Front-desk onboarding checklist

For owners and managers of OT, PT and speech clinics serving children, adults or both: onboard a front-desk hire in stages. Set up accounts before day one, train HIPAA in the first week, teach phones, scheduling, referrals, insurance, Medicare, payments, consent, interpreters and records, then watch real scenarios before the hire works alone.

What should a front-desk onboarding checklist cover?

A front-desk onboarding checklist covers what the hire needs before the first shift, what they learn in the first week, what they practice under supervision, and what a manager confirms at 30 days. A greeting script alone does not make someone ready: the desk books evaluations, verifies coverage, collects payments, answers privacy questions and routes clinical questions, for a parent calling about a toddler and for an adult calling about their own care.

Start with a service map the hire can read in ten minutes: the disciplines the clinic offers (OT, PT, speech), the ages each clinician sees, locations and telehealth, languages, evaluation and visit lengths, payers accepted, and what the clinic does not offer. Make the map the first page of the binder, because every routing decision on this page starts from it. A clinic that serves both children and adults can borrow the population split from the children and adults guide.

What must be ready before a new hire’s first day?

Before day one, the hire needs their own logins at the right access level, a signed confidentiality and acceptable-use policy to read, a list of approved tools, and a training plan with dates. Doing this ahead keeps the first morning for people, not passwords.

• Their own user name for every system. The HIPAA Security Rule requires a unique name or number for identifying and tracking each user, so shared front-desk logins do not meet it.⁠²
• Access set by role. The Security Rule requires policies and procedures so that each workforce member has appropriate access to electronic patient information; procedures to clear a member’s access and to end it when employment ends are addressable specifications under that standard.⁠¹³
• Exclusion check. OIG says anyone who hires an individual on its List of Excluded Individuals/Entities may be subject to civil monetary penalties, and that health care entities should routinely check the list for new hires and current employees.⁠¹⁴
• Screens that lock. Electronic procedures that end a session after a set time of inactivity are one of the Security Rule’s technical safeguards, listed as addressable.⁠²
• Password rules. The Security Rule’s training standard includes procedures for creating, changing and safeguarding passwords.⁠¹³
• The policy binder. The privacy and security policies, the sanctions policy, the cancellation and payment policies, the language access procedures and the incident report form, each with the name of the person who answers questions about it.

Which HIPAA training does a front-desk hire need?

Training on the clinic’s own privacy and security policies, given within a reasonable period after the person joins and documented. The Privacy Rule requires a covered entity to train all workforce members on its policies as necessary for their functions, to train each new member within a reasonable period, and to document that training was provided.⁠¹ The Security Rule separately requires a security awareness and training program for all workforce members, including management.⁠¹³

The HIPAA Rules apply to health care providers who transmit health information in electronic form in connection with a covered transaction, so the privacy lead confirms at hiring that the clinic is covered and which policies apply.⁠⁴ Tie the training to the desk’s real tasks: what may be said on the phone, what goes on a sign-in sheet, who may receive a child’s information, and how to report a mistake. The clinic must also have and apply sanctions for workforce members who fail to follow its privacy policies, so the hire should read that policy in week one, not after a mistake.⁠¹

What does minimum necessary mean at the front desk?

It means using, sharing and asking for only the patient information the task needs, and giving each role access to only what its work requires. The Privacy Rule requires reasonable efforts to limit information to the minimum necessary for the purpose of a use, disclosure or request.⁠¹⁵ HHS explains that the clinic’s policies must identify the persons or classes of persons who need access to carry out their job duties, the types of information they need, and the conditions of that access.⁠³

At the desk, that usually means demographics, insurance, the schedule, referral and authorization status, and balances, not evaluation reports or treatment notes. The rule does not apply to disclosures to or requests by a health care provider for treatment, so sending a referring pediatrician or physician what they need for the patient’s care is not limited by it.⁠¹⁵ Write the desk’s access level into the role description, so the next hire starts at the same place.

Which apps can the front desk use with patient data?

Only the tools the clinic has approved, and for any outside service that stores or handles patient information, only after a business associate agreement is signed. HHS describes business associates as persons other than workforce members who are engaged to carry out functions or services that involve patient information, and lists billing, practice management, EHR vendors and a chatbot on a provider’s patient portal that handles appointment scheduling among its examples.⁠⁴ A covered entity may let a business associate create, receive, maintain or transmit patient information only after obtaining satisfactory assurance that it can appropriately safeguard it.⁠¹⁵

A cloud service that stores patient information for the clinic is a business associate even if it holds only encrypted data and lacks the key, and HHS allows its use when the clinic has a HIPAA-compliant business associate agreement with it.⁠⁵ Give the hire a short list: the scheduling system, the phone and texting platform, the fax or e-fax service, the email account, and the payment terminal, each marked approved, with a line saying that personal phones, personal email and free consumer apps are not used for patient information.

What should a new hire say on the phone?

