HIPAA compliance for therapy practices in Alaska
Alaska keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Patient Protect has not recorded any Alaska rule that applies to therapy practices differently from other providers in the state — the statewide rules below are the ones that reach you.
Alaska jurisdiction record verified against primary state authority November 2026. General reference, not legal advice.
Does this reach your practice?
Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Alaska's own law reaches a practice that HIPAA already covers.
Federal — is this practice a covered entity
A therapy practice is a HIPAA covered entity when it or a service acting for it electronically conducts an HHS-adopted standard transaction, such as a claim or eligibility inquiry. Cash-pay status alone does not answer the question. Covered practices must complete every duty below; non-covered practices may still be governed by state mental-health privacy, professional, and contractual requirements.
State — how Alaska law interacts with HIPAA
Alaska's breach-notification statute contains no HIPAA-specific provision. Therapy practices must satisfy the state regime on its own terms, independently of anything HIPAA requires.
Alaska's breach article (AS 45.48.010-.090) contains no HIPAA, covered-entity, business-associate, or federal-regulator provision, and a keyword search of the whole of chapter 45.48 found none. The only federal-law carve-outs in the chapter concern Gramm-Leach-Bliley (§ 45.48.040(c) for consumer-reporting-agency notice; § 45.48.540(b) for records disposal). A HIPAA-regulated practice that owns or licenses Alaska residents' personal information must therefore meet Alaska's duties on their own terms, alongside the HIPAA Breach Notification Rule. Alaska's breach-article definition of personal information does not include medical or health information (§ 45.48.090(7)): a breach of protected health information that involves none of the listed elements (Social Security number, driver's license or state ID number, financial account or card number, or financial-account passwords, PINs, or access codes) does not trigger the Alaska breach-notice duty, although HIPAA may still require notice.
What Alaska adds for therapy practices specifically
Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Alaska's general breach law, which applies the same way to every business in the state.
No verified intersection rules recorded
Patient Protect has not recorded any Alaska rule that applies to therapy practices differently from any other practice in the state. Where that is the case, the federal obligations and the Alaska rules below are the whole picture, and the therapists guidance that applies nationally is the better starting point.
HIPAA compliance for therapy practices→Alaska breach obligations
These apply to businesses generally rather than to therapy practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.
Alaskabreach data →Individual notice deadline
In the most expeditious time possible and without unreasonable delay, except as provided in AS 45.48.020 (law-enforcement delay) and as necessary to determine the scope of the breach and restore the reasonable integrity of the information system.
The statute does not fix a numeric outer bound. Unreasonable delay is itself a violation and may result in state enforcement action, so treat the operative timeframe as the shortest window your incident circumstances reasonably support.
State regulator notice
Required only in the circumstance the statute names
No general regulator notice. Written notification to the Alaska Attorney General is required only when the covered person relies on the no-harm exception: disclosure to residents is not required if, after an appropriate investigation and after written notification to the attorney general, the covered person determines that there is not a reasonable likelihood that harm to the consumers has resulted or will result. The determination must be documented in writing and the documentation kept for five years. The notification to the attorney general is not a public record open to public inspection.
Source: Alaska Stat. § 45.48.010(a)-(b)
How we checked this law
- : Built from Alaska Statutes chapter 45.48 as published by the Alaska Legislature, read section by section, with a search of the whole chapter for HIPAA, covered-entity and federal-regulator provisions. No amendment to AS 45.48.010-.090 after August 23, 2026 was found. HB 367 (Consumer Data Privacy Act) was in House Finance as of May 12, 2026; it is not law and would not amend the breach sections.
What applies to therapy practices everywhere
Behavioral health practices hold information whose exposure can affect a patient's employment, family relationships, safety, custody matters, reputation, and willingness to continue treatment. The SRA must reflect the sensitivity and the actual way therapy is delivered.
Federal obligations still have to be evidenced for therapy practices in Alaska.
The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Alaska rules on this page.
Start the risk assessment