Does HIPAA regulate non-theraputic massage? If so, is it necessary to keep separate notes on each person?

Question

I work for a company that provides chair massage to companies in Maryland. We address a variety of aches and pains but for the most part just provide a nice 15 minute relaxation massage. There is no insurance work involved. Some of our clients are regulars but we also get many non-repeating ones. The State of Maryland requires that notes be kept on all massages, retained for 5 years and made available to a client upon request. There has been some disagreement as to whether we can write our notes as a running log by shift or if we have to keep a separate note on each person. Any input into this matter would be appreciated.

Answer 1

In April 2003, the US Department of Health and Human Services issued regulations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which may affect some ISPA members.

Essentially, HIPAA's sweeping health information privacy rules are designed to ensure the protection and security of medical records and other personal health information and to protect an individual's right to privacy in matters involving their health care. Where an individual's health information is to be used or disclosed for specific purposes other than for treatment, payment or health care operations, a written authorization is required.


The HIPAA rules apply to all "Covered Entities," defined as health plans, health care clearinghouses and health care providers that transmit any health information in electronic form in connection with a list of specified transactions. ISPA members are not health plans or health clearinghouses. Importantly, however, they may be considered health care providers.

Because of the diversity of services provided by ISPA members, HIPAA's federal privacy requirements may not apply to every ISPA member. If your company does not furnish, bill or receive payment for health care in the normal course of business, then the HIPAA requirement does not affect you. For ease of determining whether your company should comply, follow the HIPAA Decision Tree below.


Finally, if you/your company are not covered health care providers under the federal HIPAA requirements, you also need to check your state privacy laws and regulations to review what is required. As well, it is most wise for your company to develop a statement of privacy or confidentiality in any event, irrespective of whether HIPAA affects its operations.

The decision tree referenced above can be found here:
http://www.experienceispa.com/ISPA/Education/Resources/HIPAA+Decision+Tree.htm

Answer 2

I would keep individual notes on everyone whether it is a HIPAA requirement or not. When I was in nursing school they could not stress enough, CYA-Cover Your ***. You just never know when someone thinks they have been slighted and wants to file a law suit. The more documentation you have the better for your own protection. Plus that client may have been involved in an accident of some kind and later the attorney may request records and billing.

I would also require a signed release from the client before you release the records to anyone.

Answer 3

HIPAA, as it pertains to your situation, requires that you can provide your notes on one specific client to that client without giving them any anyone else's notes.

You could keep the notes as a running log by shift, but it would be better (from a HIPAA standpoint) if you kept a file folder on each particular client. Better yet, a computer database that let you store the notes. That way, when a client requests the notes, you already have them separated.

HIPAA prevents you from disclosing anyone's information to any other party without their consent.

Answer 4

HIPAA would allow for that kind of record keeping, but in the event that a client requests their records you would have to black out/ block out the information that does pertain to them.
You may be "nontherapeutic" but your clients as customers have a certain expectation of privacy of records.
My massage therapist keeps individual files on record for each client - both therapeutic and non-therapeutic.