A new hire answers with the clinic’s name and their own, finds out who the call is about and what they need, books or routes it, and leaves a record of the next step. Use the clinic’s existing intake call script rather than writing a second one, and teach the reason behind each question so the hire can handle calls the script does not cover.

Train these four habits in the first week:

• Name the caller’s role. A parent, an adult patient, a spouse, a case manager, a physician’s office and an insurer each get different information; the sections below on privacy, minors and records say what each may receive.
• Route clinical questions. Whether therapy fits a diagnosis, how many visits a child needs, or whether pain after a session is normal goes to a clinician, with a callback time; the desk does not answer from the calendar.
• Leave short messages. HHS says the Privacy Rule does not prohibit leaving messages on answering machines, and suggests leaving only the clinic’s name and number and what is needed to confirm an appointment, or asking the person to call back.⁠¹⁶
• Honor contact requests. A provider must accommodate reasonable requests to receive communications by alternative means or at alternative locations, and may require the request in writing.⁠¹⁷ HHS gives calls at the office rather than at home as an example of a reasonable request.⁠¹⁶

For the call that does not book, the clinic’s reply standards and the guide to why callers do not book set the follow-up; for a family asking to talk to a therapist first, the free consultation call guide sets the limits of that call. A caller describing an emergency is told to call 911, and the desk tells the clinician on duty.

How should the front desk schedule therapy visits?

The front desk books from written rules: which visit types exist, how long each takes, which clinicians and rooms each needs, and how far ahead each can be booked. Put these on one page:

Teach the hire which visits need a clinician’s approval before booking, such as a child younger or older than the clinician usually sees, an adult with a new diagnosis since the last plan, or a request to change discipline. When there is no opening, the waitlist guide sets who is offered the next slot, and the appointment reminders guide covers what a reminder may say.

Can a clinic charge for a missed therapy visit?

For a clinic billing Medicare as a physician or supplier, yes, if its missed-appointment policy and fee apply equally to Medicare and non-Medicare patients. CMS allows physicians and suppliers to charge Medicare beneficiaries for missed appointments provided they also charge non-Medicare patients, and the amount charged to Medicare beneficiaries must be the same as the amount charged to others.⁠¹⁸ A clinic enrolled in Medicare as another type of provider, and every clinic for its Medicaid and commercial patients, follows a written policy the billing lead has checked against its Medicare enrollment, each payer contract and the state Medicaid manual.

Give the hire the policy in writing, the words to explain it at booking, and the rule for exceptions (illness, weather, transport failures), with the name of who can waive a fee. A fee the desk waives for one family and charges another is a fairness problem before it is a billing one.

When does a therapy patient need a referral?

It depends on three separate questions the desk should ask in order: what the state allows, what the payer requires, and what the clinic’s own policy is. A front-desk hire who treats these as one question books evaluations that cannot be paid, or turns away patients who could have been seen.

• State law. APTA reports that, as of July 1, 2025, all 50 states, the District of Columbia and the U.S. Virgin Islands have either provisional or unrestricted direct access to physical therapists for evaluation and treatment, and that provisions tied to treatment without a referral persist in a number of states.⁠¹⁹ For OT and speech, and for the limits on PT, the desk uses the clinic’s state page in the state guides.
• Medicare. The Medicare certification rule states that its references to an order or referral do not require an order or referral for outpatient PT, OT or speech.⁠⁶ What Medicare requires is a plan of care certified by a physician or nonphysician practitioner, covered in the Medicare section below; and when a patient comes for an evaluation without a referral and needs no treatment, a referral, order or certification of the evaluation is required for payment.⁠²⁰
• Other payers. Medicaid and commercial plans can set their own referral or prescription rules; the physician order and referral guide lists what to verify before scheduling.

At intake, record the referral source, the referring practitioner’s name and contact, the date of the referral and whether it is on file. The clinic must also give each new patient its notice of privacy practices: a provider with a direct treatment relationship provides it no later than the first service delivery, makes a good faith effort to obtain a written acknowledgment and, if it is not obtained, documents why.⁠²¹ A clinic with a physical office posts the notice where patients can read it.⁠²¹ That acknowledgment is usually a front-desk task, so it belongs on the checklist.

How does the front desk verify therapy insurance?

The desk verifies coverage before the first visit, records what the plan said and who said it, and repeats the check when the plan year, the plan or the authorization changes. Teach one verification form for every payer:

Two items belong on the scheduler’s screen: visit limits that combine OT, PT and speech under one count, and authorizations that cover a set number of visits or a date range. Put both on the patient’s account, not only in the verification record. For a patient whose plan does not include the clinic, the out-of-network benefits guide covers what to tell them; for children on Medicaid, the EPSDT guide covers pediatric coverage.

Medicaid plans have one payment rule every desk should know: a state must limit Medicaid participation to providers who accept the agency’s payment, plus any deductible, coinsurance or copayment the plan requires, as payment in full.⁠²² So a Medicaid patient is not billed the difference between the clinic’s fee and the Medicaid rate.

