HIPAA compliance for therapy practices in Indiana
Indiana keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Patient Protect has not recorded any Indiana rule that applies to therapy practices differently from other providers in the state — the statewide rules below are the ones that reach you.
Indiana jurisdiction record verified against primary state authority November 2026. General reference, not legal advice.
Does this reach your practice?
Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Indiana's own law reaches a practice that HIPAA already covers.
Federal — is this practice a covered entity
A therapy practice is a HIPAA covered entity when it or a service acting for it electronically conducts an HHS-adopted standard transaction, such as a claim or eligibility inquiry. Cash-pay status alone does not answer the question. Covered practices must complete every duty below; non-covered practices may still be governed by state mental-health privacy, professional, and contractual requirements.
State — how Indiana law interacts with HIPAA
Indiana allows the procedures of a primary or functional regulator to stand in for parts of its own breach-notification scheme. Whether that substitution reaches therapy practices depends on the conditions in the statute below — read it before assuming HIPAA compliance settles the state duty.
Ind. Code § 24-4.9-3-4(d)(6) provides that a data base owner that maintains its own disclosure procedures as part of an information privacy, security policy, or compliance plan under HIPAA is not required to make a disclosure under the chapter if the plan requires that Indiana residents be notified of a breach of the security of data without unreasonable delay and the data base owner complies with the plan. The individual-notice duty in § 24-4.9-3-1(a) is expressly made subject to section 4(d). The exemption is conditional: the plan must require notice without unreasonable delay, and the owner must follow it. Its text relieves the owner of 'a disclosure under this chapter', which on its face includes the attorney-general disclosure (§ 24-4.9-3-1(c)) and the consumer-reporting-agency disclosure (§ 24-4.9-3-1(b)); the condition restates 'without unreasonable delay' but does not restate the 45-day limit in § 24-4.9-3-3(a). Whether the Attorney General reads 4(d) to relieve HIPAA entities of the AG disclosure was not established from any AG publication. Separately, § 24-4.9-3-3.5(a)(6) exempts a data base owner with a HIPAA compliance plan from the chapter's reasonable-security and records-disposal duties if the plan requires reasonable safeguards and is followed, but § 24-4.9-3-3.5(b) applies those duties to a current or former health care provider whose plan does not require or does not implement reasonable procedures to protect personal information, including health records, after it ceases to be a HIPAA covered entity. Indiana's definition of personal information (§ 24-4.9-2-10) does not include medical information.
What Indiana adds for therapy practices specifically
Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Indiana's general breach law, which applies the same way to every business in the state.
No verified intersection rules recorded
Patient Protect has not recorded any Indiana rule that applies to therapy practices differently from any other practice in the state. Where that is the case, the federal obligations and the Indiana rules below are the whole picture, and the therapists guidance that applies nationally is the better starting point.
HIPAA compliance for therapy practices→Indiana breach obligations
These apply to businesses generally rather than to therapy practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.
Indianabreach data →Individual notice deadline
Without unreasonable delay, but not more than forty-five (45) days after the discovery of the breach. A delay is reasonable only if necessary to restore the integrity of the computer system, necessary to discover the scope of the breach, or in response to a request from the attorney general or a law enforcement agency to delay because disclosure will impede a criminal or civil investigation or jeopardize national security; once the delay is no longer necessary, disclosure must be made as soon as possible.
The outer bound of 45 days is shorter than HIPAA's 60-calendar-day outer limit. Following the federal notice procedure satisfies this deadline only on the conditions the statute sets; see how the statute treats HIPAA entities above.
State regulator notice
Required
If a data base owner makes a disclosure to Indiana residents under § 24-4.9-3-1(a), it must also disclose the breach to the Indiana Attorney General. The Attorney General's business guidance directs submissions on its Data Breach Notification Form, with a sample of the notice sent to affected individuals.
Source: Ind. Code § 24-4.9-3-1(a); § 24-4.9-3-3(a)-(b) (as amended by P.L.171-2022, SEC.1)
How we checked this law
- : Built from the 2026 Indiana Code, Title 24, as published by the Indiana General Assembly, and the Attorney General's breach guidance. P.L.115-2026 and P.L.23-2026, both effective July 1, 2026, changed a cross-reference in § 24-4.9-2-6 and a spelling in § 24-4.9-3-4; neither changes a duty. The Attorney General's business FAQ still describes timing only as "without unreasonable delay"; the statute's 45-day limit in § 24-4.9-3-3(a), in force since 2022, controls.
What applies to therapy practices everywhere
Behavioral health practices hold information whose exposure can affect a patient's employment, family relationships, safety, custody matters, reputation, and willingness to continue treatment. The SRA must reflect the sensitivity and the actual way therapy is delivered.
Federal obligations still have to be evidenced for therapy practices in Indiana.
The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Indiana rules on this page.
Start the risk assessment