HIPAA lets PT clinics treat patients in an open gym if they use reasonable safeguards. Use a private room for sensitive talks, lower voices, and keep full names off whiteboards next to conditions. Also keep a risk assessment, a signed BAA (Business Associate Agreement) with each vendor handling patient data, a device policy, and staff training logs.
Every physical therapy clinic has the same architectural feature and the same HIPAA question. The feature is the open gym: six tables, four patients, two therapists, one big room. The question is whether treating people in that room, where everyone can hear everyone, is a federal privacy problem.
It is not. HIPAA was written for the real world, and the real world includes open treatment areas. But the rule that makes the open gym legal comes with conditions, and the conditions are where PT clinics actually fail. This article covers the open-gym rules, the PHI a PT clinic holds that nobody thinks of as PHI, the vendor list that needs BAAs (Business Associate Agreements), and the common gaps to look for in your own clinic.
HIPAA Compliance for Physical Therapy: What the Rules Actually Ask
Why the Open Gym Is Legal
Two provisions do the work. 45 CFR 164.502(a)(1)(iii) permits disclosures "incident to" an otherwise permitted use: the unavoidable overhearing that comes with running a clinic in a shared space. And 45 CFR 164.530(c) requires "reasonable safeguards" to keep those incidental disclosures small.
"A covered entity must reasonably safeguard protected health information to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure."
45 CFR 164.530(c)(2)(ii)
Reasonable is the operative word. Nobody expects soundproof pods between treatment tables. What OCR (the HHS Office for Civil Rights, which enforces HIPAA) expects is that you thought about it and wrote the thinking down: initial evaluations and sensitive conversations happen in a private room, therapists lower their voices for diagnosis talk on the floor, progress discussions stick to the exercise in front of you, and the whiteboard by the door does not list full names next to conditions. Put those four practices in a written policy. They help keep overheard talk an incidental disclosure. That is a side effect of normal care that HIPAA allows, as long as you use reasonable safeguards and share only what is needed.
The PHI Nobody Counts
Ask a PT clinic where its PHI (Protected Health Information, meaning health details that can be tied to a specific patient) lives and you will hear "the EMR." The real inventory is longer: outcome questionnaires on clipboards, the schedule grid visible at the front desk, home exercise program printouts left on tables, photos and videos of patients demonstrating movement (those are PHI the moment they are identifiable), text threads with patients about scheduling, and the referral faxes from physicians stacked by the printer. Every one of those needs a home in your risk assessment, because every one of them walks out the door in a different way.
The Vendor List That Needs BAAs
PT clinics run on a specific software stack, and most of it touches PHI: the EMR and scheduling platform, the home exercise program app that emails patients their routines, the outcomes-tracking service, the billing clearinghouse, and any texting or reminder platform. Each one is a business associate, and each one needs a signed BAA before PHI flows, not after. The test is simple: if the vendor creates, receives, maintains, or transmits PHI for you, it is on the list. The BAA guide covers what the agreement must say, and BAA management is the ongoing part practices skip.
I have seen this gap firsthand. One single-location practice I worked with had several vendors handling PHI with no BAA in place. We got every missing BAA signed and set up a vendor review the office can repeat.
The Gaps That Show Up in PT Clinics
The common gaps in small outpatient clinics are boring and repeatable: no documented risk assessment, no mobile device policy while therapists text patients from personal phones, home-program apps adopted by one enthusiastic therapist with no BAA, and front-desk conversations in a lobby three feet from the waiting chairs. The front desk rules cover that last set. None of these are exotic. All of them are findable in an afternoon of honest self-review.
Staff and Students
PT clinics host students, aides, and techs, and the workforce rules apply to all of them: training within a reasonable time after they join, unique logins (a shared tablet login on the gym floor fails this), and access scaled to role per the minimum necessary rule. A student on rotation is your workforce for HIPAA purposes; their training is your responsibility, and it belongs in your training program records.
What a Compliant PT Clinic Actually Looks Like
Not quieter. Not slower. It has five documents: a risk assessment that mentions the open gym by name, a front-office and floor policy with the four practices above, a BAA file with every software vendor in it, a device policy covering the personal phones that already exist, and training logs for everyone including students. That is the whole visible difference. OCR can ask to see these records when it looks into a complaint.
| Document | What it covers in a PT clinic |
|---|---|
| Risk assessment | Names the open gym, plus the PHI nobody counts: clipboards, the schedule grid, exercise printouts, patient videos, texts, and referral faxes. |
| Front-office and floor policy | The four practices: a private room for sensitive talks, lowered voices, progress talk kept to the exercise, and no full names next to conditions on the whiteboard. |
| BAA file | A signed BAA from every vendor that touches PHI: EMR and scheduling, home exercise app, outcomes tracking, billing clearinghouse, and texting or reminder platform. |
| Device policy | The personal phones therapists already use to text patients. |
| Training logs | Everyone, including aides, techs, front desk staff, and students on rotation. |
The point is a program the office can actually run. A small multi-specialty practice I worked with built a workflow its office manager could keep up.
It does not have to take months, either. A Florida mental health franchise office came to me with policies never written, records with holes, training half done, and a state auditor due in days. In under a week the office was audit-ready, and it passed its state audit.
FAQ
Are open treatment gyms a HIPAA violation?
No. Incidental overhearing in shared treatment spaces is permitted under 45 CFR 164.502(a)(1)(iii), provided the clinic applies reasonable safeguards: private space for sensitive conversations, lowered voices, and no identifying displays.
Do physical therapists need HIPAA training?
Yes. Every workforce member needs training. That includes aides, techs, front desk staff, and students on rotation. Train each new person within a reasonable time after they join. Train them again when a policy change affects their job.
Is a home exercise program app a business associate?
If it stores or transmits identifiable patient information for your clinic, yes. It needs a signed BAA before patient data goes in, and it belongs in your vendor inventory.
Can PT clinics text patients?
Yes, within limits: appointment logistics with minimal content are workable, clinical details need a secured channel and patient agreement. Put your texting rules in a written policy.
Are videos of patients exercising PHI?
If the patient is identifiable, yes. Recording for documentation, education, or marketing each has different rules, and marketing use requires written authorization.
One Guy Consulting works with small practices like this: small teams, open floor plans, no compliance officer on payroll. The Full-Scope plan is a flat $1,300 a year per location, no matter how many staff you have. It includes policy and procedure templates, staff training, and 4 hours a month of 1:1 implementation calls with Chuck. Start with a free 30-minute intro call. No obligation, no pressure.
One Guy Consulting in 37 seconds
Sources
- 45 CFR 164.502 (incidental disclosures)
- 45 CFR 164.530(c) (reasonable safeguards)
- HHS guidance: Incidental Uses and Disclosures
Related Reading
Try three One Guy Consulting 3D staff training courses free →