HIPAA Violations in Optometry Practices: What Independent Practices Get Wrong

Optometry practices face a compliance challenge that is structurally distinct from other healthcare specialties: they operate at the intersection of a clinical healthcare environment and a retail business. That intersection creates specific HIPAA vulnerabilities that generic compliance guides never address — and that OCR investigations of optometry practices consistently reveal.

---

Violation 1: Retail Staff Accessing Clinical Records Beyond Minimum Necessary

Citation: §164.502(b) and §164.312(a)(1)

The minimum necessary standard requires that every use and disclosure of PHI be limited to what is actually needed for the specific purpose. In optometry, this standard is structurally challenged by the retail-clinical overlap.

An optician helping a patient select frames needs the patient's current prescription. They do not need the patient's full examination findings, medical history, or prior clinical documentation. A front desk coordinator scheduling an appointment needs the patient's contact information and appointment history. They do not need clinical examination notes or medical diagnoses.

When a single practice management system gives every staff member identical access — which is common when systems are deployed with default settings — every retail and administrative staff member is accessing clinical PHI beyond minimum necessary every time they interact with a patient record.

The default configuration problem:

Most optometry practice management systems — Eyefinity, RevolutionEHR, Crystal PM — support role-based access configuration. They do not enforce it by default. Practices that deploy these systems without configuring role-based access are giving all staff the same access level from day one.

When an OCR investigation examines a practice with this configuration, the audit log showing retail staff routinely accessing clinical records beyond their role requirements is evidence of an ongoing minimum necessary violation.

What to do:

Audit your current access configuration. Work with your practice management vendor to configure role-based access that enforces the clinical-optical boundary. Document the configuration as evidence of minimum necessary compliance.

---

Violation 2: Missing BAAs With Optical Labs

Citation: §164.308(b)(1)

This is the most optometry-specific violation on this list and the one with the highest rate of non-compliance across the specialty.

Every optical lab that receives patient prescriptions with identifiers is a Business Associate. Every Business Associate requires a signed BAA. Most optometry practices have never requested, executed, or documented BAAs with their optical labs.

The rationalization is understandable: the lab relationship is routine, transactional, and feels more like a supply chain relationship than a healthcare data relationship. The prescription is "just a number." But a prescription transmitted with a patient's name, date of birth, and account number is ePHI. The lab that receives, stores, and uses that data to fabricate lenses is processing ePHI on the practice's behalf.

When a lab experiences a data breach — a ransomware attack on their fabrication system, an unauthorized access event in their order portal — and the practice has no BAA, the practice bears liability for the ePHI that was exposed without a required Business Associate agreement.

The frame vendor portal extension:

Several optical frame vendors and wholesale optical platforms operate order portals where practices place orders and manage accounts. If patient names or identifiers are stored in these portals in connection with orders, the same analysis applies. Request BAAs from frame vendor portals that store patient-level data.

What to do:

Contact every optical lab you use. Ask for their BAA. Execute it. File the signed copy. Add optical lab BAA tracking to your compliance management process. Do the same for frame vendor portals where applicable.

---

Violation 3: Dual-Billing Insurance Disclosure Failures

Citation: §164.502 and §164.514

Optometry practices that bill both vision insurance and medical insurance for the same patient encounter — common in practices treating medically-diagnosed eye conditions — navigate a disclosure environment that creates specific minimum necessary risks.

A patient with diabetic macular edema may have the examination billed to their medical insurer under an ICD-10 medical diagnosis code, and a portion of the encounter billed to their vision insurer for the refraction component. Each billing transaction discloses specific PHI to a different payer: the medical insurer receives the medical diagnosis and clinical findings; the vision insurer receives the refractive findings and vision-related services.

The minimum necessary dimension:

Each insurer is entitled to the minimum PHI necessary to process the specific claim being submitted. Submitting a comprehensive clinical record to a vision insurer processing a refraction claim — or including medical diagnosis details in a vision-only claim — exceeds minimum necessary.

The coordination of benefits problem:

When both vision and medical claims are submitted for the same encounter, coordination of benefits processes may result in payers requesting additional records to adjudicate claims. Each records request from an insurer must be evaluated against the minimum necessary standard. The practice should produce only what the insurer needs to adjudicate the specific claim, not a complete clinical summary.

What to do:

Establish a billing protocol that defines what PHI is included in vision claims versus medical claims. Train billing staff on minimum necessary as it applies to dual-billing encounters. Document the protocol as part of your privacy policies.

---

Violation 4: Missing or Outdated Security Risk Analysis

Citation: §164.308(a)(1)(ii)(A)

The universal compliance gap appears here too — with an optometry-specific dimension.

Optometry practices are increasingly technology-intensive. Digital imaging equipment (OCT, fundus cameras, corneal topographers), electronic prescribing systems, vision insurance portals, optical lab ordering systems, and patient engagement platforms each represent an ePHI system or data flow that must be addressed in the SRA.

Most optometry SRAs that exist were conducted when the practice first opened or when the EHR was first implemented. They do not reflect equipment added since, insurance portal relationships established since, or lab ordering systems deployed since.

An OCR investigation that follows any breach or complaint will examine whether the SRA is current and comprehensive. A five-year-old SRA that predates the practice's current technology stack is evidence that the practice treated compliance as a one-time event.

The imaging equipment dimension:

Digital imaging equipment — OCT machines, fundus cameras — creates ePHI in the form of diagnostic images linked to patient records. These images may be stored locally on the device, transmitted to the EHR, and sent to referring physicians or specialists. Each of these data flows must be addressed in the SRA, including the security configuration of the imaging device itself and the transmission pathway to downstream recipients.

What to do:

Conduct a current SRA that inventories your actual technology environment — not what you had when you first opened. Include every imaging device, every insurance portal, every lab ordering system. Update the SRA when you add new equipment or new vendor relationships.

---

The Common Thread

The violations that hit optometry practices hardest are structural — they arise from how optometry is practiced, not from carelessness. The retail-clinical interface creates minimum necessary challenges. The lab relationship creates BAA gaps. The dual-billing environment creates disclosure complexity. The technology-intensive clinical environment creates an SRA that becomes stale faster than in simpler practices.

The solution is a compliance infrastructure that manages these relationships continuously — not an annual review that tries to reconstruct a year's worth of operational drift.

See the full platform for optometry practices →

Read the complete optometry compliance guide →

See real enforcement cases and fine amounts →

Track breach intelligence in your area →

---

Based on OCR enforcement data and HHS guidance as of April 2026. Provided for informational purposes only. Does not constitute legal advice.