Do Life Coaches Have to Follow HIPAA? A Straight Answer
Do life coaches have to follow HIPAA? In most cases, no. HIPAA applies only to "covered entities" (health plans, health care clearinghouses, and health care providers who send certain insurance transactions electronically) and to their "business associates." A life coach who works with private clients who pay directly, and who never bills insurance, is usually neither. The answer changes when a clinic, hospital or health plan hires you to handle its patients' information, when you also hold a clinical license and bill insurance, or when a state health-data law reaches you even though HIPAA does not. Washington's My Health My Data Act is the clearest example. Rules differ by state and country, so treat this article as a map, not legal advice, and check your own situation with a health-privacy attorney.
Being outside HIPAA does not mean you can be careless. Clients tell coaches about panic attacks, medication, divorces, and miscarriages, and they expect those details to stay put. We make Coachful, a coaching platform that keeps agreements, intake answers, notes and messages on one client record. We'll say plainly where it fits here: Coachful is not HIPAA-certified and does not sign business associate agreements. It is a good home for coaching records and a wrong home for clinical ones. Everything below works whichever tools you use.
What is the 60-second HIPAA checklist for a coach?
Run through this table before anything else. If every row in the "applies to you if" column is a no, HIPAA almost certainly does not apply to your practice. Your privacy duties then come from your contract, your professional ethics, consumer protection law and any state health-data law.
| Question | HIPAA (or a similar law) may apply if... | What to do this week |
|---|---|---|
| Do you bill health insurance electronically, or does someone bill it for you? | Yes: health care providers who send standard transactions such as claims or eligibility checks are covered entities. | If no, write down "private pay only" as a policy. If yes, talk to an attorney before you take another client. |
| Do you hold a clinical license (therapist, nurse, dietitian, physician) and use it with clients? | Yes, if your licensed practice sends standard transactions; your coaching side may get pulled in. | Keep coaching and clinical work under separate agreements, records and intake forms. |
| Does a clinic, hospital, insurer or health plan pay you to work with its patients or members? | Yes: you may be its business associate, and it must have a business associate agreement (BAA) with you. | Ask the organization in writing whether it considers you a business associate. |
| Are you an employee of a covered entity (for example, a hospital wellness coach)? | Yes: you are workforce, so you follow your employer's HIPAA policies. | Use only the employer's systems for patient information. |
| Do you have clients in Washington State and collect anything about their physical or mental health? | Possibly: Washington's My Health My Data Act covers health data outside HIPAA. | Read the Attorney General's FAQ and ask an attorney whether you are a regulated entity or small business under the Act. |
| Have you built your own app that pulls health data from trackers or other sources? | Possibly: the FTC's Health Breach Notification Rule covers some non-HIPAA health apps. | Check the FTC's guidance before launch. |
| Do you coach clients in the UK, EU or elsewhere? | HIPAA is US law; local data protection law applies instead and usually treats health data as sensitive. | Check your national regulator's guidance (in the UK, the ICO). |
Most first-year life coaches answer no to every row except the last one or two. The rest of this article explains each row, using the official pages it relies on, then gives you wording you can copy.
Not legal, tax or medical advice. HIPAA questions depend on facts this article cannot see. For anything with real consequences, such as signing a BAA, taking insurance, or working under a clinic, a health-privacy attorney is the right call.
Who does HIPAA actually cover?
HIPAA's rules cover two groups: covered entities and their business associates. The U.S. Department of Health and Human Services (HHS) says it plainly on its Covered Entities and Business Associates page: "If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules."
The same page, as listed in November 2026, names three kinds of covered entity:
- Health care providers such as doctors, clinics, psychologists, dentists, chiropractors, nursing homes and pharmacies, "but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard."
- Health plans: insurers, HMOs, company health plans, and government programs such as Medicare and Medicaid.
- Health care clearinghouses: companies that convert nonstandard health information into standard formats, or the reverse.
The HHS Summary of the HIPAA Privacy Rule says which transactions count: "claims, benefit eligibility inquiries, referral authorization requests, or other transactions for which HHS has established standards." It also includes a sentence that matters to coaches: "Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction."
That sentence answers a common worry. Emailing a client about their sleep habits, or storing a note in the cloud, does not by itself make you subject to HIPAA. What matters is who you are and which transactions you send, not the technology you use.
Is a life coach a "health care provider"?
