Browser-only self-check · nothing typed is stored or sent
Am I a HIPAA covered entity? The self-check for a California therapist.
The rule turns on one fact: whether you, or anyone acting for you, send a standard transaction electronically. Answer for the five a therapy practice could send and the page gives the verdict with the definition it comes from, and what California requires either way.
Your transactions →Your transactions
Five questions, in the definition’s own list.
These are the transaction types from the definition of “transaction” in 45 CFR 160.103 that a therapy practice could plausibly conduct; the paragraph number is shown. Answer for the practice, not for a client: if a billing service or your EHR sends it, you send it.
a claim sent to a health plan for payment; a claim your EHR, billing service or clearinghouse sends for you counts
checking a client's coverage or benefits with the plan
asking the plan where a claim stands
requesting or confirming an authorization for sessions
receiving an electronic remittance (ERA) or an EFT payment from a plan
The rule
Three sentences do the work.
“Covered entity means: (1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.” 45 CFR 160.103. A therapist is a health care provider: “any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.”
CMS’s decision tool, endnote 2: “If a healthcare provider uses another entity (such as a clearinghouse) to conduct covered transactions in electronic form on its behalf, the health care provider is considered to be conducting the transaction in electronic form.”
160.103 on electronic media: “Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media if the information being exchanged did not exist in electronic form immediately before the transmission.” A claim under 162.1101 is a request for payment “from a health care provider to a health plan”; a superbill the client submits is the client’s filing, which is this site’s reading of that definition, not HHS’s words.
Civ. Code 56.05(p): “Provider of health care” means a person licensed or certified under Division 2 of the Business and Professions Code, which is where every Board license sits. The Confidentiality of Medical Information Act’s disclosure limits (56.10) do not wait for HIPAA.
Then what
Where this sits.
The list this belongs on
Opening a private practice: the checklist
The Notice of Privacy Practices is one of sixteen items, each with its rule.
The platform question
California telehealth rules for therapists
What the Board requires of the session, whichever platform carries it.
If you never bill a plan
Superbills and the good faith estimate
The federal estimate rule applies to self-pay clients whether or not you are covered.
The notice every licensee gives anyway
The Notice to Clients generator
The Board’s notice, in the statute’s words, with your details filled in.
Where every figure came from
Sources.
The federal rule
- 45 CFR 160.103, definitions: covered entity, health care provider, transaction, electronic media, business associate (eCFR, read 4 September 2026)
- 45 CFR 162.1101, the health care claims transaction
- CMS, Are You a Covered Entity? (page last modified 16 March 2026)
- CMS, Covered Entity Decision Tool (PDF), endnote 2 on transactions conducted on the provider's behalf
- HHS, Covered Entities and Business Associates (reviewed 21 August 2024)
- HHS FAQ 190, Who must comply with HIPAA privacy standards?
What follows for a covered entity
California
Nothing selected here leaves the browser. The page applies the definitions to your answers; it does not decide whether any product or arrangement meets them.
