13.1 Federal Laws and Regulations Governing Music Therapy Practice
Key Takeaways
- Knowledge Statement 5B-4 names ADA, CMS, HIPAA, FERPA, OSHA, and mandated reporting as the federal framework a board-certified music therapist must know, and Task Statement 58 requires maintaining current knowledge of federal and state law affecting practice.
- HIPAA governs protected health information in healthcare settings while FERPA governs education records in schools, and a school-based music therapist’s records are usually education records under FERPA rather than PHI under HIPAA.
- IDEA establishes music therapy as a potential related service on an IEP, with Part B covering ages three through twenty-one and Part C covering birth through age two under an IFSP.
- The ADA requires reasonable accommodation and program accessibility, which reaches instrument access, communication access, and the physical environment of the therapy space.
- OSHA standards, principally the Bloodborne Pathogens Standard, impose employer training and control obligations that apply directly to instrument handling and body-fluid exposure.
Federal Laws and Regulations Governing Music Therapy Practice
The 2025 Board Certification Domains put this squarely in Domain V:
- 5B-4 — Federal laws, regulations, and guidelines pertaining to practice (e.g., Americans with Disabilities Act [ADA], Centers for Medicare and Medicaid Services [CMS], Health Insurance Portability and Accountability Act [HIPAA], Family Educational Rights and Privacy Act [FERPA], Occupational Safety and Health Administration [OSHA], mandated reporting)
- Task 58 — Maintain knowledge of federal and state laws, rules, and regulations that may affect practice
You are not expected to practise law. You are expected to know which framework applies in which setting and what it requires of you.
1. HIPAA — Health Insurance Portability and Accountability Act
Applies to: covered entities — health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically — and their business associates.
Protects: protected health information (PHI), meaning individually identifiable health information in any form.
Core obligations for a music therapist
- Privacy Rule — use and disclose PHI only as permitted; apply the minimum necessary standard (Sections 3.4 and 9.3).
- Security Rule — administrative, physical, and technical safeguards for electronic PHI: unique logins, encryption, access controls, audit trails.
- Breach Notification Rule — report suspected breaches immediately through the organization's process.
- Client rights — access to their own records, the right to request amendment, an accounting of disclosures, and the right to request restrictions.
Permitted without separate authorization: treatment, payment, and healthcare operations. Most other disclosures require a signed, specific, current authorization (Section 9.3).
Psychotherapy notes as HIPAA defines them are process notes kept separate from the record and receive heightened protection requiring separate authorization. They are not ordinary session notes.
2. FERPA — Family Educational Rights and Privacy Act
Applies to: educational agencies and institutions receiving federal education funding.
Protects: education records, including records of services delivered under an IEP.
Core points for a school-based music therapist
- Parents have the right to inspect and review their child's education records, to request amendment, and to consent to most disclosures.
- Rights transfer to the student at 18 or on enrolling in postsecondary education.
- Disclosure to school officials with a legitimate educational interest is permitted without consent.
- Directory information may be disclosed unless the parent opts out.
The distinction the exam tests: a music therapist employed by a school district documenting IEP services is generally creating education records under FERPA, not PHI under HIPAA. A music therapist employed by a hospital who provides services in a school under contract may be creating records governed by HIPAA. Setting and employer determine which framework applies, and when in doubt the correct answer is to consult the organization's privacy officer.
3. IDEA — Individuals with Disabilities Education Act
Part B — ages 3 through 21. Provides a free appropriate public education in the least restrictive environment through an IEP.
Part C — birth through age 2. Early intervention through an IFSP, delivered in natural environments, with family-centred outcomes.
Where music therapy sits: music therapy is a related service under Part B when assessment demonstrates the student requires it to benefit from special education. The SEMTAP is the assessment process designed to establish exactly that (Section 3.6).
Procedural protections you should recognize: parental consent for evaluation and initial placement, prior written notice of proposed changes, the right to an independent educational evaluation, due process and mediation, and re-evaluation at least every three years.
