HIPAA Basics for Small Clinics: When Is Scheduling Data PHI? (2026)

The legal test

Under 45 CFR 160.103, covered entities are health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form in connection with a transaction covered by HIPAA. Transactions include claims, eligibility checks, enrollment and remittance advice.

CMS puts it simply: providers who submit HIPAA transactions, like claims, electronically are covered. Its examples include doctors, clinics, psychologists, dentists and chiropractors. CMS also publishes a covered entity decision tool for clinics that aren’t sure.

Cash-only and wellness practices

A massage, nutrition or wellness practice that never bills insurance electronically may not be a covered entity. That is not a licence to be careless. State health privacy laws, consumer protection law and professional licensing rules can still apply, and a clinic that later starts submitting claims becomes covered for everything it holds.

The Federal Trade Commission’s Health Breach Notification Rule covers vendors of personal health records and related businesses that aren’t HIPAA covered entities. It explicitly doesn’t apply to HIPAA covered entities such as doctors’ offices, which fall under HHS’s breach rule instead.

Why an appointment counts

An appointment record says that a named person is receiving care from your clinic on a given date. That relates to the provision of care and identifies the individual. So in a covered clinic’s booking system, the patient’s name, phone number and appointment time together are PHI, even with no diagnosis attached.

The de-identification standard in 45 CFR 164.514 shows how broad identifiers are. Its list of 18 includes names, geographic units smaller than a state, all dates except the year, phone numbers, email addresses, medical record numbers, IP addresses and full-face photos.

What raises the sensitivity

Some scheduling fields say more than others. “Initial visit, 60 min” is less revealing than “Pelvic floor assessment” or “Couples therapy”. A practitioner’s specialty, the clinic’s name (a sexual health or addiction clinic) and free-text reasons for visit all add clinical meaning. HIPAA still treats the plain appointment as PHI, but the minimum necessary rule means you should avoid collecting or displaying detail you don’t need.

What isn’t PHI

The definition excludes employment records a covered entity holds as an employer, so your staff rota is not PHI. Properly de-identified data isn’t PHI. And information a patient keeps themselves, such as a reminder in their own phone calendar, isn’t held by you.

Sign-in sheets and calling names

HHS’s FAQ says covered entities such as physician offices may use patient sign-in sheets or call out patient names in the waiting room, as long as the information disclosed is appropriately limited. A sheet asking for name and arrival time is fine; a column for “reason for visit” is not.

The Privacy Rule permits incidental disclosures, such as another patient overhearing a name, when the clinic has reasonable safeguards and applies the minimum necessary standard. Keep screens angled away from the waiting area and avoid discussing details at the counter.

Reminders and voicemails

Appointment reminders are treatment communications and don’t need the patient’s authorization. HHS guidance allows leaving a message on an answering machine or with a family member, while limiting what is said: the clinic name, a callback number and what is needed to confirm the appointment.

Under 45 CFR 164.522(b), a covered provider must accommodate reasonable requests to receive communications by alternative means or at alternative locations, such as “text me, don’t call my home number”, and may not require the patient to explain why. Record the preference in the booking system so every reminder respects it.

Minimum necessary inside the clinic

45 CFR 164.514(d) requires you to identify which staff need which categories of PHI and to limit access accordingly. In practice: reception sees the schedule and contact details, practitioners see clinical notes, and billing sees what it needs to bill. Most practice software supports roles; use them.

Who counts as a business associate

A business associate creates, receives, maintains or transmits PHI on behalf of a covered entity. For a clinic, that typically includes the practice management system, online booking widget, reminder text service, email provider used for appointment emails, cloud storage, IT support with access to systems, and the billing service.

HHS’s guidance on cloud computing says a cloud service provider that stores electronic PHI is a business associate even if the data is encrypted and the provider doesn’t hold the key. The narrow conduit exception covers transmission-only services such as a courier or internet provider, not services that store data.

What a BAA must contain

45 CFR 164.504(e) lists the required terms. The business associate must use PHI only as the contract allows, apply safeguards and comply with the Security Rule for electronic PHI, report unauthorized uses and breaches, make subcontractors agree to the same restrictions, help you meet patients’ rights of access and amendment, open its records to HHS, and return or destroy PHI at the end of the contract where feasible. You must be able to terminate for a material breach.

