HIPAA compliance for physical therapy practices in Massachusetts

Massachusetts keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Patient Protect has not recorded any Massachusetts rule that applies to physical therapy practices differently from other providers in the state — the statewide rules below are the ones that reach you.

Massachusetts jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Massachusetts's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Physical therapy practices that electronically submit claims, check benefits, request authorization, or have those transactions conducted on their behalf are HIPAA covered entities. Once covered, the duties below are required across every location and workflow handling PHI.

State — how Massachusetts law interacts with HIPAA

Massachusetts substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Physical therapy practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Massachusetts requires notice content that HIPAA does not require, including the name of the person responsible for the breach if known and whether the entity maintains a written information security program. HIPAA notice alone does not satisfy Massachusetts content requirements.

What Massachusetts adds for physical therapy practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Massachusetts's general breach law, which applies the same way to every business in the state.

No verified intersection rules recorded

Patient Protect has not recorded any Massachusetts rule that applies to physical therapy practices differently from any other practice in the state. Where that is the case, the federal obligations and the Massachusetts rules below are the whole picture, and the physical therapists guidance that applies nationally is the better starting point.

HIPAA compliance for physical therapy practices→

Massachusetts breach obligations

These apply to businesses generally rather than to physical therapy practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Massachusettsbreach data →

Individual notice deadline

As soon as practicable and without unreasonable delay after knowing or having reason to know of the breach or unauthorized use. The statute does not fix a numeric outer bound, but delay past what is reasonable is itself a violation.

The statute does not fix a numeric outer bound. Unreasonable delay is itself a violation and may result in state enforcement action, so treat the operative timeframe as the shortest window your incident circumstances reasonably support.

State regulator notice

Required

Notice must be provided to (1) the Massachusetts Attorney General and (2) the Director of the Office of Consumer Affairs and Business Regulation, in addition to affected residents.

Source: Mass. Gen. Laws ch. 93H, § 3

Statewide rules that also reach physical therapy practices

Minor may consent

A minor may consent to medical or dental care without parental permission where the minor is married, widowed or divorced; is the parent of a child; is a member of any of the armed forces; is pregnant or believes themselves pregnant; is living separately from parents and managing their own financial affairs; or reasonably believes themselves to be suffering from or to have come into contact with a disease defined as dangerous to the public health, OR SEEKS CARE FOR THE PREVENTION OF HIV IF THE MINOR IS SEXUALLY ACTIVE.

What this means operationally

Consent turns on the minor's circumstances rather than age, so intake has to capture status — marital, parental, service, residential, financial — and not merely date of birth. The public-health limb is the one most likely to arise unplanned in a general practice, and it is scoped to the disease rather than to the visit.

Applies when

One or more of the enumerated circumstances applies
For the HIV-prevention limb, the trigger is that the minor is sexually active — not exposure to or belief in a disease

Exceptions

Consent may not be given under the second through sixth circumstances for abortion or sterilization

StatewideMass. Gen. Laws ch. 112, § 12F, consent clauseAll minors under 18Verified 2026-08-29

Parental right of access

A health care provider who maintains records for a patient treated or examined by such provider SHALL PERMIT INSPECTION of such records by the patient or an AUTHORIZED REPRESENTATIVE of the patient, and UPON REQUEST A COPY of the patient's record SHALL BE FURNISHED UPON PAYMENT OF A REASONABLE FEE, AS DEFINED IN SECTION 70 OF CHAPTER 111.

What this means operationally

The operative detail is the cross-reference. Massachusetts does not write a separate fee rule for practices — § 12CC imports the schedule that chapter 111 § 70 writes for HOSPITALS AND CLINICS, so a private dental, optometric or chiropractic office charges on a hospital's schedule. A practice looking only in the professions chapter will not find a figure at all. Note the section states no deadline for an ordinary request; the only stated clock in Massachusetts is the thirty days for benefit-claim requests.

