Does HIPAA Apply to Cash-Pay Telehealth Companies?

It depends on what the company does, not on how patients pay: HIPAA applies to a cash-pay telehealth company if it is a health care provider that sends health information electronically in connection with a HIPAA standard transaction, such as an insurance claim or eligibility check, or if it handles protected health information (PHI) as a business associate of a covered entity. Not taking insurance does not decide either point by itself. Outside HIPAA, the FTC Act still applies, and state health privacy laws may too. Curve Compliance gives telehealth companies server-side conversion tracking that removes PHI before anything is sent to an ad platform, with a BAA on every plan.

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, then set up server-side conversions under a BAA on every plan. Book a call with Curve.

The first route: are you a covered entity?

Under 45 CFR 160.103, a covered entity is a health plan, a health care clearinghouse, or "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter." A health care provider includes "any other person or organization who furnishes, bills, or is paid for health care in the normal course of business", so a telehealth company can be one whether or not it bills insurance.

The transaction decides it. The list in 160.103 includes claims, eligibility for a health plan, claim status, and referral certification and authorization, and 45 CFR Part 162 sets the standard for each. HHS gives the usual example in its COVID-era telehealth FAQ: a provider is covered "if it transmits any health information in electronic form in connection with a transaction for which the Secretary has adopted a standard (e.g., billing insurance electronically)."

HHS adds two points in its Privacy Rule summary. "Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction." And the rule covers a provider "whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf." So a provider that sends no claims can still be covered if it, or a vendor, sends a health plan an electronic eligibility check or authorization request. The Privacy Rule then covers its self-pay care too (45 CFR 164.522(a)(1)(vi)).

The CMS Covered Entity Decision Tool ends the same way: a provider that does not "transmit (send) any covered transactions electronically" is "NOT a covered health care provider and therefore not a covered entity." The same test decides whether HIPAA applies to a med spa.

The second route: are you a business associate?

A company that is not a covered entity can still come under HIPAA as a business associate: a person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter," such as billing or practice management (160.103; HHS, Business Associates).

Take a telehealth brand that runs the website, intake and billing while an affiliated medical group delivers care and a partner pharmacy or lab fills orders. If a partner is a covered entity and you handle its patients' PHI on its behalf, the definition may fit, and the covered entity "must have a written business associate contract or other arrangement with the business associate" (HHS, Covered Entities and Business Associates). The definition also excludes "A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual." Your contracts and data flows decide it, so talk to your counsel. See our BAA guide.

Your setup	HIPAA status	What else can apply	Source
Card payments only. No covered transaction is sent electronically, by you or a billing service. No work for covered entities.	Not a covered entity under the CMS test.	FTC Act section 5; state health privacy laws; the Health Breach Notification Rule if you offer a personal health record.	160.103; CMS tool
Card payments, but you or a vendor send eligibility checks, authorization requests or claims to a health plan electronically.	Covered entity if you are a health care provider, self-pay care included.	FTC Act section 5 and state laws.	160.103; 164.522
You run the platform, intake or billing for a covered medical group, pharmacy or lab.	Business associate if you handle its PHI on its behalf. A written agreement is required.	FTC Act section 5 and state laws. The FTC's breach rule does not cover business associate work.	160.103; 16 CFR 318.1

Outside HIPAA does not mean unregulated

The FTC Act. Section 5 says "unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." The FTC's health information guidance says these obligations "apply to HIPAA-covered entities and business associates, as well as to companies that collect, use, or share health information that aren't required to comply with HIPAA" and that its cases "make clear that disclosing consumers' health information for advertising without their affirmative express consent may be an unfair practice."

The Health Breach Notification Rule. 16 CFR Part 318 "applies to foreign and domestic vendors of personal health records, PHR related entities, and third party service providers" and "does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity." A breach includes an unauthorized acquisition "that occurs as a result of a data breach or an unauthorized disclosure." The amended rule took effect July 29, 2024. On September 9, 2026 the FTC rescinded its 2021 policy statement on health apps, with the 2024 update "rendering the policy statement unnecessary." The rule stays. See who the rule covers.

FTC cases. These are FTC actions over health data sent to ad platforms, not HHS HIPAA cases.

