HIPAA compliance is one of those topics that nutrition professionals know they should understand but often put off. The rules feel complex, the language is dense, and it is not always clear whether they even apply to your practice. The short answer: it depends on your credentials and how you handle client information.

When HIPAA applies to nutrition professionals

HIPAA applies to "covered entities" - healthcare providers who transmit health information electronically in connection with certain transactions, primarily insurance billing. If you are a Registered Dietitian (RD) or Registered Dietitian Nutritionist (RDN) who bills insurance companies, you are almost certainly a covered entity and HIPAA applies to you.

The picture gets more nuanced for non-RD nutritionists, health coaches, and wellness practitioners. If you do not bill insurance and do not transmit protected health information (PHI) electronically for covered transactions, you may not be legally required to comply with HIPAA. However, there are strong reasons to follow HIPAA principles regardless of your legal obligation.

The RD vs. nutritionist distinction matters

In most states, Registered Dietitians are recognized as healthcare providers. They can bill Medicare, Medicaid, and private insurance. This recognition brings HIPAA obligations along with it. The moment you submit a claim electronically, you are a covered entity.

Nutritionists without the RD credential operate in a different regulatory space. Licensing requirements vary by state, and many nutritionists function as wellness professionals rather than healthcare providers. If you accept only private pay and never interact with insurance, your HIPAA exposure is lower - but not necessarily zero. If you receive referrals from or share records with covered entities like physicians or hospitals, you may be considered a business associate, which carries its own HIPAA requirements.

When in doubt, consult a healthcare compliance attorney in your state. The cost of a one-hour consultation is far less than the cost of a violation.

What HIPAA compliance actually requires

If HIPAA does apply to your practice, the core requirements are more manageable than they appear:

Privacy Rule - Establish policies for how you collect, use, and share client health information. Give clients a Notice of Privacy Practices.
Security Rule - Protect electronic PHI with appropriate safeguards. This means encrypted storage, secure communication channels, and access controls on your devices and software.
Breach Notification Rule - Have a plan for what happens if client data is compromised. You must notify affected individuals and, in some cases, the Department of Health and Human Services.

Practically, this translates to using HIPAA-compliant software for scheduling and record-keeping, encrypting emails that contain health information, securing your devices with passwords and encryption, and training any staff on proper data handling.

Choosing compliant tools

Your practice management software is the biggest compliance decision you will make. Look for platforms that offer a Business Associate Agreement (BAA), which is a legal contract confirming the vendor will protect PHI according to HIPAA standards. Without a signed BAA, using a tool to store or transmit client health information is a compliance risk.

Stillpoint is built with security and privacy at its core, giving nutrition professionals confidence that their client data is handled responsibly.

Beyond your core platform, audit every tool that touches client information - your email provider, video conferencing software, file storage, and messaging apps. Each one needs to meet the same standard.

Even if you are exempt, act like you are not

Clients trust you with sensitive information about their health, habits, and bodies. Treating that data with the same care that HIPAA mandates - regardless of whether you are legally required to - builds trust and protects your reputation. It also future-proofs your practice. If your credentials or billing practices change, you will already have the right systems in place.

Start with the basics: use secure, professional tools; do not discuss client details over unsecured channels; and keep your records organized and protected.

If you are ready to run your nutrition practice on a platform designed for security and simplicity, sign up for Stillpoint and get started today.