The Privacy Rule summary defines providers broadly: institutional providers like hospitals, practitioners like physicians and dentists, "and any other person or organization that furnishes, bills, or is paid for health care." A life coach who helps someone plan a career change or rebuild confidence after a breakup is not furnishing health care in any ordinary sense. Health and wellness coaches get closer to that line, especially if they work on medical conditions.
Even a health care provider is covered only if it sends standard electronic transactions. A coach who takes card payments directly from clients and never touches an insurer fails that second test, even in the unlikely case that the first one is met.
When does a coach become a business associate?
This is the most likely way a coach ends up under HIPAA. You become a business associate by doing work for a covered entity that involves its patients' information. The HHS Business Associates FAQ defines a business associate as a person or organization that "performs certain functions or activities ... on behalf of a covered entity" involving "creating, receiving, maintaining, or transmitting" protected health information (PHI), or that provides certain services to a covered entity involving PHI.
The examples HHS lists, as of November 2026, include billing, practice management, data analysis, cloud storage and an app developer that monitors "patients' food and exercise" for a covered entity. HHS adds that business associates are "directly liable for complying with certain provisions of the HIPAA Rules," and that the covered entity must get "satisfactory assurances" in a written business associate agreement before sharing PHI.
In coaching terms, these situations are where to slow down:
- A cardiology practice pays you to run a 12-week lifestyle group for its patients and sends you their names, diagnoses and lab targets.
- A health plan contracts your small coaching company to call members who have diabetes.
- A hospital's employee wellness program, run through its group health plan, sends you a list of participants with their health risk scores.
- A therapy group hires you to deliver "coaching" to its own clients as part of their care plan, using its records.
The direction of the work is what matters. If you coach a client privately and they happen to also see a therapist, you are not that therapist's business associate. You work for the client, not on the therapist's behalf. If the therapy practice hires you to serve its patients, you are working on its behalf.
What does a business associate agreement require?
HHS says the agreement must contain the elements listed at 45 CFR 164.504(e). It starts by describing the permitted uses and disclosures of PHI and barring the business associate from using or disclosing it in other ways. In practice, signing a BAA means your systems must meet those requirements: access controls, safeguards, and vendors who will also sign BAAs with you. Signing a BAA you cannot honour is worse than declining the work.
What counts as protected health information, and why doesn't it follow your client home?
PHI is health information held by a covered entity or its business associate. The Privacy Rule summary describes it as "individually identifiable health information" about "past, present or future physical or mental health or condition," the provision of health care, or payment for it, held "in any form or media, whether electronic, paper, or oral."
The words "held or transmitted by a covered entity or its business associate" are what limit it. The same fact, "my client takes sertraline," is PHI in a psychiatrist's chart and is not PHI in a private life coach's notes. Your client's health information is still sensitive. HIPAA just isn't the law that protects it in your hands. Other things do: your contract, consumer protection law, state law, and your professional reputation.
A related point: if a client's doctor or therapist wants to share records with you, HIPAA lets the covered entity disclose PHI when the individual "authorizes in writing." That is the provider's responsibility, not yours. A client who wants their therapist and coach to coordinate signs the therapist's release form. You don't need to become a business associate to receive it.
What are the stakes if you get this wrong?
There are two kinds of risk, and they point in opposite directions.
If HIPAA does apply and you ignore it, the penalties are real. The HHS Privacy Rule summary lists civil money penalties, using the 2022 inflation adjustments shown on the page in November 2026, of $127 to $63,973 per violation, with calendar-year caps from $25,000 to $1,919,173 for identical violations. Criminal penalties for knowingly obtaining or disclosing identifiable health information in violation of the rule start at up to $50,000 and one year in prison. They rise to $250,000 and 10 years when the intent is commercial advantage, personal gain or malicious harm.
If HIPAA does not apply and you claim it does, the risk is quieter but still real. Calling your practice "HIPAA compliant" on a website, intake form or sales call is a factual claim about your security and legal status. The FTC notes in its health privacy guidance that it enforces Section 5 of the FTC Act, "which prohibits companies from misleading consumers or engaging in unfair practices." A privacy promise you can't back up is the kind of statement that law is concerned with. It also confuses clients about what protection they actually have.
