HIPAA for optometry practices: privacy, security and staff training

This page works from two of HIPAA's rules, both administered by HHS and both written in 45 CFR part 164: the Privacy Rule and the Security Rule.

They cover different things, and a covered entity's compliance program addresses both.

The Privacy Rule governs the practice's PHI policies.

It is the rule behind the designated privacy official, new-hire training on those policies and documented retraining after material changes — the duties this page takes up under staff training below.

On retention, HHS says the Privacy Rule includes no medical record retention period: state laws generally govern how long records are kept, and HIPAA's safeguards apply for as long as a practice keeps them, disposal included.

The Security Rule is the electronic half.

It applies to electronic protected health information — ePHI — and requires every covered entity, regardless of size, to conduct an accurate and thorough risk analysis of risks to the confidentiality, integrity and availability of that information (45 CFR 164.308(a)(1)(ii)(A)).

It also requires a security awareness and training program for all workforce members, including management, plus a sanction policy for staff who violate security policies (45 CFR 164.308(a)(1) and (a)(5)).

One retention clock belongs to HIPAA itself: required documentation — policies, procedures and required records — is kept six years from creation or from the date last in effect, whichever is later (45 CFR 164.530(j)(2)).

That clock covers compliance documentation, not patient charts; chart retention comes from state law and payer rules.

HIPAA is also one layer of a practice's compliance stack — OSHA, the FTC prescription rules and Medicare sit alongside it.

The compliance checklist walks the full list; this page stays on HIPAA.

The risk analysis is one of the Security Rule's "Required" specifications — not an optional one — and the text is demanding about its quality.

The rule calls for an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic PHI held by the covered entity or business associate (45 CFR 164.308(a)(1)(ii)(A)).

The requirement is size-independent: every covered entity conducts one, regardless of size.

A one-doctor practice and a multi-location group sit under the same sentence.

As the rule frames it, the assessment reaches ePHI the practice holds and ePHI its business associates hold — one reason the vendor agreements in the next section belong in the same workstream.

Change may be coming.

On December 27, 2024, HHS OCR issued a proposed rule to strengthen the Security Rule: it would remove the distinction between "required" and "addressable" implementation specifications, and require a technology asset inventory and network map at least every 12 months.

It was a proposal.

As of October 12, 2026, no final rule text appeared in 45 CFR 164.308 — the current text still carries the required and addressable labels.

Build your program to the text in force, and check HHS for the proposal's status before restructuring anything around it.

A business associate, as HHS defines it, is a person or organization that performs functions or services for a covered entity, where the work involves creating, receiving, maintaining or transmitting protected health information.

Claims processing, data analysis, billing and practice management are on its list of examples.

The billing example is the one with a hard edge for optometry practices.

An outside company that handles billing or claims processing involving patient information is a business associate, and the practice must have a written business associate contract or agreement with it (45 CFR 164.502(e)(2), 164.504(e)).

How Medicare pays such an agent is a separate question, covered in in-house vs outsourced billing.

The written agreement has a defined job: it must describe the permitted uses and disclosures of PHI and bar the business associate from other uses (45 CFR 164.504(e)).

Two boundary notes from HHS keep the definition from swallowing every vendor a practice pays.

A BAA is not needed with vendors whose work does not involve PHI — HHS's example is a janitor — and the "conduit" exception does not cover vendors that access PHI on a regular or frequent basis to perform a service for the practice.

HHS's named examples reach several modern practice vendors.

An independent medical transcriptionist, or the vendor of a transcription app, is a business associate — so a remote or AI scribe vendor that handles patient records generally needs a BAA.

So do a health care app developer providing patient messaging or patient-management services on the practice's behalf, and a third-party AI chatbot on a patient portal handling appointment scheduling and reminders.

The HHS guidance we read does not name optometry's vendor categories one by one — your EHR platform, a lens lab, the online sellers your patients' contact lens prescriptions go to.

Whether a specific vendor is a business associate turns on the definition above: does that vendor create, receive, maintain or transmit PHI on the practice's behalf?

Map your own vendor list against it, and confirm the close calls with a healthcare attorney.

The Privacy Rule sets the training baseline: train each new workforce member on the practice's PHI policies within a reasonable period after they join, retrain staff after material policy changes, and document the training (45 CFR 164.530(b)).

The annual-training question has a precise answer.

The federal text sets no fixed annual-training rule; "annual HIPAA training" is a common best practice, not a requirement written into the regulation.

What the text requires is the new-hire window, the material-change retrigger and the documentation.

The Security Rule adds a second program with a wider audience: a security awareness and training program for all members of the workforce, including management (45 CFR 164.308(a)(5)).

The same rule requires a sanction policy for staff who violate security policies, so the training program and the consequences for breaking it are both written requirements.

Documentation ties it together and carries its own retention clock: the required HIPAA documentation — policies, procedures and required records — stays for six years from creation or from the date last in effect, whichever is later (45 CFR 164.530(j)(2)).

For a practice, the trigger date is the hire date: every new technician, optician or front-desk hire starts the training clock, which is why HIPAA training belongs on the onboarding checklist rather than in a drawer.

The recruiting steps that lead to day one are covered in hiring for your optometry practice.

A response program starts from the pieces above.

The risk analysis is where a practice identifies its vulnerabilities in electronic PHI before an incident finds them (45 CFR 164.308(a)(1)(ii)(A)).

The trained workforce and the sanction policy are the human layer (45 CFR 164.308(a)(1) and (a)(5)).

The designated privacy official gives the program an accountable owner (45 CFR 164.530(a)), and the written policies sit in the documentation the practice keeps.

When PHI sits with a business associate, the written agreement is what spells out that vendor's permitted uses and disclosures (45 CFR 164.504(e)) — the document to read first when an incident involves a vendor's systems.

The breach-notification side of HIPAA — deadlines, who must be notified, and any thresholds — was not established in the sources this page was written from.

Do not build a response plan around a remembered deadline: get the current requirements from HHS, and review the finished plan with a healthcare attorney before you need it.

Patients can ask for access to their records, and the clock is explicit.

The rule requires a covered entity to act on a request for access no later than 30 days after receipt, with one extension of no more than 30 days if the practice notifies the patient in writing of the reason (45 CFR 164.524).

Copies can carry only a reasonable, cost-based fee, limited to the cost of labor for copying, supplies, postage and — where the patient has agreed — preparing a summary (45 CFR 164.524(c)(4)).

Prescription release is a different duty from a different agency.

Under the FTC's Eyeglass Rule, the prescriber gives the patient one copy of the eyeglass prescription immediately after a refractive eye exam and before offering to sell eyewear, whether or not the patient asks (16 CFR 456.2(a)).

Keep the two apart in your front-desk workflow: the FTC rule sets the prescription handover, HIPAA's right of access sets the records-request clock, and each is its own requirement under its own agency.

Requests that mix records and prescriptions are the edge cases to confirm with HHS's guidance and the FTC's compliance pages.

This page is employer information, not medical, licensing, legal, billing or coding advice. HIPAA's rules here are administered by HHS; confirm the current requirements — including the status of the December 2024 Security Rule proposal — with HHS before relying on them, and review your vendor agreements, training program and response plan with a healthcare attorney.