What do payers owe a clinic on prior authorization?

For Medicare Advantage plans, Medicaid and CHIP programs and plans, and the federal exchange plans that CMS’s rule covers, decisions on time and a reason for any denial. CMS’s prior authorization rule requires these payers, except the exchange plans, to send decisions within 72 hours for expedited requests and seven calendar days for standard requests, and requires all of them to give a specific reason for a denial, with compliance starting January 1, 2026.⁠²³

Teach the hire to log each request: the date and time sent, the method, the visits and dates requested, and the date a decision is due. When the window passes with no answer, the desk follows up and tells the billing lead; when a denial arrives, the reason goes to the clinician, who decides whether to appeal. Employer and individual plans outside those groups follow their own contracts and state law.

What should the front desk know about Medicare therapy?

The front desk needs three Medicare facts: whether the patient has Original Medicare or a Medicare Advantage plan, where the patient stands against the yearly therapy threshold, and when the plan of care must be certified and recertified. Medicare Advantage plans are among the payers covered by CMS’s prior authorization rule above, so verify a Medicare Advantage plan’s authorization and referral rules as you would a commercial plan’s.⁠²³

What is the Medicare KX modifier threshold for 2026?

For calendar year 2026, the threshold is $2,480 for PT and speech-language pathology combined and $2,480 for OT. CMS explains that claims above these amounts must carry the KX modifier as confirmation that the services are medically necessary as justified by documentation in the record, that claims above the threshold without it are denied, and that the amount is indexed each year.⁠⁷ A separate targeted medical review threshold is $3,000 for PT and speech and $3,000 for OT, and not every claim above it is reviewed.⁠⁷

The amounts accrue per patient, not per clinic: Medicare’s contractors apply the thresholds to therapy services for each beneficiary, and its Common Working File tracks them.⁠²⁴ So at intake, ask a new Medicare patient whether they have had outpatient PT, OT or speech elsewhere this calendar year, and tell the billing lead when the answer is yes. Adding the KX modifier is the clinician’s and the biller’s decision, made from the documentation, never the desk’s.

The Advance Beneficiary Notice is also not a desk decision. CMS describes it as a notice given to Original Medicare beneficiaries when Medicare payment is expected to be denied, to transfer potential financial liability to the beneficiary in certain instances.⁠²⁵ The desk hands it out when the clinician or billing lead says so, explains it in plain words, and files the signed copy.

Who tracks Medicare plan of care certification?

The front desk often keeps the calendar, even though the clinician writes the plan and a physician or nonphysician practitioner certifies it. Medicare’s certification rule requires that therapy be furnished while the patient is under the care of a physician, nurse practitioner, clinical nurse specialist or physician assistant, and that the plan be recertified at least every 90 days.⁠⁶ Medicare’s manual says the initial plan should be certified as soon as it is obtained or within 30 days of the initial therapy treatment, that a certification covers up to 90 calendar days, and that treatment beyond the certified duration requires recertification.⁠²⁰

There is one exception the desk should know about: when the therapist establishes the plan, a written order or referral is in the record, and the therapist has documented delivering the plan to the physician, NP, PA or CNS within 30 days of completing the initial evaluation, the certification does not need that practitioner’s signature.⁠⁶ Give the desk a report of plans due for signature or recertification in the next 14 days, with who sent each and when, because the manual notes that payment may be denied if a physician does not certify the plan.⁠²⁰

How should the desk handle payments and self-pay?

The desk collects what the patient owes under the clinic’s written financial policy, explains it the same way to every patient, and sends exceptions to the owner or billing lead. The insurance and fees guide has the words for explaining deductibles, copays and coinsurance; this section covers the rules a new hire must not get wrong.

• Copays are collected, not quietly waived. HHS’s Inspector General notes that the statute defines remuneration to include waivers of copayments and deductibles, and that offering Medicare or Medicaid beneficiaries remuneration likely to influence their choice of provider can bring civil monetary penalties.⁠²⁶ Hardship decisions follow a written policy and are made by the owner, not at the counter.
• Receipts and payment plans follow one template. The desk records the amount, the date, the method and what the payment applied to.

When does a self-pay patient get a good faith estimate?

When an uninsured or self-pay patient schedules a service or asks for one, and any question about cost counts as asking. The No Surprises Act rule requires clinics to tell all uninsured or self-pay individuals that a good faith estimate is available upon scheduling or upon request, to display that notice on the website, in the office and where scheduling happens, and to say it orally when scheduling or when someone asks about cost.⁠⁸ The rule treats any discussion or inquiry about the potential costs of a service as a request for an estimate.⁠⁸

Who counts: a patient with no coverage for the service under a group or individual health plan, a federal employees’ plan or a Federal health care program, and a patient with a group, individual or federal employees’ plan who chooses not to have a claim submitted.⁠⁸ The deadlines run from scheduling or the request:

A course of therapy can be covered by a single estimate for recurring services, but its scope cannot exceed 12 months, and an issued estimate is part of the patient’s medical record.⁠⁸ If the final bill comes in at least $400 above the estimate, it is substantially in excess under the federal patient-provider dispute resolution rule, so the desk sends any such bill to the billing lead before it goes out.⁠²⁷

What does patient privacy look like at the front desk?