There is a third stake that no regulator measures: trust. A client who finds their story in a group-program example, or sees a screenshot of their message in your Instagram highlights, will not ask which law you broke. They will leave and tell people why.
| Situation | Does HIPAA apply? | What does apply | Who to ask |
|---|---|---|---|
| Solo life coach, private pay, US clients | Almost never | Your agreement, FTC Act on marketing claims, state privacy and consumer law, ICF ethics if credentialed | A small-business attorney when drafting your agreement |
| Health or wellness coach, private pay, works on conditions like prediabetes | Usually not, unless you bill insurance | As above, plus a clear scope-of-practice line and referral process | An attorney familiar with your state's scope-of-practice rules |
| Coach under contract to a clinic or health plan, receiving patient data | Likely, as a business associate | HIPAA via a BAA, plus the organization's policies | The organization's privacy officer and your own attorney |
| Coach employed by a hospital or health plan | Yes, as workforce | Your employer's HIPAA program | Your employer's privacy officer |
| Licensed therapist who also coaches and bills insurance | Yes for the clinical practice; coaching may be pulled in if not clearly separated | HIPAA, your licensing board's rules | A health-law attorney and your licensing board |
| Coach serving clients in Washington State who collects health information | No, but a state law may | Washington My Health My Data Act, if you qualify as a regulated entity or small business | A Washington privacy attorney |
| Coach who built a health app syncing data from trackers | Usually not | Possibly the FTC Health Breach Notification Rule | A privacy attorney before launch |
| Coach based in the UK or EU | No | UK GDPR or GDPR; health data is a special category | The ICO (UK) or your national data protection authority |
If HIPAA doesn't apply, which other privacy laws might?
This is where the "most coaches are not covered" answer needs a footnote. Over the past few years, state and federal regulators have started to cover health data that falls outside HIPAA.
Washington's My Health My Data Act
The Washington Attorney General's page calls it "the first privacy-focused law in the country to protect personal health data that falls outside the ambit of" HIPAA. As listed in November 2026, the FAQ says:
- It reaches entities that conduct business in Washington, or provide products or services aimed at Washington consumers, and that decide why and how consumer health data is collected.
- Small businesses, as the Act defines them, had to comply with sections 4 through 9 from June 30, 2024.
- Regulated entities and small businesses must "prominently publish a link to its consumer health data privacy policy on its homepage," as a separate link.
- Information "derived or extrapolated from nonhealth data" can count as consumer health data when it is used to link someone to a health status.
- A violation is a per se violation of Washington's Consumer Protection Act, enforced by the Attorney General and through private lawsuits.
A coach who markets to Washington residents and asks intake questions about anxiety, sleep, eating or medication should take this seriously. Whether a one-person practice qualifies depends on definitions in the Act that are worth reading with an attorney. Other states can adopt their own health-data rules, so check the rules where your clients live, not just where you live.
The FTC's Health Breach Notification Rule
The FTC's guidance explains that "many companies that collect people's health information ... aren't covered by HIPAA," and that the rule requires vendors of personal health records and related entities to notify people after a breach of unsecured health information. A personal health record, under the rule, can draw information "from multiple sources" and is managed by or for the individual. A coach using an off-the-shelf platform is unlikely to be a vendor of personal health records. A coach who builds their own app that syncs with fitness trackers might be. The FTC also notes that a "breach" includes sharing data without authorization, not only hacking.
Outside the United States
HIPAA does not apply outside the US. In the UK and the EU, data protection law (UK GDPR and the EU GDPR) applies to most coaching businesses. Health data is in a special category that needs a specific lawful basis and extra care. If you coach internationally, the stricter regime usually sets your baseline. The UK Information Commissioner's Office publishes guidance for small businesses, and EU member states each have a data protection authority.
Which privacy practices should a coach adopt anyway?
Coaches outside HIPAA still benefit from borrowing its logic. Collect less, limit who sees it, keep it somewhere controlled, and be able to hand it back or delete it. Here is a working checklist, in the order most first-year coaches can tackle it.
- Write a confidentiality clause into your coaching agreement. Say what you keep private, the limits (risk of harm, legal requirement), and how long you keep records. Have clients sign before the first session. See our worked review of legal disclaimers for life coaches for the scope language that goes alongside it.
- Trim your intake form. For each health question, ask: "What would I do differently with this answer?" If nothing, delete it. "Are you currently working with a therapist or doctor on anything related to what we'll cover?" usually tells you what you need. "List all diagnoses and medications" usually does not.
