HIPAA Risk Assessment for Physical Therapy Clinics

A HIPAA risk assessment for physical therapy clinics is the written analysis required under 45 CFR § 164.308(a)(1) that identifies every system handling electronic protected health information (ePHI), the threats facing those systems, and the safeguards needed to bring risk to a reasonable level. Physical therapy practices handle unusually detailed clinical information, injury histories, functional assessments, imaging orders, and insurance authorizations, while typically running with administrative staff and IT budgets sized for a small business rather than a hospital system. According to HHS Office for Civil Rights enforcement data, a missing or incomplete risk analysis is cited in 68% of OCR investigations into small and mid-size healthcare providers. This guide walks through the inventory, threat identification, documentation, and reassessment steps a physical therapy clinic's risk assessment needs to cover.

Physical therapy clinics are covered entities under HIPAA whenever they create, receive, maintain, or transmit ePHI. The HIPAA Security Rule, part of 45 CFR Part 164, Subpart C, requires every covered entity to complete an accurate and thorough risk analysis under 45 CFR § 164.308(a)(1). The HHS Office for Civil Rights (OCR), the federal agency that enforces HIPAA, has repeatedly cited incomplete or missing risk analyses as a primary driver of enforcement action against small and mid-size providers.

What makes PT clinics distinct is the combination of lean administrative staff, heavy third-party referral traffic, and clinical detail, injury histories, functional assessments, home exercise videos, that goes beyond a typical primary care note. Practices that refer to or receive referrals from urgent care clinics or chiropractic offices face comparable obligations under the same rule and should confirm those relationships are handled properly.

Clinics often undercount their ePHI inventory because patient data moves through more systems than the EHR alone. Build the inventory first, since it sets the scope boundary for every later step in the assessment.

Healthcare threat analysis tends to focus on large hospital systems, but a PT clinic's size and operating model create a distinct threat profile. The 2024 Verizon Data Breach Investigations Report found that healthcare remains one of the most targeted sectors for ransomware, with system intrusion accounting for the largest share of incidents. For PT clinics, the most common entry point is a phishing email aimed at front-desk or billing staff, roles that routinely handle outside email from insurers, attorneys, and referring physicians, and a single compromised login can expose the entire EHR if multi-factor authentication (MFA), a login method requiring a second form of verification beyond a password, isn't enforced.

Lost and stolen devices are a separate risk. Therapists doing home health visits or working across locations often carry tablets, laptops, or phones with patient data, and physical theft of an unencrypted device is a reportable breach under HIPAA regardless of whether the data was ever opened.

Vendor risk and insider access round out the profile. Most PT clinics rely on three to five third parties that touch ePHI, an EHR vendor, billing service, clearinghouse, and often a telehealth platform or managed IT provider, and each one needs a signed Business Associate Agreement (BAA), a written contract required whenever a third party accesses or processes ePHI on a covered entity's behalf. Reviewing staff access against the minimum-necessary standard at 45 CFR § 164.514(d) and removing credentials promptly when someone leaves reduces the risk of an outdated account turning into an entry point.

A risk assessment without documentation carries the same weight as no risk assessment at all; OCR investigators will ask for the written analysis, and an oral explanation of what was reviewed doesn't satisfy the requirement. Rate each identified gap on likelihood and potential impact to the ePHI confidentiality, integrity, and availability triad, then combine the two ratings to assign an overall risk level.

For every high and medium finding, record the specific vulnerability, the control selected to address it, the responsible person, and a target completion date. This record is the Risk Management Plan, and it demonstrates that the clinic treated its risk analysis as an ongoing process rather than a one-time document.

Telehealth expanded quickly in physical therapy after 2020, and many clinics never formally assessed the platforms they adopted during that period. HHS's COVID-era telehealth enforcement discretion ended in 2023, so any platform used since then must meet the same technical safeguards as any other system that handles ePHI; the guide to HIPAA-compliant video conferencing for telehealth providers covers what that requires in practice.

The risk assessment should also cover remote work generally: whether therapists access the EHR from personal home networks or devices, and what controls, such as a VPN or mobile device management, reduce that exposure. Clinics should also confirm the telehealth platform is covered by a signed BAA before treating it as compliant.

The Security Rule doesn't set a fixed reassessment interval; it requires the risk analysis to stay current. HHS guidance and OCR enforcement history point to an annual review as the practical minimum for most covered entities, with updates triggered by the events above.

Many cyber insurance policies now require evidence of a completed HIPAA risk assessment as a condition of coverage or renewal, which gives clinics an additional reason to keep the documentation current. Specific compliance determinations for a clinic's situation should be reviewed with legal counsel.