4. ADA — Americans with Disabilities Act
Title I — employment. Reasonable accommodation for qualified individuals with disabilities. This protects music therapists as employees as well as clients.
Title II — state and local government services, including public schools and public hospitals. Program accessibility and effective communication.
Title III — public accommodations, including private practices, clinics, and private schools.
What it requires in the therapy room
- Effective communication — qualified interpreters, assistive listening systems, materials in accessible formats. A family member is not an acceptable substitute for a qualified interpreter.
- Physical accessibility — the route to the space, the space itself, seating, and table height.
- Reasonable modification of policies — for example, permitting a service animal in the session.
- Instrument and equipment accessibility — the adaptation obligations in Section 4.6 have a legal dimension as well as a clinical one.
Section 504 of the Rehabilitation Act is the closely related civil rights provision applying to recipients of federal funds; in schools it produces the 504 plan, which provides accommodations for access but not the specialized instruction and related services an IEP provides (Section 3.4).
5. CMS — Centers for Medicare & Medicaid Services
CMS sets Conditions of Participation and coverage rules that shape documentation and service delivery in most healthcare settings.
- Hospice — music therapy is explicitly recognized within the hospice benefit; services appear on the plan of care and the interdisciplinary group reviews them on a defined cycle.
- Inpatient psychiatric — active treatment requirements govern what counts as a therapeutic service and how it is documented.
- Inpatient rehabilitation — intensity of service and functional outcome reporting requirements.
- Skilled nursing — care planning and assessment cycles.
- Medicaid — administered state by state, so coverage of music therapy varies substantially by state, including waiver programs and school-based Medicaid billing.
The practical consequence is documentation: CMS rules are why medical necessity, skilled intervention, and measurable functional outcomes must appear in the record (Section 9.3).
6. OSHA — Occupational Safety and Health Administration
Bloodborne Pathogens Standard (29 CFR 1910.1030) — the standard most directly relevant to music therapy. Requires an exposure control plan, annual training, hepatitis B vaccination offered at no cost to employees with occupational exposure, engineering and work practice controls, personal protective equipment, and post-exposure evaluation and follow-up.
Hazard Communication Standard — Safety Data Sheets for chemicals including instrument disinfectants, with labelling and training.
General Duty Clause — the employer must furnish a workplace free from recognized hazards, which reaches workplace violence prevention on behavioural health units.
Section 2.4 covers how these obligations appear in daily practice.
7. Mandated Reporting
Named in Knowledge Statement 5B-4 and required by Task 61.
- Music therapists are mandated reporters of suspected child abuse and neglect in every state, and of vulnerable adult or elder abuse in most.
- The standard is reasonable suspicion, not proof or certainty.
- The obligation is personal and non-delegable. Telling a supervisor does not discharge it.
- Reporting timelines are set by state law and are typically immediate or within a short defined period.
- Good-faith reporters have statutory immunity; failing to report carries civil and criminal penalties and licensure consequences.
- Confidentiality does not override mandated reporting. This is one of the defined exceptions.
Section 11.2 develops the practical steps. Section 13.2 covers the client-rights and consent framework that surrounds it.
Exam pattern: an option in which the therapist "reports the concern to the supervisor and considers the obligation met" is wrong. So is one in which the therapist investigates to confirm the suspicion first. Reasonable suspicion triggers the report; investigation is the agency's job.
A music therapist employed directly by a public school district documents services delivered under a student’s IEP. These records are generally governed by:
A music therapist forms a reasonable suspicion that a client is being abused and reports the concern to their clinical supervisor. Regarding the mandated reporting obligation, the therapist has:
A client who is deaf requests an interpreter for music therapy sessions in a private outpatient clinic. The client’s adult daughter offers to interpret instead. Under the ADA, the clinic should:
Which federal framework most directly obligates an employer to provide annual training, hepatitis B vaccination, and post-exposure follow-up for a music therapist with occupational exposure to blood?