- Pick one home for client records. Notes scattered across a phone notes app, a personal Google Drive, paper notebooks and DMs are impossible to protect, export or delete. Choose one system with a login you control and two-factor sign-in where it is offered.
- Separate marketing data from client data. Your email list software doesn't need to know a subscriber's anxiety score. Don't tag leads with health conditions in tools that sync to ad platforms.
- Get written permission before using any client story. The FTC's Endorsement Guides FAQ covers honesty in testimonials. Privacy adds a second test: remove anything that could identify the person, and ask again if the story involves health.
- Set a retention period and stick to it. For example, keep notes for a set number of years after the engagement ends, then delete them. Put the period in your agreement, check it against any insurance or tax record rules that apply to you, and set a calendar reminder.
- Have a referral path ready. Know which local or telehealth therapists, doctors and crisis lines you will point to, and write the script now, not mid-session.
- Carry professional liability insurance. The SBA describes professional liability insurance as cover for service businesses that "protects against financial loss as a result of malpractice, errors, and negligence." Ask your insurer specifically about data breach and privacy claims.
- Prepare a short answer for "Are you HIPAA compliant?" You will be asked. The scripts below give you one.
If you hold an ICF credential or are working toward one, the ICF Code of Ethics also covers confidentiality and client records. Your agreement should match what you have committed to there.
What should you actually say? Scripts and templates to copy
Adapt these to your voice and have an attorney review anything that goes into a signed agreement. They are written for a US-based private-pay life coach outside HIPAA.
Confidentiality clause for your coaching agreement
Confidentiality. I keep what you share in our sessions, messages and forms confidential. I will not share it with anyone without your written permission, except (a) if I believe you or someone else is at risk of serious harm, (b) if the law requires it, or (c) in anonymised form for supervision with a mentor coach, with no details that could identify you. I am not a health care provider and I am not subject to HIPAA. I store your records in [system name] with access limited to me [and named team members]. I keep records for [period] after our work ends, then delete them. You can ask for a copy or ask me to delete them sooner at any time, unless I'm required by law to keep them.
Intake form note above health questions
The next two questions help me understand whether coaching is the right support for you right now. Answer only what you're comfortable sharing. Coaching is not therapy or medical care, and I don't diagnose or treat. If something you share is better supported by a licensed professional, I'll tell you and help you find one.
When a client asks "Are you HIPAA compliant?"
Great question, and I'd rather give you a straight answer than a reassuring one. HIPAA is a law for health care providers, insurers and the companies that work for them. As a coach working with you directly, I'm not covered by it, so I won't claim to be "HIPAA compliant." Here is what I do instead: everything you share is confidential under our agreement, your records sit in one secure system that only I can access, I don't use client stories without your written OK, and you can ask for your records or have them deleted at any time. If you'd like to share details from your therapist or doctor, they'll ask you to sign their own release form, and that's the right way to do it.
When a clinic or health plan sends you a business associate agreement
Thanks for sending this over. Before I sign, I want to make sure I can actually meet the obligations in it. My current systems are built for private coaching and are not set up for protected health information. Could we either (a) run the program inside your systems, so patient information never leaves them, or (b) talk through what your privacy officer would need from my setup? I'm also asking my attorney to review the agreement.
Referral script when health comes up mid-session
What you're describing sounds important, and it's outside what coaching can safely help with. I'd like you to have someone qualified looking at it. Would you be open to talking with your doctor or a therapist about this? I can share a couple of names, and we can keep working on [the coaching goal] alongside that, or pause until you've had that conversation.
Privacy policy paragraph for your website
I collect the information you give me through my booking, intake and contact forms, and during coaching, so I can provide coaching services. I do not sell your information. Some details you share may relate to your health or wellbeing; I treat them as confidential, use them only to coach you, and do not share them for advertising. You can request a copy of your information or ask me to delete it by emailing [address].
If you serve Washington residents and may be covered by the My Health My Data Act, you probably need a separate consumer health data privacy policy linked from your homepage. Ask an attorney to draft that one rather than relying on the paragraph above.
A fictional example: Dana's first year, three HIPAA moments
This example is fictional. Dana is a composite, not a real coach or client.
Dana is a life coach in Ohio, eight months into her practice. She works mostly with women in their forties who are rebuilding after a divorce or a layoff. She takes card payments through her own Stripe account and has never touched insurance.
