If you've been in private practice for any length of time, you've probably gotten a question like this: "Is this HIPAA-compliant?" Sometimes it's from a corporate client sending employees your way. Sometimes it's from a referring physician. Sometimes it's from the client themselves, who read something online and got nervous.
The honest answer for most yoga therapists: probably not required by law. But that doesn't mean the question doesn't matter. Here's the nuance most articles skip over.
Are yoga therapists even covered by HIPAA?
The short answer: usually no. HIPAA applies to "covered entities" — health plans, healthcare providers that conduct certain transactions electronically, and healthcare clearinghouses. Most solo yoga therapists in private practice don't meet any of these criteria. You don't bill insurance electronically, you don't conduct standard HIPAA transactions, and you're not a clearinghouse.
IAYT-certified yoga therapists are not automatically covered. If you're employed by a hospital, clinic, or healthcare system — even as a contractor — that organization's obligations may extend to you. But as a solo practitioner? You're generally in the clear legally.
Important caveat: If you work with referring healthcare providers who have HIPAA obligations, those providers may contractually require you to comply as a "business associate." That's a contractual requirement, not a legal one — but it's still enforceable and still matters.
When HIPAA expectations show up anyway
Even if you're not legally required to be HIPAA compliant, you will encounter situations where clients or partners expect it:
- Corporate wellness contracts — HR departments increasingly require vendors to demonstrate HIPAA compliance before signing agreements
- Referring healthcare providers — physicians, PTs, and mental health professionals often have HIPAA obligations and may require associate agreements
- Clients with privacy concerns — especially those with conditions they consider sensitive (mental health, addiction recovery, chronic illness)
- IOO-based or employer-sponsored benefits — if a third-party administrator is paying you, they may require compliance as a condition of the arrangement
In these situations, you're not covered by HIPAA — but you're expected to act like you are. That's a different standard, and it has real implications for your software choices and data practices.
What "acting like HIPAA compliant" actually requires
If you're operating in contexts where HIPAA-level data protection is expected, here's what the practical minimum looks like — without full covered-entity compliance overhead:
- Use a practice management system with encrypted data storage and role-based access controls
- Never send client health information via regular email or SMS — use encrypted channels only
- Add a privacy statement to your intake form explaining how client data is stored and used
- Don't store intake data in unencrypted spreadsheets, Google Docs, or voice memos
- Have a data retention policy — know how long you keep records after the client relationship ends
Where automation creates the biggest compliance risks
Automated intake is one of the highest-leverage improvements you can make to your practice — but it also introduces the most common compliance failures. Here's where things go wrong:
Email and SMS intake links
Sending intake form links via unencrypted email or SMS is the most common compliance gap. A intake form delivered via regular Gmail or iMessage has already traveled through multiple non-encrypted systems before the client fills it in. For casual privacy expectations, this is fine. For HIPAA-conscious clients or employer-sponsored programs, it may not be.
What to do instead: Use a platform that delivers intake links over TLS-encrypted connections, and consider using a dedicated client portal rather than email for sensitive health data exchange.
Cloud storage without encryption at rest
If your intake data flows into a Google Sheet, Airtable base, or similar cloud tool, check whether that tool encrypts data at rest. Many do not by default for free-tier accounts. Business-tier accounts typically include this — but it's worth verifying.
Third-party AI processing
When you use AI to help generate yoga protocols from intake data, that intake data is being processed by an external AI service. If you're working with HIPAA-sensitive client populations, make sure your AI processing partner has a Business Associate Agreement (BAA) in place, or avoid sending identifiable health information to AI systems that don't support BAAs.
SadhanaFlow's approach
SadhanaFlow processes intake data through an AI protocol generation system. We don't send identifiable health data to AI services that don't support BAAs. Intake responses are stored in encrypted databases, and practice pages delivered to clients are sandboxed per-client. Contact us if you're working with a corporate wellness program and need to review our data processing agreements.
Automating securely with the right infrastructure
You don't need to choose between automation and security. The key is choosing tools that were designed with health data handling in mind, rather than bolting on privacy as an afterthought.
When evaluating practice management software, ask these questions:
- Is data encrypted at rest and in transit?
- Can I control who has access to which client records?
- Is there an audit log showing who accessed what and when?
- Does the platform support data export and deletion requests (CCPA/GDPR considerations)?
- Can I get a BAA or data processing agreement if needed for employer or referrer requirements?
If the answer to any of these is "I don't know," dig deeper before trusting that platform with client health data. The convenience of automation isn't worth a data breach or a contractual dispute with a corporate client.
What "overkill" looks like — and when it's justified
If you're a solo therapist doing purely self-pay work with no corporate contracts and no referring healthcare providers, full HIPAA compliance infrastructure is probably overkill. The cost and complexity of maintaining HIPAA compliance — regular risk assessments, security officer designation, incident response plans, business associate management — is substantial and not justified by the actual risk profile.
But if you're in any of the situations described above — corporate wellness, healthcare referrals, sensitive client populations — the cost of a privacy incident (lost contract, damaged relationship, reputational harm) likely outweighs the investment in getting this right from the start.
Wrapping up
HIPAA compliance for yoga therapists is mostly a matter of matching your data practices to your actual risk profile — not achieving certification nobody's actually asking you to get. Use common-sense encryption, be thoughtful about where client data lives, and have a privacy statement that explains your approach. That's the floor for most private practitioners.
If you're working in contexts where higher standards are expected — get a data processing agreement in place, verify your tools' encryption at rest, and be careful about what goes through consumer-grade AI services. The contracts and compliance infrastructure cost more than the software itself — factor that into your evaluation.