HIPAA Compliance for Concierge Medicine Practices

The HIPAA compliance and security operating system for concierge practices. Greater access for the patient means more communication paths, more service partners, more personal devices — and a patient roster that attracts targeted social engineering. Patient Protect runs the risk analysis across that surface, sets communication and access policy, and keeps the evidence.

Get your Patient Protect Score — free

Most concierge practices remain HIPAA covered entities because they electronically bill, check eligibility, prescribe within plan workflows, or conduct other adopted transactions. The retainer model does not cancel that status. Once covered, the duties below are required.

HIPAA compliance is not optional for a covered concierge practice.

If your practice is a HIPAA covered entity, it is required to maintain an active, documented compliance program — and if it performs covered functions as a Business Associate, it must implement the Security Rule and every other duty attaching to that role. The responsibility does not transfer to your EHR, IT company, consultant, insurance carrier, or software provider. Those partners can support the work; your practice remains responsible for completing it.

Watching one training video is not a compliance program. Downloading a policy template is not a compliance program. Signing one BAA is not a compliance program. HIPAA requires your practice to implement, maintain, and document the complete operating system behind each of those activities.

Your practice is required to do all of the following

The duty

What it requires

Where it is written

01Conduct and document a Security Risk Analysis
Identify every place electronic protected health information enters, moves through, or leaves the practice. Assess the systems, devices, people, vendors, locations, workflows, threats, and vulnerabilities that could compromise that information.
45 CFR §164.308(a)(1)(ii)(A)
02Manage the risks the analysis uncovers
Turn identified risks into a documented remediation plan. Assign responsibility, prioritize the work, implement safeguards, and preserve evidence showing how the practice responded.
45 CFR §164.308(a)(1)(ii)(B)
03Designate Privacy and Security Officials
Assign and document who is responsible for developing, maintaining, and enforcing the practice's privacy and security program. In a small practice, one person may perform both roles — but the responsibilities must still be assigned and documented.
45 CFR §164.530(a) · §164.308(a)(2)
04Maintain written policies and procedures
Document how the practice protects patient information, controls access, handles permitted disclosures, responds to incidents, enforces workforce accountability, and maintains required privacy and security safeguards.
45 CFR §164.316(a) · §164.530(i)
05Train the entire workforce
Train workforce members on the privacy policies relevant to their roles and maintain an ongoing security-awareness program. Preserve records showing who was trained, what the training covered, and when it was completed.
45 CFR §164.530(b) · §164.308(a)(5)
06Identify and govern every Business Associate
Determine which vendors and service providers create, receive, maintain, or transmit protected health information on the practice's behalf. Execute the required Business Associate Agreement before protected information flows and maintain the agreement as part of the practice's compliance record.
45 CFR §164.502(e) · §164.308(b) · §164.504(e)
07Implement administrative, physical, and technical safeguards
Control who can access patient information, secure the systems and locations where it is maintained, review activity, authenticate users, protect data integrity, and safeguard electronic transmission.
45 CFR §164.308 · §164.310 · §164.312
08Protect patient privacy rights
Maintain the required notices, authorization processes, complaint procedures, and workflows for responding to patient requests involving access, amendments, confidential communications, restrictions, and applicable disclosure accounting.
45 CFR §164.520 · §164.524 · §164.526 · §164.522 · §164.528
09Prepare for incidents, outages, and breaches
Maintain security-incident procedures, data backup, disaster recovery, emergency operations, mitigation, and breach-notification processes before an event occurs.
45 CFR §164.308(a)(6) · §164.308(a)(7) · Subpart D
10Preserve proof that the work was completed
Retain the assessments, risk decisions, policies, training records, official designations, BAAs, acknowledgments, incident records, and other documentation needed to demonstrate what the practice actually did.
45 CFR §164.316(b) · §164.530(j)

The Security Risk Analysis is where the work begins.

The Security Rule requires an accurate, thorough assessment of the risks and vulnerabilities affecting every form of electronic protected health information your practice creates, receives, maintains, or transmits. This is commonly called a Security Risk Analysis, or SRA.

The federal government publishes its own Security Risk Assessment Tool for small and medium-sized practices. You are not required to use that particular tool. You are required to perform and document the underlying analysis.

Patient Protect provides its own guided SRA. It walks the practice through the assessment in plain language, identifies what is missing, and carries those findings into risk management, remediation, policies, tasks, and documentation — so the assessment ends with the problem assigned and resolved, not merely named.