Privacy at the desk means reasonable safeguards, not silence: the Privacy Rule does not require that all risk of incidental disclosure be eliminated, but it does require reasonable safeguards and minimum necessary limits around it.⁠²⁸ HHS’s examples of reasonable safeguards include speaking quietly when discussing a patient’s condition with family in a waiting room, avoiding patients’ names in public hallways and elevators, and protecting computers that hold personal information with passwords.⁠²⁸

• Sign-in sheets and names. HHS says clinics may use sign-in sheets and call out names in waiting rooms if the information is appropriately limited; a sign-in sheet may not show medical information not needed to sign in, such as the reason for the visit.⁠²⁹
• Screens and paper. Angle monitors away from the counter, lock the screen when stepping away, and keep intake forms, referral faxes and payment slips face down or in a closed tray.
• Verifying callers. Before disclosing patient information, the clinic must verify the identity and authority of a requester it does not know, except for the family and friends disclosures covered by its own rule.⁠³⁰ Teach one method: name, date of birth and one more identifier, checked against the account.
• Family and friends. The clinic may share information directly relevant to a family member’s or friend’s involvement in the patient’s care or payment, and when the patient is present and able to decide, it obtains their agreement, gives them the chance to object, or reasonably infers from the circumstances that they do not object.⁠³¹
• Mistakes are reported, not fixed quietly. An incidental disclosure that results from failing to apply reasonable safeguards or the minimum necessary standard is not permitted, so a misdirected fax or email goes to the privacy lead at once.⁠²⁸

Who can consent and get information for a minor?

Usually a parent or legal guardian, but state or other applicable law decides who has authority to make a patient’s health care decisions, and the desk should know the clinic’s rule before the first call.⁠³² HHS explains that in most cases a parent, guardian or other person acting in loco parentis is the minor’s personal representative under HIPAA, because the parent usually has authority to make the child’s health care decisions.⁠³² HHS adds that the exceptions generally track the ability of certain minors to obtain specified care without parental consent under state or other law, and include a parent agreeing to a confidential relationship between the minor and a provider.⁠³²

Teach the desk what to collect for every child: who brought the child, who holds legal authority to consent, any custody order or guardianship paper the family provides, who else may schedule or receive information, and how each person prefers to be contacted. When two parents disagree, or a document is unclear, the desk does not decide; it sends the question to the owner. For teenagers moving into adult care, the pediatric-to-adult transition guide covers when the patient becomes the decision-maker. When a teenager asks to consent for themselves, the desk sends the question to the owner, who checks the state’s law; the state guides are the starting point for the clinic’s state.

What about adults who bring a helper or have a guardian?

An adult patient makes their own decisions unless someone holds legal authority to act for them. If a person has authority under applicable law to make health care decisions for an adult, the clinic must treat that person as the adult’s personal representative for the information relevant to that role.⁠¹⁵ A spouse, adult child or friend without that authority is a helper: the clinic may share what is directly relevant to their involvement in care or payment, with the patient’s agreement or without objection when the patient is present.⁠³¹

At the desk, address the adult patient first, even when a helper does the talking; record the helper’s name and role; and ask the patient, privately if possible, what the helper may hear. A communication difficulty, such as aphasia after a stroke, does not by itself give a relative authority, because a personal representative’s authority comes from applicable law, so the clinic offers communication support instead of switching to the relative.⁠¹⁵

How should the front desk arrange interpreters?

By offering a qualified interpreter at no cost and never asking the patient to bring one, under the clinic’s written language access procedures. The Section 1557 rule applies to recipients of federal financial assistance, and HHS’s 2024 final rule interprets Medicare Part B payments as federal financial assistance, so its requirements apply to entities paid through Part B.⁠^10,33 A court vacated some of that rule’s provisions on gender identity on October 22, 2025, and HHS’s June 2, 2026, notice states that the rule’s other provisions remain in force.⁠³⁴

For a covered clinic, the desk’s rules are these:

• Free, qualified and timely. Language assistance must be free, accurate and timely, and when interpretation is required the clinic must offer a qualified interpreter.⁠⁹
• No bring-your-own interpreter. The clinic must not require a patient with limited English proficiency to provide or pay for their own interpreter, and must not rely on a minor child to interpret except as a temporary measure in an emergency involving an imminent threat to safety.⁠⁹
• Only qualified staff interpret. The clinic must not rely on staff other than qualified interpreters, translators or qualified bilingual staff to communicate with these patients.⁠⁹ A front-desk employee who speaks Spanish is not automatically qualified to interpret an evaluation.
• Written procedures. The clinic’s language access procedures must say how an employee identifies whether someone has limited English proficiency and how the employee obtains a qualified interpreter or translator.⁠³⁵
• The notice. The clinic must provide a notice that language assistance and auxiliary aids are available, in English and at least the 15 languages most commonly spoken by people with limited English proficiency in its state or states.⁠³⁶

The same rule requires the clinic to train employees who interact with patients and the public on these policies, including each new employee within a reasonable period after joining, and to document the training and keep the record for at least three calendar years.⁠³⁷ Put the interpreter service’s phone number, account code and booking steps on the desk sheet. For more on languages, see the bilingual and Spanish-language services guide.

