6 min read
May 5, 2026
Does HIPAA Apply to Your Support Group?
Wondering whether HIPAA covers your group? Who counts as a covered entity, what it means if you are not one, and how to protect members either way.
Share
Subscribe
For most support group leaders, the answer is no, and that surprises people, because HIPAA has become shorthand for "health privacy" in general rather than the specific statute it is.
This page explains who HIPAA actually applies to, what it means if it does not apply to you, and what you should be doing about privacy either way. It is general information, not legal advice; if you are close to a line, ask a lawyer in your state.
HIPAA's privacy and security rules apply to covered entities and their business associates. They do not apply automatically to every organization that handles sensitive information.
Covered entities are health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in connection with certain standard transactions, most commonly billing insurance. Business associates are organizations that handle protected health information on behalf of a covered entity, under a contract.
These are the questions that decide it. They are questions rather than answers, because the answer depends on facts only you have.
If any of those gives you pause, that is the point to get advice on your own situation rather than rely on a general article. A clinician running a group as part of a billing practice is in a different position from a volunteer running a community group, and only the facts of your own setup settle it.
MentalHappy does not sell, share, or distribute member information. MentalHappy hosts expert-led psychoeducational support groups, supplemental to professional care, and does not host group therapy or clinical treatment.
Three things, and the third is the one that matters.
The practical upshot: stop asking whether you are legally required to protect member information, and start with the assumption that you are.
These apply whether or not HIPAA covers you, and they are most of what good practice consists of.
The strongest privacy protection is not holding the information. A support group needs a name and a way to contact someone. It does not need a diagnosis, a medical history, a date of birth or an address, and every field you add is something you now have to protect.
Invitation-only or approved-entry. A waiting room you admit from. Nobody in the room who is not a member. A group anyone can find and enter is not a private group, whatever your policy says.
The chilling effect on what people are willing to say is larger than any benefit, and a stored recording of a sensitive conversation is a risk with no upside. If someone misses a session, a short written summary of themes with no personal detail is a better answer.
Confidentiality stated vaguely is not kept, because everyone has their own idea of what it covers. Say plainly that nothing is repeated outside (including to partners, including without names) and state the limit: if someone is at risk of serious harm you may have to act.
One short paragraph telling members what information you hold, why, who can see it, and how long you keep it. Most leaders have never written this down, and writing it is usually the point at which they realize they are holding more than they need.
A lost phone, a mistaken email, a member repeating something outside. Decide now who you tell and how fast. If you are a covered entity there are formal breach notification requirements; if you are not, telling the affected people promptly is still the right answer.
Your analysis is different and you should not rely on a general article for it.
If your practice is a covered entity, whether a psychoeducational group you run sits inside or outside that is a real question with a fact-specific answer. Your professional board may also hold you to standards that apply regardless of HIPAA, and your professional liability cover may or may not extend to non-clinical group facilitation. Many policies are written around one-to-one clinical work.
Two practical habits help in any case. Say explicitly, at the start, which hat you are wearing. And keep the boundary clean: a support group member is not your client, and if someone in the group needs treatment, refer them rather than absorbing them into your practice through the group.
Most leaders find two or three of these uncomfortable the first time through, and all of them are fixable in an afternoon.
Not automatically. HIPAA applies to covered entities (health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically for certain transactions such as billing) and to their business associates. Whether it reaches your group depends on whether you or the organization behind the group fall into one of those categories, which is a question about your own setup rather than about support groups in general.
Yes. Other law may apply, including state privacy statutes that are in some cases stricter than HIPAA, and your obligation to the people in your group does not depend on which statute names it. Collect less, control who gets in, do not record, and tell members what you keep.
Only if you are a covered entity or a business associate. Be careful with the claim itself: "HIPAA compliant" usually means a product can be configured to support a covered entity's obligations, not that using it makes you compliant.
No. Recording changes what people are willing to say, and storing recordings of sensitive conversations creates risk with very little benefit. A short written summary of themes, with no personal detail, serves anyone who missed a session.
Putting member names in the To: field of a group email, which discloses the membership list to everyone on it. Use blind copy or a platform that handles messaging, and check before you send.
.svg)
