HIPAA compliance for therapy practices in Ohio

Ohio's general breach-notification statute excludes HIPAA covered entities outright, so for covered therapy practices the federal rules govern and the state statute adds no separate notification duty. Beyond that, Ohio has 4 recorded rules that apply to therapy practices differently from other businesses in the state — set out below with their conditions and sources.

Ohio jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Ohio's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

A therapy practice is a HIPAA covered entity when it or a service acting for it electronically conducts an HHS-adopted standard transaction, such as a claim or eligibility inquiry. Cash-pay status alone does not answer the question. Covered practices must complete every duty below; non-covered practices may still be governed by state mental-health privacy, professional, and contractual requirements.

State — how Ohio law interacts with HIPAA

Ohio's general breach-notification statute expressly excludes HIPAA covered entities from its scope. For therapy practices that qualify as covered entities under 45 CFR §160.103, the federal rules govern and the state statute below adds no separate notification duty.

Covered-entity exclusion. Ohio Rev. Code § 1349.19(F)(2) provides that '[t]his section does not apply to any person or entity that is a covered entity as defined in 45 C.F.R. 160.103.' HIPAA covered entities operating in Ohio are excluded from § 1349.19 — no residual state-law breach-notification obligation runs alongside HIPAA for CEs. Business associates are NOT expressly included in the (F)(2) exclusion and require separate analysis — a BA should independently evaluate whether it qualifies as a covered entity under 45 C.F.R. 160.103 (which enumerates health plans, healthcare clearinghouses, and qualifying healthcare providers as covered entities and separately defines business associate) or whether some other Ohio provision applies to it. Financial institutions, trust companies, and credit unions subject to and complying with their functional federal regulator's requirements are also excluded from § 1349.19 under (F)(1).

What Ohio adds for therapy practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Ohio's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

A mental health professional may provide outpatient mental health services at the request of a minor 14 years of age or older without parental consent, but those services are limited to six sessions or thirty days, whichever occurs sooner.

Service: outpatient mental health services
Provider class: a mental health professional as defined by the chapter
Patient population: minors

What this means operationally

The limit is a hard operational boundary, not guidance. A practice taking self-consenting 14-to-17-year-olds needs a per-patient counter running on both sessions and elapsed days, because whichever arrives first ends the authority to continue. At that point services stop or a parent consents — there is no third option.

Applies when

The minor is 14 or older
The minor requests the services
The services are outpatient mental health services

State statuteOhio Rev. Code § 5122.04(A)–(B)Minors aged 14 and olderVerified 2026-08-28

Minor confidentiality

Provider may disclose, subject to a test

Information about services provided under § 5122.04 may be shared with a parent only with the minor's consent, or where the provider determines there is a substantial probability of harm. The minor must be told of the intent to disclose.

Service: services provided under § 5122.04
Provider class: a mental health professional as defined by the chapter
Patient population: minors

What this means operationally

Notice to the minor is part of the disclosure, so a harm-based disclosure to a parent is a two-step action: tell the minor first, then disclose. A workflow that releases to the parent without recording that the minor was told has not completed the statutory step.

Applies when

The services were provided under § 5122.04

Exceptions

Disclosure without the minor's consent is permitted where the provider determines a substantial probability of harm

State statuteOhio Rev. Code § 5122.04(A)Minors aged 14 and older receiving services under § 5122.04Verified 2026-08-28

Provider disclosure to a parent

Left to professional judgment

For providers governed by OAC chapter 5122-27, where a minor consented alone to outpatient mental health services under ORC § 5122.04 or to drug or alcohol treatment under ORC § 3719.012, only the client signs the authorization for release of information. A separate authorization is required to release psychotherapy notes as defined at 45 CFR § 164.501, and for 42 CFR Part 2 programs the authorization must comply with 42 CFR § 2.31 with each disclosure accompanied by one of the two written statements specified at 42 CFR § 2.32(a).

Setting: providers governed by OAC chapter 5122-27 — certified community behavioral health providers, opioid treatment programs, class one residential facilities and approved ADAMH boards
Provider class: NOT licensed health care professionals practicing under their own license, who are exempt from the chapter regardless of practice structure
Patient population: minors who consented to their own treatment

Reaches this practice type only where the practice is a certified community behavioral health provider or other entity the chapter governs — not where it operates as a licensed professional's independent practice.

What this means operationally

READ THE APPLICABILITY RULE BEFORE THIS ONE. Chapter 5122-27 governs certified community behavioral health providers, opioid treatment programs, class one residential facilities and approved ADAMH boards. Rule 5122-27-01 EXEMPTS licensed health care professionals holding a valid state license, regardless of practice structure, along with services delivered through accredited hospital outpatient clinics and several FQHC in-scope services. An Ohio practice operating through independently licensed professionals may therefore fall outside this chapter entirely, including where it runs as a sole proprietorship, partnership or group practice. Applicability has to be established before the release rule is used; applying it to a practice the chapter does not govern imports a requirement that practice does not sit under. Where it DOES apply, the operational consequence is concrete: the release form carries one signature rather than two, and psychotherapy notes need their own authorization.

