Privacy and security for yoga teachers (HIPAA compliance)

Yoga teachers’ responsibilities concerning private student information
Yoga teachers and yoga therapists often handle student information that is considered private and sensitive. According to the Health Insurance Portability and Accountability Act (HIPAA), which became law in the U.S. in 1996, protected health information (PHI) is defined as “any individually identifiable health information relating to the past, present, or future health condition of the individual regardless of the form in which it is maintained (electronic, paper, oral format, etc.).”

PHI includes any health-related information that you receive or create during your work with the student if it contains individually identifiable information, such as a name, address, email address, medical record number, IP address, facial photos, or any other unique identifiers or codes. For example, if the student emails you a lab report, a physical therapy exercise sheet, or a doctor’s recommendations, and the document contains a name, email address, or other identifiable information, it’s PHI, and you’re responsible for keeping it safe. Moreover, any notes you take, whether paper or electronic, in the process of working with your student in which you identify your client in some way are considered PHI. Remember: HIPAA protects any data viewed as PHI.

According to the HIPAA, as a yoga teacher or therapist, you’re a covered entity, i.e., in a direct relationship with the individuals whose PHI you retain. As a covered entity, you bear certain responsibilities under the law that fall under two main categories: the HIPAA Privacy Rule and the HIPAA Security Rule. The HIPAA Privacy Rule focuses on protecting all PHI from a people perspective, and the HIPAA Security Rule establishes minimum safeguards for electronic PHI in terms of technological standards.

Under the HIPAA Privacy Rule, as a yoga teacher or yoga therapist, you’re required to do the following:

• Avoid sharing private client information with anyone, even in casual or educational environments, unless it’s necessary for operating your practice.
• If you must share a client’s PHI as a necessary part of operating your practice, you need to take two precautions:
  – Share the minimum amount of information necessary to perform the task.
  – Ensure that the businesses or people you share this information with (accountants, scheduling services, recordkeeping services, email/hosting companies, marketing services, IT firms, etc.) are HIPAA-compliant.
• Never leave private records lying around; keep paper records locked in a cabinet and electronic records stored under password protection.
• Always log out of websites and accounts before leaving your computer unattended.
• Use a secure email service when sharing PHI.
• Keep PHI records for at least six years.
• Dispose of unnecessary records properly (shred paper records and erase electronic records completely).
• Notify clients about any improper use or disclosure of records.
• Make all records available to clients upon request.

Under the HIPAA Security Rule, as a yoga teacher or therapist, you’re required to set up the following safeguards to protect PHI:

Administrative safeguards: Contingency plans for emergencies (floods, fires, theft, etc.) and procedures for reporting security incidents to clients
Physical safeguards: Door locks and cabinet locks to protect paper records and computers, and data backups stored off-site
Technical safeguards: Encrypted computer hard drives (not required, but recommended), usernames and passwords, firewalls, and other access controls that discourage hackers and protect information from malware and viruses

In addition, as a yoga teacher or therapist, you need to do the following:

• Provide all students with a HIPAA notice of privacy practices (and follow the responsibilities outlined in that document).
• Store and transmit records securely (following the physical and electronic security requirements outlined above).
• De-identify records by removing any identifiable information when using them as case studies or teaching examples.
• Have action protocols for potential security breaches.
• Ensure that organizations you use to manage students’ data are HIPAA-compliant and sign a business associate agreement with each organization.
• (Recommended) Take HIPAA awareness training to understand the law’s intricacies more thoroughly.

These measures might seem overwhelming, but in reality, they are common sense and are already implemented in other industries. All our students should feel assured that whatever information they share with us is handled carefully and stored securely. It’s always better to be prepared than to be caught off guard.