Moment one: the intake form. Dana's first intake form, adapted from a template she found online, asked clients to list "all current diagnoses and medications." Halfway through year one, she realises she has never used those answers. She also realises a printout of one form is sitting in her car's glovebox. She replaces the question with a single yes or no question about whether the client is working with a doctor or therapist on anything related to coaching. She moves all forms into one system and shreds the paper copies.
Moment two: the therapist. A client, Maria, says her therapist would like to "compare notes." Dana's first instinct is to ask whether she needs to sign something under HIPAA. She doesn't. The therapist is the covered entity, so Maria signs the therapist's release form. Dana gets Maria's written OK under their coaching agreement to share her coaching observations, and keeps a note of exactly what was shared and when.
Moment three: the clinic contract. A local integrative medicine clinic asks Dana to run a six-week "life after diagnosis" group for its patients. The clinic plans to email her a spreadsheet of names, diagnoses and phone numbers, and its office manager attaches a business associate agreement. Dana reads the HHS business associate page and sees that this is the textbook case. She uses the BAA script above, and the clinic agrees to run enrollment and messaging through its own patient portal. Dana gets a first-name list on the day of the group, with no diagnoses. Her attorney reviews the reworded contract before she signs it.
Dana's practice never became subject to HIPAA. She ended the year with a shorter intake form, one records system, a confidentiality clause her clients understood, and a clear sense of where HIPAA's boundary is.
| Where to keep coaching records | Good for | Not for | Cost |
|---|---|---|---|
| Coachful | Coaching agreements, intake answers, session notes, check-ins, messages and payments on one client record; full data export as a ZIP | Clinical records, insurance billing, anything that needs a BAA (not HIPAA-certified) | Lite: $29/month for up to 5 clients |
| A clinical EHR or practice system that signs a BAA | Licensed clinicians and coaches working as business associates | Sales funnels, courses and group programs, which most are not built for | Varies; check each vendor's pricing page |
| A covered entity's own systems | Programs you run for a clinic or health plan | Your private clients | Paid by the organization |
| Paper notebook in a locked drawer | Brief in-session jotting, if you transcribe and shred afterwards | Long-term records, remote work, client data requests | Low |
| Personal notes apps and personal cloud folders | Nothing client-identifying | Client records; hard to control access, export or delete per client | Low |
How do you set this up in Coachful when you're starting out?
If you are a private-pay coach outside HIPAA, which the checklist suggests most readers are, Coachful can be the "one home for client records" from step three. Here is what it does and doesn't cover, using only what it actually does.
What Coachful is: a coaching platform where one subscription covers booking, payments, coaching agreements, program delivery with habits and check-ins, courses, a community, a website with funnels and email, and an AI assistant, with one login for you and one branded app for your clients. It is built for coaches who deliver programs, not just sessions. What it does not do: it is not HIPAA-certified, does not sign BAAs, and is not for clinical record-keeping or insurance billing. If you need any of those, use a clinical system for that work. Our SimplePractice alternatives guide covers the trade-offs between clinical and coaching tools.
Agreements before the first call. Coaching agreements with e-signature go out before the first session and are stored on the client record, so your confidentiality clause is signed and easy to find. More on that at coaching contracts.
Intake on booking. You can add intake questions to a booking page, which is where your trimmed intake form belongs. Booked discovery calls appear in one list with their status.
One client record. Goals, check-ins, habits, notes, intake answers, tags, payments and sessions sit on the same profile, with an AI briefing from Michelle, the built-in assistant, before each session. When a client asks what you hold about them, you have one place to look.
Check-ins without a pile of DMs. Morning and evening check-in flows and a welcome flow collect the between-session updates clients would otherwise send by text. Messages stay in the client app rather than your personal phone.
Handing data back. Coachful exports full client data as a ZIP (roster, notes, check-ins, goals, habits, sessions, form responses), which helps when a client asks for a copy or when you close your practice. Coachful describes itself as GDPR-ready, which matters if you coach clients in the UK or EU. This short walkthrough shows where your data lives and how to export it:
Why Coachful stands out: a free white-glove service. From Create, then "We'll build it for you," you describe what you need, such as an intake form, a coaching flow, a welcome email sequence or a website with a privacy page placeholder. The Coachful team builds it inside your account, usually within about 24 hours. Nothing gets invented. Gaps like your actual privacy policy text or credentials are left for you to fill, which is what you want for legal wording. Read more in how the free white-glove service works.
