>but in that case it seems like HIPAA would apply to these Not necessarily, HIPAA applies only to "covered entities" https://www.cms.gov/Regulations-and-Guida

>but in that case it seems like HIPAA would apply to these Not necessarily, HIPAA applies only to "covered entities" https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/HIPAA-ACA/AreYouaCoveredEntity https://www.cms.gov/Regulations-and-Guidance/Administrative-... >Providers who submit HIPAA transactions, like claims, electronically are covered. If you aren't doing any sort of "transactions" (ie not submitting insurance claims) then you don't have to comply with HIPAA - even if you are providing health services and are storing and processing health information. The "I" in HIPAA stands for "insurance," as a general rule, if an insurance company is never involved HIPAA probably doesn't apply. HIPAA is extremely misunderstood, people think it is a general medical privacy law, but it is not, it's a law that regulates insurance companies.