A five-minute readiness quiz is not an SRA. Reviewing only your EHR is not an SRA. Reusing an old checklist that no longer reflects your systems, vendors, workforce, or workflows is not an SRA.

That includes our own free tool. The Patient Protect Score is a free exposure scan and a starting point. It is not your completed Security Risk Analysis, and we will not tell you it is.

What a concierge practice’s Security Risk Analysis must cover

Concierge medicine increases patient access — and often increases the number of communication paths, service partners, personal devices, after-hours interactions, and people attempting to obtain information. The SRA must reflect that higher-touch operating model.

The EHR, portal, membership, billing, scheduling, and direct-communication systems
Physician and staff use of personal or practice-issued phones, email, text, messaging, and after-hours communication
Travel medicine, home visits, mobile care, remote access, and care delivered outside the primary office
Laboratories, imaging, hospitals, specialists, executive-health, second-opinion, and care-coordination workflows
Family members, personal assistants, household staff, patient representatives, and others requesting access or information
Prominent-patient, executive, public-figure, and other records likely to attract targeted access or social engineering
24/7 nurse lines, answering services, travel partners, IT support, cloud systems, and other vendors handling PHI on the practice's behalf

What the concierge compliance program must also address

Minimum-necessary and role-based access calibrated to a smaller, high-touch workforce
Written confidential-communication preferences for each patient
Social-engineering and targeted-access procedures for prominent or high-profile patients
Business Associate governance for concierge-specific service partners
Incident-response procedures that account for patient representatives, reputational exposure, and rapid escalation
Training on family, assistant, media, travel, after-hours, and direct-physician communication scenarios

Greater access for the patient cannot mean uncontrolled access to the patient's information.

The honest answer to the question concierge practices most often misclassify.

Most vendor content gives a marketing-flavored hedge. The page below answers the question directly, with primary-source references where they exist. This is the section that matters most if you’re trying to figure out whether your operation is actually a covered entity.

Covered entity status

Most concierge practices are covered entities under 45 CFR §160.103, and the analysis is usually straightforward: they submit electronic claims and run eligibility verification, both of which are standard transactions adopted under 45 CFR Part 162. The retainer-fee component does not change that. Worth noting for accuracy — e-prescribing and electronic referrals are not themselves adopted covered transactions, so a practice that has dropped insurance entirely should re-run the test rather than assume its status carried over. For the large majority of concierge practices that still bill in some form, coverage attaches and stays attached.

Business associate status

Concierge practices are providers, not BAs. The BA cascade applies in the standard direction: the EHR, billing service, e-prescribing platform, lab interfaces, secure messaging tool, telehealth platform, payment processor where PHI flows, and any concierge-specific service vendors (24/7 nurse line, travel medicine partners, executive health screening providers) are all BAs and require BAAs under §164.308(b)(1).

Where the gray zone lives

The genuine gray zone for concierge practices is not whether HIPAA applies — it does — but rather the heightened operational requirements that come with serving prominent patients. HIPAA's minimum-necessary standard under §164.502(b) takes on heightened weight when the patient is a public figure: every additional staff member with access to the record increases the breach surface for a target whose breach has outsized media and reputational consequences. Some concierge practices operate enhanced privacy protocols (compartmentalized records, named-physician-only access, reduced administrative footprint) that exceed HIPAA minimums but reflect the actual threat model. The practice's choice is whether to formalize and document these enhanced protocols — making them legally defensible — or operate them informally where they fail the audit framework.

State consumer-health law

State medical privacy laws (California CMIA, Texas HB 300, New York's SHIELD Act health-data provisions) add layers above HIPAA, particularly for practices in jurisdictions that concentrate concierge operations. Some states impose stricter notification timelines than HIPAA's 60 days; some impose AG-notification thresholds that catch incidents HIPAA wouldn't require reporting at the federal level. Concierge practices operating in multiple states face a notification matrix calibrated to the prominent-individual scenario — the kind of breach where state AGs typically engage.

Operational events that move a concierge practice from theoretical non-coverage into clearly-covered-entity territory.

Submitting any electronic health care claim (837), including for the insurance-billed portion of a hybrid retainer model.
Conducting electronic eligibility or benefit verification (270/271).
Requesting prior authorization or referral certification electronically (278).
Checking claim status electronically (276/277), or receiving electronic remittance advice (835).
Having a billing service, management company, or clearinghouse conduct any of the above for the practice.