Company and date	What the FTC alleged, in its words
GoodRx, February 1, 2023	The first action under the Health Breach Notification Rule, "for failing to notify consumers and others of its unauthorized disclosures of consumers' personal health information to Facebook, Google, and other companies."
Monument, April 11, 2024	It gave custom events "descriptive titles that revealed details about its users" such as "Paid: Weekly Therapy" and sent them to ad platforms "along with users' email addresses, IP addresses, and other identifiers".
Hims & Hers, July 29, 2026	The FTC, with Utah and California, sued "alleging that the telehealth provider shared consumers' sensitive health information about medical conditions with third-party advertising platforms despite claiming its services maintain consumers' privacy". The FTC lists the case as pending.

State laws. Washington's My Health My Data Act covers a "regulated entity" that "Conducts business in Washington, or produces or provides products or services that are targeted to consumers in Washington" and decides how consumer health data is used. Sharing that data needs "consent from the consumer for such sharing that is separate and distinct from the consent obtained to collect consumer health data", or a need to share it to provide what the consumer requested. The act exempts HIPAA PHI and "Health care information collected, used, or disclosed in accordance with chapter 70.02 RCW". See Curve's MHMDA checklist.

California's Confidentiality of Medical Information Act defines a provider of health care by state license or certification, not insurance billing. Section 56.06 extends it to some businesses, including one that offers "a mental health digital service". Section 56.10 says a provider "shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization," with listed exceptions. Our state law reference table lists more.

How Curve helps cash-pay telehealth companies

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names, so a completed visit does not have to carry a treatment name. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and flags them so they can be stopped at the source (what counts as PHI on a website).

For telehealth funnels, Curve follows each patient from ad click through intake, booking and the completed visit, and credits the outcome to the original ad click. Outcomes from Healthie, Athenahealth, OptiMantra, IntakeQ and Jane arrive through Keragon. Telehealth apps are tracked through the React Native SDK, and consent management applies the right rule for each visitor's region. Curve signs a BAA on every plan and is SOC 2 Type II. Curve's team does the setup, and most customers are live in about a week. See Curve for telehealth and our telehealth tracking guide.

Sources, checked October 13, 2026: 45 CFR 160.103; 45 CFR Part 162; 45 CFR 164.522; HHS on covered entities, the Privacy Rule, business associates and telehealth; CMS Covered Entity Decision Tool; 15 U.S.C. 45; 16 CFR Part 318; 89 FR 47028; FTC health information guidance, policy statement withdrawal and press releases on GoodRx, Monument and Hims & Hers; RCW 19.373; and California Civil Code 56.05, 56.06 and 56.10.

Frequently Asked Questions

Does HIPAA apply to a cash-pay telehealth company that doesn't take insurance?

It depends on what the company does. HIPAA applies if it is a health care provider that sends health information electronically in connection with a standard transaction, or if it handles PHI as a business associate of a covered entity (45 CFR 160.103). Not taking insurance does not decide it.

Is a telehealth company a covered entity if patients only pay by card?

Not on that fact alone. CMS says a provider that does not "transmit (send) any covered transactions electronically" is not a covered entity (CMS tool). An electronic eligibility check or authorization request to a health plan is a listed transaction (160.103).

Can a telehealth company be a HIPAA business associate?

Yes. A business associate "creates, receives, maintains, or transmits protected health information" on behalf of a covered entity (160.103). A platform that handles PHI for a covered medical group, pharmacy or lab may fit.

If HIPAA does not apply, can we put the Meta Pixel on intake pages?

Being outside HIPAA does not answer that. The FTC says "disclosing consumers' health information for advertising without their affirmative express consent may be an unfair practice" (FTC guidance). Curve Compliance sends conversions server-side and removes PHI before anything is sent to an ad platform.

Does the FTC Health Breach Notification Rule apply to telehealth companies?

It applies to vendors of personal health records and related entities, not to HIPAA covered entities (16 CFR 318.1). In GoodRx, the FTC said "as a vendor of personal health records, GoodRx is subject to the Health Breach Notification Rule" (FTC).

Can a cash-pay telehealth company say it is HIPAA compliant?

Only if the claim is true and not misleading. FTC guidance warns against "false or misleading claims" that you are "HIPAA Compliant" (FTC guidance). The FTC alleged GoodRx "displayed a seal at the bottom of its telehealth services homepage falsely suggesting to consumers that it complied with" HIPAA (FTC).

Talk to Curve Compliance

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, set up server-side conversions for your telehealth funnel, and sign a BAA on every plan. Book a call with Curve.