What are the front desk’s ADA duties at the door?

The ADA’s public accommodation rules list the professional office of a health care provider, and they bar charging a person with a disability a surcharge to cover the cost of auxiliary aids.⁠³⁸ Under the Section 1557 rule, a covered clinic must provide auxiliary aids and services free of charge, in accessible formats, in a timely way, and protecting the person’s privacy and independence.⁠³⁹

• Relay calls are real calls. The Justice Department says covered entities must accept calls placed through the telecommunications relay service and video relay service, and staff must treat relay calls like other calls.⁠⁴⁰
• Companions count. The ADA’s communication rules cover the person receiving services and, in appropriate circumstances, their parent, spouse or companion; a deaf parent of a child patient is owed effective communication too.⁠⁴⁰
• No bring-your-own interpreter here either. Covered entities cannot require a person to bring someone to interpret, and the exception for an accompanying adult does not apply to minor children.⁠⁴⁰
• Service animals. Under the ADA, a service animal is a dog individually trained to do work or perform tasks for a person with a disability.⁠⁴¹ When its role is not obvious, staff may ask only two questions: whether the dog is a service animal required because of a disability, and what work or task it has been trained to perform; they cannot ask about the disability, require documentation or ask for a demonstration.⁠⁴¹

For forms and the inquiry path, the accessible inquiry forms guide covers formats and alternatives.

How should a new hire handle a records request?

By identifying who is asking and under which rule, logging the request the day it arrives, and sending anything unusual to the privacy lead. Three kinds of request reach the desk:

For the patient’s own request, the clinic must act no later than 30 days after receiving it, may extend once by no more than 30 days with a written statement of the reason and the new date, and must provide the copy in the form and format requested if it is readily producible.⁠¹¹ The clinic may require requests in writing if it tells patients so, and may charge only a reasonable, cost-based fee.⁠¹¹ A patient may also direct the clinic to send a copy to another person in a written, signed request that clearly identifies the person and where to send it.⁠¹¹ HHS notes that a federal court limited that directive to an electronic copy of an electronic health record, and that the fee limit applies only to a patient’s request for their own records, so a directive covering paper records or other formats goes to the privacy lead, who may ask for an authorization instead.⁠⁴³

A clinic may disclose information for another health care provider’s treatment activities, which covers a request from the patient’s physician or a new therapist.⁠⁴⁴ Outside the uses the Privacy Rule permits or requires, a disclosure needs a valid authorization, so a school’s or attorney’s letter is not enough by itself.⁠⁴² Subpoenas, court orders and requests from law enforcement go straight to the owner or privacy lead.

What safety and incident steps come first?

On the first day, the hire learns where the exits, fire extinguishers and first aid kit are, how to call for help, and how to report anything that goes wrong. In the first week, they learn the clinic’s incident form and the three kinds of events that have their own deadlines.

• Privacy incidents. A breach is treated as known to the clinic when any workforce member or agent other than the person who committed it knows of it, and notice to affected people is due without unreasonable delay and no later than 60 calendar days after discovery.⁠¹² A misdirected fax, a lost list or a wrong-patient email is reported to the privacy lead the same day.
• Staff injuries. Every employer covered by the OSH Act must report a work-related fatality to OSHA within eight hours, and an in-patient hospitalization, amputation or loss of an eye within 24 hours, even an employer exempt from keeping injury records.⁠⁴⁵
• Concerns about a child. As of May 2023, in approximately 17 states and Puerto Rico any person who suspects child abuse or neglect is required to report, and in all states any person is permitted to report.⁠⁴⁶ The clinic tells the hire whether its state makes them a mandated reporter, and how to tell the owner, without delaying a required report.

Patient falls, a child leaving with someone not on the pickup list, a threatening visitor and a medical emergency in the waiting room each need a one-line instruction on the desk sheet: who to call first, and who writes the report.

What should the first week and first 30 days include?

A first week of training and observation, three weeks of supervised work on each task, and a written review at 30 days. The schedule below is a model to adapt, not a standard: a clinic with one location and one payer mix needs less time than one with three locations and Medicaid, Medicare and commercial plans.