How to start: begin a free trial, request the white-glove build, and import your existing clients and programs during onboarding. Current plans: Lite: $29/month for up to 5 clients; Solo: $49/month for up to 20 clients; Pro: $99/month with unlimited clients; Studio: $199/month with unlimited clients. Life coaches can see the full setup at Coachful for life coaches, and health coaches at Coachful for health coaches.
What mistakes do new coaches make with HIPAA and client privacy?
- Writing "HIPAA compliant" on the website. If HIPAA doesn't apply to you, the claim is meaningless at best and misleading at worst. Say what you actually do.
- Signing a BAA to win a contract. A BAA is a set of obligations, not a formality. Reshape the work so the organization keeps the PHI, or get advice before signing.
- Collecting a medical history "just in case." Every answer you collect is something you have to protect. Ask only what changes how you coach.
- Keeping records everywhere. Phone notes, personal email, voice memos and paper make it impossible to answer "what do you hold about me?"
- Tagging leads with health conditions in marketing tools. Ad audiences built from health tags are exactly what state health-data laws target.
- Sharing client stories without written permission. "I changed her name" is not enough when the details give her away.
- Assuming that crossing state lines changes nothing. Your clients' states can matter as much as yours, as Washington shows.
- Drifting into treatment. A life coach who starts managing a client's depression has a scope problem before a privacy one. Refer, and keep coaching to what coaching does. Our guide to AI intake triage with human follow-up covers how to flag intakes that need a referral.
If you're still choosing tools, our roundup of the best coaching software for life coaches compares how different platforms handle records and client communication. The session follow-up email templates show how to recap a session without repeating sensitive details in an inbox.
Frequently asked questions
Do life coaches have to follow HIPAA if a client tells them about a medical condition?
No. HIPAA applies based on who you are (a covered entity or business associate), not on what a client tells you. A private-pay life coach who hears about a diagnosis is not covered because of it. You should still treat the information as confidential under your agreement and any state law that applies.
Do health coaches have to follow HIPAA?
Most independent health coaches who are paid directly by clients are not covered entities, because they don't send standard insurance transactions. Health coaches who work under contract for clinics, insurers or employer health plans often are business associates. Ask the organization and an attorney before you start.
What is a business associate agreement, and should I sign one?
It is a contract a HIPAA covered entity must have before sharing protected health information with someone who works on its behalf. Sign one only if your systems and habits can meet its obligations and an attorney has reviewed it. Often the better route is to run the program inside the organization's own systems.
Can I say my coaching practice is "HIPAA compliant"?
If HIPAA does not apply to you, avoid the phrase. It suggests a legal status and security level you haven't been assessed against. Describe your actual practices instead: confidentiality, limited access, no sale of data, and export or deletion on request.
Is Coachful HIPAA compliant?
No. Coachful is not HIPAA-certified and does not sign business associate agreements. It is built for coaching records such as agreements, intake answers, notes, check-ins and messages, not for clinical records or insurance billing. If you need HIPAA coverage for part of your work, keep that part in a clinical system.
What is Coachful's free white-glove service?
It is a build service included on every plan. You describe what you want, such as a website, intake form, program, coaching flow or email sequence, and attach up to 8 reference links and 10 files. The Coachful team then builds it inside your account, usually within about 24 hours. It won't invent credentials, testimonials or legal text; it leaves those gaps for you.
Does HIPAA apply if I coach someone who is also seeing my friend, a therapist?
Not to you. The therapist is the covered entity. They need the client's written authorization before sharing anything with you, usually on their own release form. Get the client's written OK under your coaching agreement before you share anything back.
I'm a licensed therapist who also coaches. Which rules apply?
If your clinical practice sends standard insurance transactions, it is a covered entity, and mixing coaching clients into the same records and intake can blur the line. Many dual-licensed practitioners keep separate agreements, records and marketing for coaching. Your licensing board and a health-law attorney are the right people to confirm your setup.
Does HIPAA apply to coaches outside the United States?
No. HIPAA is US federal law. In the UK and EU, data protection law (UK GDPR and the EU GDPR) applies to most coaching businesses and treats health data as a special category. Check your national regulator's guidance.
How long should I keep coaching notes?
No federal rule sets a period for coaches outside HIPAA. Pick one, write it into your agreement, and apply it consistently, checking any tax or insurance record requirements with your accountant or insurer. Shorter is generally safer for sensitive notes that serve no ongoing purpose.
