HIPAA compliance for Physical Therapy practices in California
PT clinics frequently share records with referring physicians and payers, which means unsigned Business Associate Agreements are a common, expensive gap. In California, the federal HIPAA Security Rule is only the floor. CMIA (Cal. Civ. Code §§56 to 56.37) stacks on top.
The law that stacks on top of HIPAA in California
Exposure: $1,000 nominal with no harm required, $3,000 actual, up to $5,000 punitive.
A single 500-patient breach is a $500,000 floor in nominal damages alone. Patients can sue you directly.
Patients can sue your practice directly.
Recent OCR enforcement in California and nationally
- Rio Hondo Community Mental Health$100,000
CA · Nov 19, 2024 · Right of Access failure.
- Enzo Biochem (NY/NJ/CT AGs)$4,500,000
NY/NJ/CT · Aug 13, 2024 · HIPAA Security Rule failure treated as a SHIELD Act violation, affecting 2.4M patients.
- Solara Medical Supplies$3,000,000
(multi) · Jan 14, 2025 · Phishing breach, no Security Risk Analysis, and breach notification failure.
- Warby Parker, Inc.$1,500,000
national · Feb 20, 2025 · Credential stuffing, no Security Risk Analysis, and no audit log review.
Nearly every action above names the same first failure: no documented Security Risk Analysis. It is the cheapest gap to close and the most expensive to leave open.
How a California Physical Therapy practice gets compliant
- 1
Get your free HIPAA Risk Score
Answer about ten questions about your Physical Therapy practice. You get a 0 to 100 score weighted by OCR enforcement priority and an estimated penalty exposure for California.
- 2
Close the gaps, done for you
Honest Comply builds the documented Security Risk Analysis, policies, training records, and Business Associate Agreements your practice is missing, deployed in 72 hours from intake.
- 3
Stay provable
Your record stays dated, signed, and current, so the day a breach brings OCR or the California Attorney General to your door, you can produce a defensible record in one sitting.
California Physical Therapy HIPAA questions
- Does California have medical privacy rules stricter than HIPAA for physical therapy practices?
- Yes. California enforces CMIA (Cal. Civ. Code §§56 to 56.37) on top of federal HIPAA. A single 500-patient breach is a $500,000 floor in nominal damages alone. Patients can sue you directly.
- What is the penalty exposure for a HIPAA violation in California?
- $1,000 nominal with no harm required, $3,000 actual, up to $5,000 punitive. That sits on top of federal OCR civil monetary penalties, which is why a single incident in California can draw enforcement from two directions.
- Can patients sue my Physical Therapy practice directly in California?
- Yes. CMIA (Cal. Civ. Code §§56 to 56.37) gives patients a private right of action, so a patient can sue your practice without waiting for a regulator to act.
- What does OCR look at first in a Physical Therapy practice?
- The Security Risk Analysis. PT clinics frequently share records with referring physicians and payers, which means unsigned Business Associate Agreements are a common, expensive gap. A missing or stale analysis is the single most cited failure in recent settlements.
- How fast can a California Physical Therapy practice become compliant?
- Honest Comply deploys a complete, documented, audit-ready HIPAA record in 72 hours, with the clock starting when you submit your intake form, not at checkout. It is a flat $299 a month with unlimited staff.
See exactly where your physical therapy practice stands.
The free Risk Score scores your exposure against California law and real OCR settlements in about five minutes. No card, no sales call.
Practice information only. We never ask for patient data.