1. Day one. Logins, the policy binder, the service map, the phone system, the incident form, safety exits and the people to ask.
2. Days two to five. HIPAA and civil rights training, documented; listening to calls; booking practice in a test account; the verification form with the billing lead.
3. Week two. Answering calls with a manager listening; booking evaluations and treatment visits; collecting copays; giving the notice of privacy practices.
4. Week three. Verifying coverage alone, with a check of each record; logging authorization requests; tracking plans due for certification.
5. Week four. Handling records requests, interpreter bookings and good faith estimates with review before anything is sent.
6. Day 30. The competency review below, signed by the manager and the hire, with any follow-up dates.

How do you check a new hire is ready to work alone?

By watching them do each task, not by asking whether they understand it. Record each item as shown, needs practice, or not yet seen:

Practice with scenarios built from the clinic’s real calls: a parent asking about an age the clinic does not see, an adult who wants written contact only, a spouse asking about an appointment, a referral that needs a clinician’s review, a self-pay caller asking the price, a family needing a Spanish interpreter, and a clinician calling in sick on a full day. Use test accounts, not real charts, for practice. An internal sign-off records that the clinic observed the tasks; it is not a professional certification, and the form should not call it one.

What does the printable onboarding checklist include?

The checklist below collects every section of this guide on one page; print it with the browser’s print command, fill in the clinic’s names and dates, and keep the signed copy with the training records. Under HIPAA, training documentation is kept six years from its creation or from when it was last in effect, whichever is later.⁠¹

The same list works as a refresher for an existing employee after a policy change. Copy it into the clinic’s own document so names, systems and phone numbers sit beside each line.

How do you keep front-desk training current?

By retraining the people whose work a change affects, soon after the change, and updating the service map and desk sheet the same day. The Privacy Rule requires training for each workforce member whose functions are affected by a material change in the clinic’s policies, within a reasonable period after the change takes effect.⁠¹ The Section 1557 rule has the same requirement for relevant employees when its civil rights policies change materially.⁠³⁷

Some changes come on a calendar. Medicare’s therapy threshold is indexed each year, and CMS notes that the amounts change each calendar year, so the desk sheet’s figure is updated each January.⁠^7,24 Others come with the clinic: a new clinician, a new location, a new payer, a discipline added or dropped, or a new phone system. When a clinician leaves, the desk needs the words for patients the same day, and the discharge guide covers transfers and records; when a former patient calls back, the former patient check-ins guide covers what may be said.

Review the misrouted calls, unbooked evaluations and denied claims each month for patterns that point to a training gap rather than a person, and add the fix to the checklist.

Sources

1. Electronic Code of Federal Regulations. 45 CFR 164.530, Administrative requirements (HIPAA Privacy Rule) (eCFR text, Title 45 up to date as of October 29, 2026; paragraphs (b), (c), (e) and (j)). Checked November 1, 2026.
   Show the passageHide the passage

   “A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity.”; “Thereafter, to each new member of the workforce within a reasonable period of time after the person joins the covered entity's workforce”; “To each member of the covered entity's workforce whose functions are affected by a material change in the policies or procedures required by this subpart or subpart D of this part, within a reasonable period of time after the material change becomes effective”; “A covered entity must document that the training as described in paragraph (b)(2)(i) of this section has been provided”; “A covered entity must reasonably safeguard protected health information to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure.”; “A covered entity must have and apply appropriate sanctions against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity”; “A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later.”.
2. Electronic Code of Federal Regulations. 45 CFR 164.312, Technical safeguards (HIPAA Security Rule) (eCFR text, Title 45 up to date as of October 29, 2026; paragraph (a)(2)). Checked November 1, 2026.
   Show the passageHide the passage

   “Unique user identification (Required). Assign a unique name and/or number for identifying and tracking user identity.”; “Automatic logoff (Addressable). Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.”.
3. U.S. Department of Health and Human Services, Office for Civil Rights. Minimum Necessary Requirement (HIPAA Privacy Rule guidance; content last reviewed July 26, 2013). Checked November 1, 2026.
   Show the passageHide the passage

   “For uses of protected health information, the covered entity’s policies and procedures must identify the persons or classes of persons within the covered entity who need access to the information to carry out their job duties, the categories or types of protected health information needed, and conditions appropriate to such access.”.
4. U.S. Department of Health and Human Services, Office for Civil Rights. Business Associates Frequently Asked Questions (FAQs) (HIPAA guidance; content last reviewed October 21, 2026). Checked November 1, 2026.
   Show the passageHide the passage

   “apply to covered entities–-health plans, health care clearinghouses, and health care providers who transmit health information in electronic form in connection with a covered transaction.”; “Generally, business associates are persons, other than a workforce member of a covered entity, that are engaged by a covered entity to carry out certain health care activities and functions or to provide certain services that involve the use or disclosure of PHI.”; “Some examples of activities performed on behalf of a covered entity by a business associate include claims processing or administration, data analysis, billing, and practice management.”; “creates, receives, maintains, or transmit patients’ PHI for patient management services (e.g., remote patient health counseling, patient messaging, monitoring of patients’ food and exercise, electronic health record (EHR) access) on behalf of the covered entity.”; “IT contractor or vendor (e.g., EHR vendor, Managed Services Provider) that provides maintenance and/or support services (either in person or remotely) for information systems that require the contractor or vendor to create, receive, maintain, or transmit ePHI.”; “Third-party vendor super intelligence (SI) chatbot on a provider’s patient portal that provides services involving the patient’s PHI such as symptom assessment, medical reminders, and appointment scheduling.”.
5. U.S. Department of Health and Human Services, Office for Civil Rights. Guidance on HIPAA & Cloud Computing (content last reviewed December 23, 2022). Checked November 1, 2026.
   Show the passageHide the passage