What does not, by itself, make you a covered entity: sending an electronic prescription, submitting an electronic lab order, receiving an HL7 or FHIR result, running a patient portal, making an ordinary electronic referral, storing treatment photographs, hiring a medical director, or performing a medical service. None of these appear on CMS’s list of adopted standard transactions. They may still carry real security and state-law obligations — they just are not what decides HIPAA covered-entity status.

OCR has not published large-scale enforcement actions targeting concierge practices specifically as a segment, but breaches involving prominent individuals — including the 2017 OCR resolution agreement with Memorial Healthcare System ($5.5 million) and several cases involving celebrity-patient breaches at large hospital systems — signal heightened agency attention when prominent individuals are affected. The OCR's risk-tier model under the HITECH Final Rule explicitly considers the harm potential of the breach, which scales with the prominence of affected patients. A concierge breach involving public figures is positioned to attract enforcement at the upper end of OCR's discretion.

OCR enforcement record observation

Not legal advice. This page summarizes how HIPAA and related state consumer-health privacy laws apply to concierge medicine practices based on Patient Protect’s reading of the relevant CFR provisions and state statutes. Operators with applicability questions specific to their setup should consult a qualified HIPAA attorney. Patient Protect is a HIPAA compliance platform; we are not a law firm and do not provide legal advice.

Where concierge medicine practices are most exposed.

Standard risk analysis missing the actual threat model

Most concierge practices use compliance vendors that produce risk analyses calibrated for general primary care. The actual concierge threat model — paparazzi-driven social engineering, celebrity-patient targeting, asymmetric breach impact — is not what those analyses cover. The result is a documented risk analysis that satisfies the audit but does not protect the practice from the threats it actually faces.

Concierge-specific partner BAAs missing across the long tail

Beyond the standard EHR/lab/billing BAAs, concierge practices typically have ten to twenty partner relationships that touch PHI: 24/7 nurse lines, travel medicine partners, executive health screening, second-opinion services, mental health referral networks, dietitians, physical therapists, advocacy services. Most have unsigned templates or no BAA at all on the long-tail partners.

Asymmetric breach impact for prominent-patient incidents

A breach affecting one prominent patient can produce more reputational, legal, and regulatory consequence than a breach affecting hundreds of routine patients. Most concierge operators have not run the breach-impact analysis with the patient prominence factored in, and consequently have not built a response protocol calibrated to the actual stakes.

Patient communication discipline at the boundary of concierge accessibility

Concierge's value proposition includes direct, accessible communication with the physician — text, email, video, phone. The compliance reality is that patient communications must travel through HIPAA-compliant channels. Many concierge practices operate under informal communication patterns that create §164.530 exposure on every message.

Built for concierge medicine practices, not hospital systems.

Risk analysis modeling the concierge-specific threat surface

The SRA wizard models the actual threat surface concierge practices face: social engineering, paparazzi-driven access attempts, prominent-patient targeting, asymmetric breach impact. The output is a risk register grounded in the actual threats, not the generic primary-care threat model competitors design around.

Compartmentalized access controls calibrated for prominent patients

Role-based access management with explicit support for compartmentalized record access — named-physician-only sections, reduced administrative footprint per record, granular logging of access to identifiable prominent-patient records. Documented under §164.502(b) for audit defensibility.

BAA tracking for the concierge partner ecosystem

The Vendor Risk Scanner pre-loads the long-tail concierge partner ecosystem: 24/7 nurse lines, travel medicine partners, executive health screening providers, second-opinion services, mental health referral networks, advocacy services. Surfaces the BAA gaps generic compliance vendors miss because they don't model the concierge operating pattern.

Heightened breach response protocols for prominent-patient scenarios

Pre-built breach response with accelerated timelines, pre-drafted patient communications, AG-coordination procedures, and media-handling protocols specific to prominent-patient incidents. Assembled before any incident occurs rather than during the 72-hour window after one.

Secure communication that fits the concierge accessibility model

HIPAA-compliant text, email, and video that doesn't make the practice less responsive than the SMS-and-personal-email pattern it replaces. Audit-logged, role-aware, and calibrated for after-hours physician-direct communication.

Continuous compliance scoring with prominent-patient overlay

Real-time compliance recalculation that accounts for prominent-patient roster changes, new partner relationships, communication pattern drift. The dashboard surfaces the specific risks that scale with the patient base, not just the generic compliance score.

HIPAA already requires the work. Patient Protect starts at $39 a month.

For a covered practice, HIPAA does not ask whether the organization has the budget, internal expertise, or spare time to build a compliance program. The obligation already exists. The only real question is whether you run it through spreadsheets, generic templates, disconnected training and scattered agreements — or keep the whole program in one place.

