So what’s going on HIPAA 2026, because this is the email I’ve been getting, in fact, several. And it says, hi Sam. Hope all is well. I’m getting a sudden surge in emails about the new HIPAA laws going into effect.

Click here to download the transcript.

Disclaimer: The following is an actual transcript. We do our best to make sure the transcript is as accurate as possible, however, it may contain spelling or grammatical errors. Due to the unique language of acupuncture, there will be errors, so we suggest you watch the video while reading the transcript.

Hey, greetings, all my friends. It’s Sam Collins, the coding and billing expert for acupuncture for you, the profession, and of course, the American Acupuncture Council. But most importantly, really it’s just you and I wanna make sure that each time we’ve got something new, something that’s changing to make sure you’re up to date.

Click here for the best Acupuncture Malpractice Insurance

If you’re a network member with me, even better, let’s make sure we always know what’s going on. Otherwise, even if you’re not a member, this is a place where we’re gonna give you the updates. Let’s go to the slides. Let’s talk about. What’s going on, and some of you may have gotten some emails to this and it’s always one that I’m always careful, hyperbole and if you have stress, it sells.

Get a Quick Quote and See What You Can Save

So what’s going on HIPAA 2026, because this is the email I’ve been getting, in fact, several. And it says, hi Sam. Hope all is well. I’m getting a sudden surge in emails about the new HIPAA laws going into effect. Now, I do understand HIPAA is misspelled here, but I left the email just as it was sent and it says, is this accurate or is it just marketing hype?

And I’m so glad they reached out to me. As good as Google searches and chat, GPT can be, remember, those are still limited to the information they can gather, and is it always correct? No. So we wanna be careful and we also wanna be careful. Is it also subject to hyperbole as well? Potentially to some extent.

I always look at the context. Obviously HIPAA is a big deal. It is. But how big is it? It depends on the size of the office, what you’re doing. At the end of the day, what is hipaa? In a acupuncture office? Don’t let anyone have someone else’s records. Many of you’re using paper charts. That’s pretty hard to get records unless they break into your office.

So let’s make sure what are we really doing and talking about let’s update. There are changes that you have to make. Or potentially February 16th. However, these updates probably will have nothing to do with you. I will tell you, I’m gonna be very acentric when it comes to these things. Code changes, everything else.

I’m like, how does it affect us? That’s what I wanna know. These updates chiefly concerned, a heightened confidentiality, protections for substance abuse disorder and reproductive health privacy. And this is mostly related to. Reproductive rights of people that some states allow certain types of birth control, others don’t.

If you go to another state, they can’t get access to it. It’s just protection. All this is about protection of a patient’s information. Same for substance abuse, that if someone has, gone through some substance abuse treatment, that no one just can easily get access to it. In fact, the easiest way to keep everything private, always pay cash.

If you’re not aware, cash means you don’t have to disclose at all, and the patient has a right to. Now, with this update though, what if it does affect us? What do we really have to do? It’s really updating your privacy practice. I’m gonna say 99.9% of you won’t, but let’s say for some reason you’re doing some reproductive health.

Now, I’m not saying necessarily fertility, I’m talking about reproductive birth control and that type, but let’s say you were, what would you add in there? The patient has rights for reproductive protection and that these records will not be disclosed unless specifically requested. And even then you would make sure who’s the requesting party, who they have access.

In other words, you’re gonna exercise a lot more caution for records, particularly if they have things like substance abuse. Same applies with HIV. So what this really is a defensive way just to make sure patients are aware of their new rights now. Does this mean you need to change your privacy notice?

Probably not. But let’s say for some reason you did, you would update your privacy notice with this additional information of that protection. If you’re not maintaining records on reproductive rights or substance abuse, though change is nothing. So continue the same, which means I don’t update anything.

Now let’s keep in mind though, what if you did have to update it? Would you have to have all patients sign the new privacy practice? No, you wouldn’t. Once they signed one from years ago. That remains in effect. Do post up in your office if you’ve made an update somewhere where they can see it. Make people aware.

But for the most part, they do not have to sign a new one. This is more so just to make sure that if you have these, you’re gonna make the change. Chances are you don’t, and this is where I want to keep things with simplicity in mind. Avoid hyperbole. At the end of the day, what is hipaa? Oh, by the way, you know how you’re supposed to do a yearly HIPAA training?