Applies when

A patient or authorized representative asks to inspect, or requests a copy of, records held by a health care provider

StatewideMass. Gen. Laws ch. 112, § 12CCPatients and authorized representativesVerified 2026-08-30

Parental right of access

NO HEALTH CARE PROVIDER SHALL CHARGE A FEE to any applicant, beneficiary or individual representing an applicant or beneficiary for furnishing a health record IF THE RECORD IS REQUESTED FOR THE PURPOSE OF SUPPORTING A CLAIM OR APPEAL UNDER ANY PROVISION OF THE SOCIAL SECURITY ACT OR ANY FEDERAL OR STATE FINANCIAL NEEDS-BASED BENEFIT PROGRAM. A health care provider SHALL FURNISH a health record requested pursuant to such a claim or appeal WITHIN THIRTY DAYS of the request. Any person for whom no fee shall be charged SHALL PRESENT REASONABLE DOCUMENTATION at the time of the records request that the purpose of the request is to support such a claim or appeal.

What this means operationally

This is the only stated response deadline for a Massachusetts practice, and it attaches to the free route rather than the paid one — thirty days for a benefit-claim request, nothing specified for an ordinary request. The documentation condition sits on the requester and must be presented AT THE TIME of the request, so a practice may properly ask what the records are for before waiving the fee, and a later assertion does not retroactively make the copy free. The program list is broad: any provision of the Social Security Act and any federal or state needs-based benefit program, which reaches disability, SSI and state assistance appeals alike.

Applies when

A record is requested to support a claim or appeal under the Social Security Act or a federal or state needs-based benefit program, with documentation presented at the time of request

StatewideMass. Gen. Laws ch. 112, § 12CC; ch. 111, § 70Patients and authorized representativesVerified 2026-08-30

Limit on copy fees, format or delivery

A REASONABLE FEE for these purposes MEANS a BASE CHARGE OF NOT MORE THAN $15 for each request for a medical record; a PER PAGE CHARGE OF NOT MORE THAN $0.50 for each of the FIRST 100 PAGES copied per request; and NOT MORE THAN $0.25 PER PAGE for each page IN EXCESS OF 100 PAGES copied per request. The reasonable fee MAY BE ADJUSTED to reflect the CONSUMER PRICE INDEX FOR MEDICAL CARE SERVICES, such that the base amount and the per page charge shall be increased by the proportional consumer price index in effect AS OF OCTOBER OF THE CALENDAR YEAR IN WHICH THE REQUEST IS MADE, rounded to the nearest dollar. An ADDITIONAL FEE may be charged to cover the cost of POSTAGE, other priority mailing, and PREPARATION OF AN EXPLANATION OR SUMMARY of the record if so requested.

This changes on 2027-10-01

The $15 base and the $0.50 and $0.25 per-page figures in this proposition are the statutory base amounts, not necessarily the lawful charge in any given year. The adjustment recurs annually, so a synthesis quoting these numbers must date them or state that they are subject to CPI adjustment.

What this means operationally

The schedule is degressive — the per-page rate halves after a hundred pages — so a large chart is proportionally cheaper than a small one, which is the opposite of most states. Two practical points. The CPI adjustment is keyed to OCTOBER of the year the request is made, so the lawful figure changes annually and any published number needs a date beside it; rounding to the nearest dollar also means the base charge moves in whole dollars. And the summary-preparation charge is only available where the patient asked for a summary — it is not a general handling fee.

Applies when

A copy of a medical record is furnished under § 12CC or § 70

Exceptions

No fee at all where the record supports a Social Security Act or needs-based benefit claim or appeal

StatewideMass. Gen. Laws ch. 111, § 70Patients and authorized representativesVerified 2026-08-30

What applies to physical therapy practices everywhere

Physical therapy moves treatment beyond the exam room. Home visits, mobile documentation, progress photography, exercise platforms, temporary staffing, workers' compensation, and frequent communication all expand the practice's ePHI surface.

The EHR, scheduling, billing, claims, and patient-portal systems

Home-exercise and patient-engagement platforms that receive identifiable treatment information

Progress photos and videos — including how they are captured, uploaded, stored, accessed, retained, and removed from devices

Laptops, tablets, and phones used in the clinic, during home visits, or while staff work remotely

Telehealth, secure messaging, email, text, e-fax, referral, and care-coordination workflows

Workers' compensation, employer, insurer, case-manager, and attorney disclosure processes

Full physical therapistscompliance guide →

Federal obligations still have to be evidenced for physical therapy practices in Massachusetts.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Massachusetts rules on this page.

Start the risk assessment