Guided Security Risk Analysis
Risk-management and remediation workflows
48 customizable policies and procedures
HIPAA Foundations workforce training
Completion tracking and verifiable training certificates
Workforce and vendor management
Business Associate Agreement tracking and documentation
Compliance scoring and centralized audit evidence

Start your 14-day free trial

$39 per office per month · Up to 25personnel · No long-term contract

State-specific HIPAA rules for concierge medicine practices.

HIPAA is federal. What a state adds on top of it varies more than most compliance guidance admits — some states impose their own notification deadline and regulator notice, and others exclude HIPAA covered entities from their breach statute entirely. Select your state to see which of those is true where you practice.

Select your state

Browse all 50 states and DC

Each jurisdiction sets its own notification window, regulator threshold, and adjacent privacy rules — and its own answer to whether those reach a HIPAA covered entity at all. Open a state page for the concierge practices reference summary.

What happens after the paperwork is done.

Every major compliance platform covers risk assessments and policy templates. This is the part that differs.

What to ask

Patient Protect

Risk analysis structured to §164.308(a)(1)(ii)(A)

A readiness quiz is not a risk analysis.

Full SRA wizard mapped to NIST CSF with live scoring

Auto-generated policies with workforce acknowledgment

HIPAA requires documented proof your staff reviewed them.

48 policies from your risk profile, versioned acknowledgment

Staff training with delivery tracking

§164.308(a)(5) — sending a PDF is not sufficient.

HIPAA Foundations — 19 modules, 95 assessment questions, verifiable certificates

Full BAA lifecycle management

Expired BAAs are a top enforcement target.

E-signature, renewal alerts, Vendor Risk Scanner

Yes on all 9. Now run the checklist on the rest.

From $39/mo · No long-term contracts.

Start free trial See pricing

Enterprise-grade compliance. Independent-practice pricing.

No contracts · No setup fees · Cancel anytime

Basic

$39/mo

Risk assessments, policies, BAA management, training, compliance scoring, secure messaging, and standard PIPAA usage.

Start 14-day free trial

Recommended

Pro

$99/mo

Everything in Basic, plus the patient-facing workflows. Patient Management and Digital Forms, expanded PIPAA usage, and up to 50 personnel.

Start 14-day free trial

See full feature comparison →

Common questions about HIPAA compliance for concierge medicine practices.

Does HIPAA apply to a concierge medicine practice that bills insurance plus charges a retainer?

Yes. The retainer-fee structure does not change HIPAA's covered-entity analysis. Concierge practices conducting standard electronic transactions — insurance claims, eligibility verification, e-prescribing, electronic referrals — are covered entities under §160.103 from inception, regardless of the additional retainer relationship.

Are concierge practices subject to heightened HIPAA enforcement attention?

OCR's risk-tier model under the HITECH Final Rule explicitly considers the harm potential of a breach, which scales with the prominence of affected patients. Concierge breaches involving public figures, executives, or other prominent individuals are positioned to attract enforcement at the upper end of OCR's discretion. The agency has not published a formal segment-specific stance, but enforcement patterns in adjacent contexts (celebrity breaches at hospital systems) suggest heightened attention.

How does HIPAA's minimum-necessary standard apply to prominent-patient scenarios?

Section 164.502(b) requires reasonable efforts to limit PHI access to the minimum necessary for each workforce role's function. For concierge practices, this often justifies compartmentalized record access — named-physician-only sections, reduced administrative footprint, explicit role-based controls that exceed the practice's general minimum-necessary policy. Documenting these enhanced controls makes them audit-defensible.

Do we need BAAs with every concierge-specific partner?

Yes. Every entity receiving PHI on the practice's behalf is a business associate under §160.103: 24/7 nurse lines, travel medicine partners, executive health screening providers, second-opinion services, mental health referral networks, advocacy services. Each requires a current signed BAA under §164.308(b)(1) before any PHI flows.

What state laws apply to concierge practices beyond HIPAA?

California's CMIA, New York's SHIELD Act health-data provisions, Texas HB 300, plus any state-specific medical privacy laws applicable in operating jurisdictions. Some impose stricter notification timelines than HIPAA's 60 days; some impose AG-notification thresholds that catch incidents HIPAA wouldn't require reporting federally. Multi-state concierge practices face a state-by-state matrix.

How should we handle direct patient communication that's part of the concierge value proposition?