   “When a covered entity engages the services of a CSP to create, receive, maintain, or transmit ePHI (such as to process and/or store ePHI), on its behalf, the CSP is a business associate under HIPAA.”; “This is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data.”; “Yes, provided the covered entity or business associate enters into a HIPAA-compliant business associate contract or agreement (BAA) with the CSP that will be creating, receiving, maintaining, or transmitting electronic protected health information (ePHI) on its behalf, and otherwise complies with the HIPAA Rules.”.
6. Electronic Code of Federal Regulations. 42 CFR 424.24, Requirements for medical and other health services furnished by providers under Medicare Part B (eCFR text, Title 42 up to date as of October 29, 2026; paragraph (c)). Checked November 1, 2026.
   Show the passageHide the passage

   “The services were furnished while the individual was under the care of a physician, nurse practitioner, clinical nurse specialist, or physician assistant.”; “Recertification is required at least every 90 days.”; “the therapist has documented evidence that the plan of treatment has been delivered to the physician, NP, PA, or CNS within 30 days of completion of the initial evaluation, the certification does not need to be signed by a physician, NP, CNS, or PA who has knowledge of the case.”; “No references to an order or referral in this subsection shall be construed to require an order or referral for outpatient physical therapy, occupational therapy, or speech-language pathology services.”.
7. Centers for Medicare & Medicaid Services. Therapy Services (page last modified March 10, 2026; its Bipartisan Budget Act of 2018 section last revised in February 2026 for the CY 2026 thresholds). Checked November 1, 2026.
   Show the passageHide the passage

   “the law preserves the former therapy cap amounts as thresholds above which claims must include the KX modifier as a confirmation that services are medically necessary as justified by appropriate documentation in the medical record.”; “there is one amount for PT and SLP services combined and a separate amount for OT services.”; “This amount is indexed annually by the Medicare Economic Index (MEI).”; “Claims for services over the KX modifier threshold amounts without the KX modifier are denied.”; “$2,480 for PT and SLP services combined, and”; “$2,480 for OT services.”; “For CY 2021 (and each calendar year until 2028 at which time it is indexed annually by the MEI), the MR threshold is $3,000 for PT and SLP services and $3,000 for OT services.”; “The targeted MR process means that not all claims exceeding the MR threshold amount are subject to review as they once were.”.
8. Electronic Code of Federal Regulations. 45 CFR 149.610, Requirements for provision of good faith estimates of expected charges for uninsured (or self-pay) individuals (eCFR text, Title 45 up to date as of October 29, 2026). Checked November 1, 2026.
   Show the passageHide the passage

   “Federal health care program (as defined in section 1128B(f) of the Social Security Act)”; “but who does not seek to have a claim for such item or service submitted to such plan or coverage.”; “Informing all uninsured (or self-pay) individuals of the availability of a good faith estimate of expected charges upon scheduling an item or service or upon request”; “prominently displayed (and easily searchable from a public search engine) on the convening provider's or convening facility's website, in the office, and on-site where scheduling or questions about the cost of items or services occur;”; “Orally provided when scheduling an item or service or when questions about the cost of items or services occur; and”; “Convening providers and convening facilities shall consider any discussion or inquiry regarding the potential costs of items or services under consideration as a request for a good faith estimate;”; “When a primary item or service is scheduled at least 3 business days before the date the item or service is scheduled to be furnished: Not later than 1 business day after the date of scheduling;”; “When a primary item or service is scheduled at least 10 business days before such item or service is scheduled to be furnished: Not later than 3 business days after the date of scheduling; or”; “When a good faith estimate is requested by an uninsured (or self-pay) individual: Not later than 3 business days after the date of the request.”; “The scope of a good faith estimate for recurring primary items or services must not exceed 12 months.”; “A good faith estimate issued to uninsured (or self-pay) individual under this section is considered part of the patient's medical record and must be maintained in the same manner as a patient's medical record.”.
9. Electronic Code of Federal Regulations. 45 CFR 92.201, Meaningful access for individuals with limited English proficiency (Section 1557 rule) (eCFR text, Title 45 up to date as of October 29, 2026). Checked November 1, 2026.
   Show the passageHide the passage