Applies when

The provider is governed by OAC chapter 5122-27
The minor consented alone under ORC § 5122.04 or § 3719.012

Exceptions

Licensed health care professionals practicing under their own license are exempt from the chapter, regardless of practice structure
Accredited hospital outpatient clinic services and certain FQHC in-scope services are exempt

State regulationOhio Admin. Code 5122-27-06; applicability under Ohio Admin. Code 5122-27-01Minors who consented alone under § 5122.04 or § 3719.012Verified 2026-08-29

Patient access to records

Provider may disclose, subject to a test

If a PHYSICIAN, ADVANCED PRACTICE REGISTERED NURSE, PSYCHOLOGIST, LICENSED PROFESSIONAL CLINICAL COUNSELLOR, LICENSED PROFESSIONAL COUNSELLOR, INDEPENDENT SOCIAL WORKER, SOCIAL WORKER, INDEPENDENT MARRIAGE AND FAMILY THERAPIST, MARRIAGE AND FAMILY THERAPIST, OR CHIROPRACTOR WHO HAS TREATED THE PATIENT DETERMINES, FOR CLEARLY STATED TREATMENT REASONS, that disclosure of the requested record is LIKELY TO HAVE AN ADVERSE EFFECT ON THE PATIENT, the health care provider shall provide the record to a designated recipient rather than to the requester directly.

Provider class: physicians, advanced practice registered nurses, psychologists, professional clinical counsellors, professional counsellors, social workers, marriage and family therapists, and chiropractors

What this means operationally

The list of who may make this determination is closed and it is narrower than the list of providers the access duty binds. A DENTIST, an OPTOMETRIST and a PHYSICAL THERAPIST are all health care practitioners for the purposes of the access right, but none of them appears among the professions authorized to find that disclosure would be adverse — so a dental or optometric practice holding a record it considers harmful has no route under this provision and must release. The determination must also rest on CLEARLY STATED TREATMENT REASONS, which is a documentation requirement rather than a standard of belief: an unrecorded clinical judgement will not support it.

Applies when

A treating practitioner from the enumerated professions determines for clearly stated treatment reasons that disclosure is likely to have an adverse effect on the patient

State statuteOhio Rev. Code § 3701.74(B)Patients, personal representatives and authorized personsVerified 2026-08-30

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Ohio breach obligations

These apply to businesses generally rather than to therapy practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Ohiobreach data →

Individual notice deadline

In the most expedient time possible but not later than forty-five days following discovery or notification of the breach, subject to law-enforcement delay and any measures reasonably necessary to determine the scope of the breach, ascertain the identity of affected residents, and restore the reasonable integrity of the data system.

The statute sets a 45-day outer bound. It is shown for context: a HIPAA covered entity is outside this section, so HIPAA's own 60-day individual-notice window is the operative deadline.

State regulator notice

Not required

None for HIPAA-covered entities (they are excluded from the section entirely — see the HIPAA-interaction note below). For entities subject to § 1349.19, the section does not impose an Attorney General notice obligation.

Source: Ohio Rev. Code § 1349.19(B)(2)

Statewide rules that also reach therapy practices

Parental right of access

A patient, a patient's personal representative, or an authorized person who wishes to examine or obtain a copy of part or all of a medical record SHALL SUBMIT TO THE HEALTH CARE PROVIDER A WRITTEN REQUEST SIGNED by the requester and DATED NOT MORE THAN ONE YEAR BEFORE THE DATE ON WHICH IT IS SUBMITTED. The request SHALL INDICATE WHETHER THE COPY IS TO BE SENT to the requester, sent to a physician, advanced practice registered nurse or chiropractor, or HELD FOR THE REQUESTER at the office of the health care provider. WITHIN A REASONABLE TIME after receiving a request that meets those requirements and includes sufficient information to identify the record, a health care provider that has the patient's medical records SHALL PERMIT THE PATIENT TO EXAMINE THE RECORD DURING REGULAR BUSINESS HOURS WITHOUT CHARGE or, on request, shall provide a copy in accordance with § 3701.741. If a health care provider FAILS TO FURNISH a medical record as required, the requester MAY BRING A CIVIL ACTION to enforce the patient's right of access.

What this means operationally

Two conditions sit on the REQUEST rather than the practice, and both are enforceable gatekeeping. The request must be signed, and it must be DATED NOT MORE THAN ONE YEAR before submission — a staleness rule that lets a practice decline an old authorization without inventing a policy. It must also state the destination, which is why a bare 'send me my records' note is incomplete under Ohio law. On the practice's side, in-person EXAMINATION is free and must be available in regular business hours; only copying attracts a fee. Note what Ohio does not give: no day count. The standard is a reasonable time, and the sanction is a private civil action rather than board discipline.

