if not legally required, following HIPAA principles is best practice for all massage therapists.
Protected Health Information (PHI)
PHI is any individually identifiable health information, including:
| PHI Examples | Description |
|---|---|
| Name | Client's full name |
| Address | Home address, email address |
| Date of birth | Age-related information |
| Phone number | Contact information |
| Social Security number | If collected |
| Medical records | SOAP notes, intake forms, treatment plans |
| Billing records | Insurance claims, payment history |
| Photographs | Images of the client for assessment purposes |
HIPAA Requirements for Massage Therapists
- Privacy Rule: Protect client health information from unauthorized access
- Security Rule: Implement safeguards for electronic health records (EHR)
- Breach Notification: Notify clients and authorities if PHI is compromised
- Minimum Necessary: Only access or share the minimum PHI needed for the purpose
- Client Rights: Clients can access, request copies of, and request corrections to their records
Permissible Disclosures (Without Client Consent)
PHI can be shared without consent in limited situations:
- Treatment: Sharing records with other healthcare providers for the client's care
- Payment: Submitting information to insurance companies for reimbursement
- Healthcare operations: Quality improvement, audits, training
- Legal requirements: Court orders, subpoenas, mandatory reporting
- Public health: Disease surveillance, vital statistics reporting
- Abuse or neglect: Mandatory reporting of suspected abuse
State Licensing Laws
Common Licensing Requirements
| Requirement | Typical Standard |
|---|---|
| Education | 500-1000 hours from an approved program |
| Examination | MBLEx Pass result |
| Background check | Criminal background check |
| Application | State board application with fee |
| Continuing education | 12-24 CE hours per renewal period (1-2 years) |
| Liability insurance | Required or recommended in most states |
Scope of Practice
Scope of practice defines what a massage therapist is legally allowed to do. It is defined by state law and varies by jurisdiction:
Typically WITHIN scope:
- Performing massage and bodywork techniques
- Assessing soft tissue conditions through palpation
- Recommending stretches and self-care exercises
- Using hot/cold applications and hydrotherapy
- Communicating assessment findings to other providers
Typically OUTSIDE scope:
- Diagnosing medical conditions
- Prescribing medications or supplements
- Performing spinal adjustments
- Providing psychological counseling
- Using modalities not included in training
Mandatory Reporting
Massage therapists are mandatory reporters in most states, meaning they are legally required to report suspected:
- Child abuse or neglect — physical, sexual, emotional abuse or neglect
- Elder abuse or neglect — physical, financial, emotional abuse or neglect of vulnerable adults
- Dependent adult abuse — abuse of adults who depend on others for care
How to Report
- Do not investigate — that is law enforcement's role
- Report suspected abuse to the appropriate agency (usually child protective services or adult protective services)
- Document your observations objectively
- Maintain confidentiality — only share information with the appropriate authorities
- You are protected — good-faith reporters are protected from retaliation by law
Informed Consent — Legal Requirements
Informed consent has both ethical and legal components:
- Must be obtained before any treatment begins
- Client must be competent (able to understand the information)
- Must include risks, benefits, alternatives, and the right to refuse
- Must be documented (written consent form + signature)
- Can be withdrawn at any time by the client
- For minors: Parent or legal guardian must provide consent
- For clients with diminished capacity: Legal guardian or healthcare proxy must consent
Record Keeping & Retention
| Requirement | Standard |
|---|---|
| Storage | Secure, locked location (physical) or encrypted/password-protected (electronic) |
| Access | Only authorized personnel |
| Retention period | Typically 7-10 years after last service (varies by state) |
| Minors | Records must be kept until the minor reaches age of majority + state retention period |
| Disposal | Shred paper records; permanently delete electronic records |
Professional Liability
Types of Liability
| Type | Description | Example |
|---|---|---|
| Negligence | Failure to provide the standard of care | Massaging over a DVT without proper screening |
| Malpractice | Professional negligence resulting in harm | Causing nerve damage through excessive pressure |
| Battery | Unauthorized touching | Massaging an area the client did not consent to |
| Breach of confidentiality | Sharing PHI without authorization | Discussing a client's condition with another client |
| Abandonment | Terminating care without proper notice or referral | Refusing to see a client without providing alternatives |
Under HIPAA, which of the following is considered Protected Health Information (PHI)?
General massage technique descriptions in a textbook
A client's name, treatment records, and billing information
The therapist's personal contact information
Publicly available health statistics
A massage therapist notices suspicious bruises on a child client that are inconsistent with the parent's explanation. The therapist should:
Confront the parent about the bruises
Report the suspected abuse to the appropriate agency as a mandatory reporter
Ignore the bruises since they are not a medical doctor
Discuss it with other clients to see if they have similar concerns
Massaging an area of the body that the client did not consent to could be considered:
Negligence
Malpractice
Battery
Abandonment
How long must client records typically be retained after the last service?
1-2 years
3-5 years
7-10 years
Indefinitely
Under HIPAA, PHI can be disclosed WITHOUT client consent in which of the following situations? (Select all that apply)
Select all that apply
Treatment purposes (sharing with other healthcare providers)
Casual conversation with a colleague
Court orders or legal subpoenas
Social media posts about interesting cases
Mandatory reporting of suspected child abuse
Insurance billing and payment processing
Scope of practice for massage therapists is primarily defined by:
The massage therapy school curriculum
Federal law (HIPAA)
State law and licensing regulations
The FSMTB national standards only
HIPAA stands for the Health Insurance ___ and Accountability Act.
Type your answer below
A therapist accidentally shares a client's medical information with another client. This is an example of:
Negligence
Battery
Breach of confidentiality
Abandonment
For informed consent to be valid for a minor client, consent must be provided by:
The minor themselves if they are over 12
The parent or legal guardian
Any adult family member
The school nurse or guidance counselor
Match each type of professional liability to its correct definition.
Match each item on the left with the correct item on the right
Negligence
Battery
Breach of confidentiality
Abandonment
Sections you finish are checked off in the contents.