HHS publishes sample BAA provisions. Most clinic software vendors use their own standard agreement; check it covers these points.

No BAA, no PHI

If a vendor won’t sign a BAA, don’t put PHI in it. That rules out many general-purpose scheduling, form and email tools on their standard plans, or limits them to data that isn’t PHI, such as a public class timetable with no patient details.

What to do now

List every system holding patient data, including the booking tool and the reminder service. Turn on multi-factor sign-in where offered. Give every staff member their own login. Remove access the day someone leaves. Keep devices encrypted and updated. Write down what you did and why; documentation is part of compliance.

The proposed update

HHS proposed a major Security Rule overhaul in January 2025 that would make most implementation specifications mandatory and require written documentation of security policies and analyses. According to the 2026 regulatory agenda, HHS’s Office for Civil Rights will not take final action before July 2027. Until then the current rule applies, but the proposal is a good guide to where expectations are heading.

Breach notification

A breach of unsecured PHI generally requires notice to affected patients without unreasonable delay and within 60 days of discovery. Breaches affecting 500 or more people must also be reported to HHS within that window, and to prominent media where 500 or more residents of a state are affected. Smaller breaches are logged and reported to HHS within 60 days of the end of the calendar year. A lost unencrypted laptop with your appointment list can trigger this.

Tracking pixels on booking pages

HHS’s bulletin on online tracking technologies warned that analytics and advertising pixels on patient portals and booking flows can disclose PHI to the tracking vendor. In June 2024 a federal court in American Hospital Association v. Becerra vacated the part of the bulletin covering a visitor’s IP address on a public page about a health condition, and HHS did not appeal. Tracking inside logged-in patient areas and booking flows remains a risk. Ask your website and booking vendors which trackers fire on those pages.

Notice of Privacy Practices

Under 45 CFR 164.520, a direct treatment provider must give its Notice of Privacy Practices no later than the first service and make a good-faith effort to get written acknowledgment. Clinics that create or receive substance use disorder treatment records covered by 42 CFR Part 2 had to update their notice by February 16, 2026.

Assuming names and times aren’t PHI

In a covered clinic they are. Treat the whole booking system as holding PHI.

Using a tool before the BAA is signed

Free trials of booking and form tools often start collecting real patient data before anyone reads the terms. Sign first, then import.

Free-text fields everywhere

A “notes” box on the booking form invites patients to type symptoms. Use a fixed list of neutral appointment types.

Shared logins at reception

One login for the front desk makes it impossible to tell who did what, and makes removing a departing employee’s access harder.

Ignoring patient communication preferences

Once a patient asks not to be called at home, every automated reminder has to follow it.

Is a patient’s name and appointment time PHI?

For a HIPAA covered clinic, yes. It identifies the patient and relates to the provision of health care to them, which meets the definition of individually identifiable health information in 45 CFR 160.103.

Does HIPAA apply to a cash-only clinic?

HIPAA covers health care providers that transmit health information electronically in connection with standard transactions such as claims. A practice that never does that, directly or through a billing service, may not be a covered entity. State privacy laws can still apply, so check with a lawyer.

Can we text appointment reminders?

Yes. Reminders are treatment communications and don’t need authorization. Keep the content limited (time, place, clinic name), honour any request for a different contact method, and use a texting vendor that signs a BAA if the messages are tied to patient records.

Do we need a BAA with our booking software?

Yes, if the software stores or transmits PHI for your covered clinic, which an appointment system almost always does. HHS says this applies even when the vendor only stores encrypted data it can’t read.

Can we use sign-in sheets?

HHS says yes, as long as the information disclosed is appropriately limited. Ask for name and arrival time, not the reason for the visit.

Can we build our own scheduling tool?

You can, but the same rules apply to whatever hosts it. If you’d rather build a front-desk tool yourself with an AI app builder such as Floot, note that Floot doesn’t offer a BAA, so it suits workflows without PHI (staff rotas, room bookings, de-identified reporting), not patient appointment records.