Do health coaches need to be HIPAA compliant? What decides it and what to set up

Do health coaches need to be HIPAA compliant: the test in the rule

A health coach needs to be HIPAA (the Health Insurance Portability and Accountability Act) compliant when the coach is a covered entity or a business associate under HHS's rule. HHS says an entity that is neither does not have to comply with the HIPAA Rules, so the test in the rule decides, not the job title.

The rule text on eCFR (45 CFR 160.103) says a health care provider is a covered entity if it sends health information electronically in connection with a transaction the rule covers. HHS lists providers such as doctors, clinics and pharmacies and links a decision tool.

This is general information, not legal advice. Practice Better's help center likewise says it cannot advise which agreements a practice needs.

Covered entity or business associate: which one a coach might be

The rule defines a business associate as a person who creates, receives, maintains or transmits protected health information for a regulated function, on behalf of a covered entity. HHS says business associates are engaged by a covered entity, other than as workforce members, and lists claims processing, data analysis, billing and practice management among their activities.

A covered entity that uses a business associate must have a written contract or other arrangement with it, which HHS calls a business associate agreement (BAA). HHS also says business associates are directly liable for certain provisions of the HIPAA Rules.

Claims and insurance: the step that brings a provider under HIPAA

CMS says providers that submit HIPAA transactions, such as claims, electronically are covered. HHS's telehealth FAQ gives billing insurance electronically as its example of such a transaction. Whether a coach does that is a fact about the coach's own practice, and the CMS covered entity decision tool is a question-and-answer check for it.

Software for coaches who keep health records

Practice Better lets every account sign its HIPAA Business Associate Agreement inside the account, the free Sprout plan included. Best health coaching software sets it beside other options. For the rest of what it says about the agreement, see is Practice Better HIPAA compliant.

Practice Better says signing does not by itself make a practice compliant, and that the agreement covers data stored in Practice Better, not third-party tools used alongside it. HHS says it does not endorse, certify or recommend specific technology, so there is no HHS certification a vendor could hold; Practice Better's own claim is that it maintains compliance with HIPAA and the privacy laws it lists. Its steps to sign:

1. Open Settings, View All, then Regulatory Compliance.
2. Click Review & Sign next to the HIPAA Business Associate Agreement (United States).
3. Click Get Started and fill in the form fields; Practice Better recommends the owner or a Practice Admin does this.
4. Click Next, then Save Changes, and download the signed copy from the same page.

Sprout is $0 for up to 3 clients, and a fourth client needs Starter, $35 a month billed monthly, as read on October 30, 2026. See the Practice Better Sprout plan page for its limits.

Where to check your own case

Start with the CMS covered entity decision tool, then read HHS's pages on covered entities and business associates. For your own case, ask a lawyer: neither a vendor article nor this page can say which agreements your practice needs. If the tool and your advisor show that no agreement is needed, choose software on features alone; if one is needed, choose a vendor that signs one.

Coaches comparing tools can try Practice Better for 14 days, or 30 days on Team. The sign-up asks for a credit card, and the card is charged when the trial ends unless you cancel.