This isn’t at the very least part of it. It may be for some of you, the whole thing, depending on the size of your office. The basics of HIPAA is that we are protecting protected health information. What does that include? Names, date of birth, social security number, their diagnosis, treatment. In other words, all the information you have on the patient, you’re protecting it.

What does it mean? I don’t let anyone have access but realize. There’s things that can make it more vulnerable. If you do all paper notes, it’s very hard for someone to get it ’cause you physically would have to send it. But what if it’s electronic? Could someone hack into your system? So we have to have other things in safeguards there.

And even verbal information. Be very careful by example. Here’s a common one, A friend recommends a friend and you start discussing things about it. Like someone’s recommended a friend and they said, Hey did my friend John come in? Do you know? You can’t disclose that. You better get permission from another person.

And this sometimes you go I just wanna thank them. Gotta have permission. ’cause maybe they don’t want them to know. So at the end of the day, think of it this way, HIPAA is about giving the least information that’s necessary. We use the term minimum necessary. So if someone’s asking for a very specific date on a patient and it’s a valid request.

You’re gonna limit it to that date. Don’t send everything. Don’t send extra things. Here would be the reason why if you send too much, you never get it back. You know the barn door’s open, but if you send not enough, it’s easier to send more than to try to pull it back. Make sure, of course there’s administrative safeguards in the office.

Again, that’s what we’re doing today. Who’s your officer? Probably you, but make sure you have things in place. Do you do a risk assessment? Have you looked recently? Hey. Have we done all the right things by example? Do all your employees or people you work with get some initial HIPAA training from you and is it done yearly?

Now, I’m not saying it has to be a big yearly thing, but enough to go over it again to make sure there’s no issues. And you should have some type of a written policy. It could even be a page. I’m gonna suggest some of you may have to have more than that, but for the most part it’s like just the protocols of how to deal with it.

Like when someone calls. How do we handle if someone’s asking for records? You know what the answer is? We don’t give ’em anything over the phone, not without a signed authorization. Remember, if you’re working with outside vendors, billers or other people, they have to sign up. A business associate network manager with me, we have that.

We’ve done so because everything, I have to keep private. Make sure that if you have any type of service that’s shredding documents and you’re not doing it yourself, they need a HIPAA notice and then make sure you have. Rules that what happens if there’s a violation? I don’t think you’re gonna have some big sanction.

It just means, Hey, we’re gonna reprimand that this doesn’t happen again. Put safeguards in place and it’s just gonna be, I did a reprimand. You’re not gonna say, I’m gonna suspend you for a damn I, I guess you could, but that doesn’t help us. And then make sure you’ve got reasonable physical safeguards, meaning secure the charts.

Now if you have paper records, that’s pretty easy. Don’t put ’em in a place where people can get them. Now what if you said I don’t have a locked cabinet. Do you need a locked cabinet? Not necessarily so long as it’s protected from the public getting to it. So if it’s in an open area behind where people can walk in, you’re always gonna have some type of safeguard.

It’s never left alone for people just to wander. And now patients are escorted back. Now obviously electronic could be a little bit more difficult ’cause now what if you’re sending an email that’s not secure, or you’re not sure because your system could be hacked? Make sure you’ve got the proper encryption on your computers.

But one simple thing is make sure just when someone comes in your office, they can’t look and see someone else’s information on the computer. It should always blank out. In fact, I’d recommend just the privacy screen. That way when you look only dead on, can you see it? Nope. Nothing from the side.

Okay. And then make sure, as I mentioned, restrict access. No, you can’t go back there. We don’t let you, those are obvious, but it’s something to remember. That’s part of the training that staff have to remember, Hey, we just can’t let a patient go to the restroom. And then they’re wandering around the office and trying to look at someone else’s chart.

Not that I think people. Do that. But every now and then you get a couple of people that are a little quirky that may try to do something like that. And then of course, make sure that you’re shredding documents when you discard them. You can’t just throw ’em out, shred them, okay, by a cross crutch shredder, or there’s a service out that’ll do it.

Remember, you do wanna keep the records timely. On the minimum time for many states. Could be five years, some or seven or 10. Know your state if you’re not sure. Contact me network members. I can make sure, but you don’t need to keep a bunch of records if you’ve been seeing a person for 20 years. You honestly don’t need all 20 years.