Applies when

A patient, personal representative or authorized person submits a signed written request dated within the past year, identifying the record and stating where the copy should go

Exceptions

Does not apply to records covered by Ohio Rev. Code §§ 173.20 or 3721.13, chapters 1347, 5119 or 5122, 42 C.F.R. part 2 (alcohol and drug abuse patient records), or 42 C.F.R. § 483.10
Does not supersede the peer-review confidentiality provisions at §§ 2305.24, 2305.25, 2305.251 and 2305.252

StatewideOhio Rev. Code § 3701.74(B), (C), (D)Patients, personal representatives and authorized personsVerified 2026-08-30

Limit on copy fees, format or delivery

Where the request is made by the PATIENT, the patient's personal representative, or an individual authorized through a valid power of attorney, TOTAL COSTS for copies and all related services SHALL BE REASONABLE, COST-BASED AMOUNTS PERMITTED TO BE CHARGED TO THE PATIENT UNDER FEDERAL LAWS AND REGULATIONS, and any per-page charges SHALL NOT EXCEED the sums authorized for third-party requests. If the request by such a person is for ACCESS TO DIGITAL RECORDS OR ELECTRONICALLY TRANSMITTED RECORDS, the TOTAL COST for that access or transmission, AND ALL RELATED SERVICES, SHALL NOT EXCEED FIFTY DOLLARS.

What this means operationally

The fifty-dollar cap is the number to build the workflow around: it is a TOTAL, covering access, transmission and every related service, and it applies regardless of how large the record is. For any substantial chart electronic delivery is therefore dramatically cheaper for the requester than paper, and a practice that defaults to printing is charging more than it needs to defend. For non-digital patient requests Ohio does not write its own figure at all — it adopts the federal cost-based limit by reference and then caps per-page charges at the third-party schedule, so the federal rules are the operative constraint and the state schedule is only a ceiling.

Applies when

A patient, personal representative or power-of-attorney holder requests copies of a medical record

StatewideOhio Rev. Code § 3701.741(B)(1)Patients, personal representatives and authorized personsVerified 2026-08-30

Limit on copy fees, format or delivery

Where the request is made by ANYONE OTHER THAN the patient, personal representative or power-of-attorney holder, total costs for copies and all related services SHALL NOT EXCEED the sum of: AN INITIAL FEE OF SIXTEEN DOLLARS AND EIGHTY-FOUR CENTS, adjusted in accordance with § 3701.742, WHICH SHALL COMPENSATE FOR THE RECORDS SEARCH; for data recorded on paper or electronically, ONE DOLLAR AND ELEVEN CENTS PER PAGE FOR THE FIRST TEN PAGES, FIFTY-SEVEN CENTS PER PAGE FOR PAGES ELEVEN THROUGH FIFTY, and TWENTY-THREE CENTS PER PAGE FOR PAGES FIFTY-ONE AND HIGHER, each adjusted under § 3701.742; for data resulting from an X-RAY, MRI OR CAT SCAN recorded on paper or film, ONE DOLLAR AND EIGHTY-SEVEN CENTS PER PAGE; and THE ACTUAL COST OF ANY RELATED POSTAGE. Every charge in this schedule applies to MEDICAL RECORDS COMPANIES as well as to health care providers.

What this means operationally

Ohio is unusual in letting the practice recover a SEARCH fee at all — most cost-based regimes exclude retrieval time — and it is a flat initial charge rather than an hourly one. The per-page rate is steeply degressive, so the marginal cost of a long record is low and the fixed component dominates a short one. Two structural points matter more than the figures. All of them are INFLATION-ADJUSTED under § 3701.742, so any quoted amount needs a date beside it. And the schedule expressly binds MEDICAL RECORDS COMPANIES, the third-party firms practices outsource copying to, which prevents a practice from routing around the cap through a vendor.

Applies when

A third party such as an attorney or insurer requests copies of a medical record from a provider or a medical records company

Exceptions

One free copy, and one copy of subsequently created records, must be provided without charge to the Bureau of Workers’ Compensation and the other recipients § 3701.741(C) names

StatewideOhio Rev. Code § 3701.741(A), (B)(2)Patients, personal representatives and authorized personsVerified 2026-08-30

What applies to therapy practices everywhere

Behavioral health practices hold information whose exposure can affect a patient's employment, family relationships, safety, custody matters, reputation, and willingness to continue treatment. The SRA must reflect the sensitivity and the actual way therapy is delivered.

The EHR or practice-management system and the access available to clinicians, supervisors, billing personnel, and administrative staff

Telehealth platforms, clinician home offices, personal or practice-issued devices, local networks, waiting rooms, chat logs, and recordings

Patient portals, scheduling tools, intake forms, email, text messaging, and after-hours communication

The creation, separation, storage, access, and disclosure of psychotherapy notes when the practice maintains them

Supervision, peer consultation, case-review, and group-therapy documentation workflows

Billing services, payment systems, cloud storage, backup, transcription, and other vendors that handle PHI on the practice's behalf

Full therapistscompliance guide →

Knowing the Ohio rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Ohio rules on this page.

Start the risk assessment