Patient communications containing PHI must travel through HIPAA-compliant channels — that is non-negotiable. The implementation question is how to maintain concierge-level accessibility while satisfying §164.530. The practical answer is a HIPAA-compliant messaging platform that fits the direct-physician-access pattern: low-friction, after-hours capable, audit-logged, and indistinguishable in user experience from the SMS workflow it replaces.

What's the simplest path to a defensible compliance program for our concierge practice?

Five steps: (1) risk analysis modeling the concierge-specific threat surface, (2) compartmentalized access controls under §164.502(b), (3) BAAs with every standard and concierge-specific partner, (4) pre-built breach response protocol for prominent-patient scenarios, (5) workforce training including social engineering scenarios. Patient Protect handles all five at $99/month for Pro.

Does a concierge practice have to complete a HIPAA Security Risk Analysis?

Yes. Most concierge practices are straightforwardly covered because they bill, verify eligibility, or conduct other adopted transactions alongside the retainer, and every covered practice must conduct and document an accurate, thorough assessment of the risks affecting all its ePHI. For a concierge practice that means the EHR, portal, membership and billing systems, physician and staff use of personal devices for direct and after-hours communication, travel and home-visit care, laboratory and hospital coordination, the records of patients likely to attract targeted access, and every service partner from the answering service to the executive-health provider. The retainer model changes the service level, not the analysis.

Which of our concierge vendors need Business Associate Agreements?

Any organization handling PHI on the practice's behalf: the EHR and portal vendors, membership and billing platforms, answering service, secure messaging, telehealth platform, cloud storage and backup, IT support, and concierge-specific service partners that administer care on the practice's behalf rather than delivering it themselves. The distinction matters here more than most places, because a 24/7 nurse line, travel medicine provider, executive-health screening service, second-opinion service, dietitian, or therapist may well be an independent treating provider — in which case the relationship is a treatment disclosure, not a business associate arrangement. Classify each partner individually; this segment has more of them than most.

A patient's assistant is asking for records. What do we do?

Treat it as an authority question, not a relationship question. An executive assistant, family member, or household staffer has no HIPAA right of access simply by being close to the patient. There are three legitimate paths: the person is the patient's personal representative under state law, the patient has signed an authorization naming them, or the patient has requested confidential communications routed through them and that request is documented. Absent one of those, the answer is no — regardless of how well-known the assistant is to the front desk, and regardless of how routine the request feels. This is the single most-exploited path in social engineering aimed at prominent patients, precisely because refusing feels like poor service. Put the standing authorizations on file in advance so the staff is confirming a record rather than making a judgment call under pressure.

Is the government's Security Risk Assessment Tool mandatory?

No. The government's SRA Tool is one method designed to help small and medium-sized organizations perform the required analysis. HIPAA requires the underlying risk analysis — not the use of one particular tool. Patient Protect provides its own guided SRA and connects the findings directly to remediation, policies, tasks, and documentation.

Does our EHR make the practice HIPAA compliant?

No. An EHR may provide important safeguards for the records it maintains, but it does not conduct the practice's complete SRA, remediate every identified risk, train the workforce, manage all policies, identify every Business Associate, prepare the practice for incidents, or preserve the full body of compliance evidence.

How much does Patient Protect cost for a concierge practice?

Patient Protect Basic costs $39 per office per month and includes up to 25 personnel. It includes the guided Security Risk Analysis, risk management, policies, workforce training, workforce and vendor management, BAA tracking, compliance scoring, and centralized documentation needed to operate the practice's core HIPAA compliance program.

See all FAQs →

Corrections & Updates

Healthcare security data changes as investigations progress, vendors update systems, and laws and guidance evolve. If you see something outdated, incomplete, or incorrect — or have newer source material — we’d appreciate hearing from you.

Submit a correction →

“

Patient Protect is intuitive, proactive, and affordable — exactly what small clinics like ours need to keep patient data safe and stay on the right side of HIPAA.

Dr. Thomas E Murray, D.D.S.Patient Protect Member Since 2017

Also built for

Dentists Therapists Chiropractors Optometrists Physical Therapists Medical Practices Telehealth Dermatology Pediatrics Psychiatry Urgent Care DPC Practices GLP-1 Clinics HRT / TRT Clinics Med Spas

Compliance built for the patient base concierge practices actually serve.

$99/month for Pro — the tier most concierge practices need given the prominent-patient threat model. Includes secure messaging, the AI compliance assistant, and prominent-patient overlay tracking.

Get your Patient Protect Score — free See pricing

Or explore the full HIPAA compliance software comparison — or all HIPAA compliance solutions