You need the last seven years, let’s say. Alright, now what about technical safeguards? Here’s something to make sure this is training with staff passwords. Everyone should have their own no shared passwords. That way we know who was on or what there was a problem. That way, if something happened, we can find out how it happened, who it happened with, and not everyone gets blamed.

If you will make sure there’s log off. The computer should log off after five minutes, maybe even shorter, depending. How about encryption? Now, it’s pretty hard to buy a computer without that, but check to make sure. Where I’d be more concerned are mobile devices and backups. If a staff can have access to records on their mobile device, let’s remember if you have Google or Microsoft, they look at everything, if you use email through Google, they’ve read it and they’re sending you ads based on it. Okay. And they’re selling it to other people. So make sure you keep things very private in that way. I would recommend no mobile devices unless we know it’s encrypted limit access based on job role. If someone’s job is only appointments, then they don’t necessarily need an EHR access.

Okay. It just lends to less people touching, less problem we can have. And then make sure, again, the personal devices. I have a concern because everyone does it now, and then you wonder what things have access. I had a friend that said, Hey man, I have a TikTok. I never had TikTok before. So I put it on, I watched the thing.

I thought it was pretty it’s not for me. I’m an older person, so I don’t wanna sound like I’m down on it, but the thing, I deleted it. Do you know, I get an email now and again from TikTok that says, Hey, this person’s on TikTok. We saw they were in your contacts on your phone. So again, there’s a lot of access there.

I would be really conscientious of. And then remember, patients have rights. Make sure they all do a privacy notice, do they have to sign that every year? No. Once is enough. If you amend or change it, then of course, put a post, a new notice. But at the same token, they have to resign. And if a patient wants, can they have access to the records?

Sure. Can they make amendments? Not really. They can’t amend it. What they can do is give what their opinion is. But don’t make them change the record. They can just write what they think. It should be a little odd. But on the medical side, you might see this. And then if they want confidential things like, Hey, I don’t want you to speak to my spouse, I don’t want you to let this person know, you have to honor it.

And in fact, I would say always simply, I don’t wanna say hide, but use that as your protection. I’m sorry. HIPAA allows me not to do that and just leave it at that. No excuses. That’s just what it is. And if they want any type of authorization, I want it in writing. From them. I don’t want there to be any issue later saying, I didn’t give you authorization to do that.

It’s not complicated in a small office, but you wanna make sure we have the right things in place. ’cause if someone does make a complaint, could that be a problem for us? Maybe which means other simple things too. Verbal discussions. Avoid, obviously if you go in a hospital, you ever notice everyone gets quiet when they get on the elevator.

You wanna make sure you’re not talking. You gotta be very qui quiet. My son’s an attorney and it’s interesting when they have meetings. They literally have soundproof rooms. A hundred that no one can hear anything. It’s really, in fact, if you sit in the room with no sound, it’s a little scary because there’s like anti sound in there.

But that’s how careful they are with the type of things they deal with. So use good discretion. If you’re releasing information and you’re not sure, or they’re asking, don’t release it. You can always get more information. Again, you can never get it back if you’re not sure where you’re sending it.

If you’re not sure. That was them on the voice. But don’t leave a voicemail. In fact, make sure they have permission for you to do so many patients will. And then if you’re gonna send a fax or an email, verify who it is before you send it. Because once you send, if it’s the wrong one, and I, when I say verify it, I mean I want you to send, my rule is you’re gonna send a test email first.

Make sure the respond back saying it’s theirs before you send it, okay? Because once you send it, there’s no coming back. The network, myself and the HJ Ross or American Acupuncture Council, we’re always here for you. We wanna be your support. If you’re a member with me and you want to go into some more details or some training, by all means do that.

Otherwise, for everyone else, use good common sense when it comes to hipaa. You always be on the right track and not saying things can’t change, but remember hyperbole often is just that it’s trying to excite you about something. We’re always gonna be that good and honest resource. So until next time, my friends, I wish you well.

And remember, acupuncture got a nice increase in fees this year. Go forward. Take care everybody.

Click here for the best Acupuncture Malpractice Insurance

Get a Quick Quote and See What You Can Save