In this article
The short answer
Most independent health and wellness coaches in the US are not covered by HIPAA, because HIPAA applies to covered entities (health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in standard transactions such as insurance billing) and to the business associates who work for them.
If you are paid directly by clients and don't bill insurance or work on behalf of a covered entity, HIPAA usually doesn't apply to you. You still owe your clients care with their information, and other privacy laws may apply.
When HIPAA does apply to a coach
You work inside or on behalf of a covered entity, for example a clinic, a physician practice or a health plan's wellness programme. In that case you're usually a business associate and will be asked to sign a Business Associate Agreement (BAA).
You are yourself a healthcare provider who bills insurance electronically, for example a registered dietitian billing health plans.
Try it with your own clients
Clients, sessions, payments, check-ins and WhatsApp reminders in one place. Free for 14 days, no card.
What HIPAA-compliant software means
Software is not "HIPAA certified": there's no official certification. In practice it means the vendor will sign a BAA and has the administrative, physical and technical safeguards the HIPAA Security Rule requires.
If HIPAA applies to you, choose a platform that will sign a BAA. Practice Better, Healthie and several others are built for that.
If HIPAA doesn't apply to you
Choose software that keeps client data in one secure place rather than in chat apps and spreadsheets, lets you delete a client's data on request, and makes consent part of intake. If you coach clients in the UK or EU, GDPR applies to health data regardless of HIPAA.
CoachevaOS is built for this group: health, wellness and nutrition coaches who want intake, check-ins, progress, sessions and payments in one place.
Good privacy habits either way
Whether or not HIPAA applies, clients trust you with sensitive information. Keep health details inside your coaching platform rather than in personal chat apps or email, and only collect what you need.
Know which tools hold client data, and remove access for anything you no longer use. Have a plan for what you'd do if a device were lost.
If you coach clients in the UK or EU, GDPR applies regardless of HIPAA; see our GDPR guide.
A quick way to think it through
This is general information, not legal advice. If you're unsure, ask a healthcare compliance professional.
| Your situation | HIPAA likely relevant? |
|---|---|
| Independent wellness or habit coach, clients pay you directly | Often not, but check |
| You work inside or are contracted by a clinic, insurer or provider | Likely yes |
| You bill health insurance for your services | Likely yes |
| You coach clients outside the US only | HIPAA is US law; local privacy law (e.g. GDPR) applies instead |
Frequently asked questions
Usually not. Covered entities are health plans, clearinghouses and providers who bill electronically in standard transactions. A coach becomes subject to HIPAA mainly by working as a business associate of a covered entity.