   “A covered entity must take reasonable steps to provide meaningful access to each individual with limited English proficiency (including companions with limited English proficiency) eligible to be served or likely to be directly affected by its health programs and activities.”; “Language assistance services required under paragraph (a) of this section must be provided free of charge, be accurate and timely, and protect the privacy and the independent decision-making ability of the individual with limited English proficiency.”; “When interpretation services are required under this part, a covered entity must offer a qualified interpreter in its health programs and activities.”; “Require an individual with limited English proficiency to provide their own interpreter, or to pay the cost of their own interpreter;”; “Rely on a minor child to interpret or facilitate communication, except as a temporary measure while finding a qualified interpreter in an emergency involving an imminent threat to the safety or welfare of an individual or the public”; “Rely on staff other than qualified interpreters, qualified translators, or qualified bilingual/multilingual staff to communicate with individuals with limited English proficiency.”.
10. U.S. Department of Health and Human Services, Office for Civil Rights, and Centers for Medicare & Medicaid Services. Nondiscrimination in Health Programs and Activities (final rule, 89 FR 37522, May 6, 2024). Checked November 1, 2026.
    Show the passageHide the passage

    “The Department is finalizing its interpretation that Medicare Part B (“Part B”) funding meets the definition of “Federal financial assistance” for the purpose of title VI, title IX, section 504, the Age Act, and section 1557.”; “Thus, the requirements of section 1557 and other civil rights statutes apply to entities that receive payments through Medicare Part B.”.
11. Electronic Code of Federal Regulations. 45 CFR 164.524, Access of individuals to protected health information (eCFR text, Title 45 up to date as of October 29, 2026; paragraphs (b) and (c)). Checked November 1, 2026.
    Show the passageHide the passage

    “The covered entity may require individuals to make requests for access in writing, provided that it informs individuals of such a requirement.”; “the covered entity must act on a request for access no later than 30 days after receipt of the request”; “the covered entity may extend the time for such actions by no more than 30 days”; “provides the individual with a written statement of the reasons for the delay and the date by which the covered entity will complete its action on the request”; “The covered entity may have only one such extension of time for action on a request for access.”; “The covered entity must provide the individual with access to the protected health information in the form and format requested by the individual, if it is readily producible in such form and format”; “the covered entity may impose a reasonable, cost-based fee”; “The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information.”.
12. Electronic Code of Federal Regulations. 45 CFR 164.404, Notification to individuals (HIPAA Breach Notification Rule) (eCFR text, Title 45 up to date as of October 29, 2026; paragraphs (a)(2) and (b)). Checked November 1, 2026.
    Show the passageHide the passage

    “A covered entity shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity”; “without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.”.
13. Electronic Code of Federal Regulations. 45 CFR 164.308, Administrative safeguards (HIPAA Security Rule) (eCFR text, Title 45 up to date as of October 29, 2026; paragraphs (a)(3) to (a)(5)). Checked November 1, 2026.
    Show the passageHide the passage

    “Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information”; “Implement procedures to determine that the access of a workforce member to electronic protected health information is appropriate.”; “Implement procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends”; “Implement a security awareness and training program for all members of its workforce (including management).”; “Procedures for creating, changing, and safeguarding passwords.”.
14. U.S. Department of Health and Human Services, Office of Inspector General. Exclusions Program (OIG web page on the List of Excluded Individuals/Entities). Checked November 1, 2026.
    Show the passageHide the passage

    “Those that are excluded can receive no payment from Federal health care programs for any items or services they furnish, order,”; “Anyone who hires an individual or entity on the LEIE may be subject to civil monetary penalties (CMP).”; “To avoid CMP liability, health care entities should routinely check the list to ensure that new hires and current employees are not on it.”.
15. Electronic Code of Federal Regulations. 45 CFR 164.502, Uses and disclosures of protected health information: General rules (eCFR text, Title 45 up to date as of October 29, 2026; paragraphs (b), (e)(1) and (g)(1) to (g)(3)). Checked November 1, 2026.
    Show the passageHide the passage

    “a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.”; “This requirement does not apply to:”; “Disclosures to or requests by a health care provider for treatment;”; “A covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information.”; “If under applicable law a person has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.”.
16. U.S. Department of Health and Human Services, Office for Civil Rights. May physician’s offices or pharmacists leave messages for patients at their homes, either on an answering machine or with a family member, to remind them of appointments or to inform them that a prescription is ready? May providers continue to mail appointment or prescription refill reminders to patients’ homes? (HIPAA FAQ; created December 19, 2002; content last reviewed December 28, 2022). Checked November 1, 2026.
    Show the passageHide the passage

    “the Rule does not prohibit covered entities from leaving messages for patients on their answering machines.”; “a covered entity might want to consider leaving only its name and number and other information necessary to confirm an appointment, or ask the individual to call back.”; “A covered entity also may leave a message with a family member or other person who answers the phone when the patient is not home.”; “a request to receive mail from the covered entity at a post office box rather than at home, or to receive calls at the office rather than at home are also considered to be reasonable requests, absent extenuating circumstances.”.
17. Electronic Code of Federal Regulations. 45 CFR 164.522, Rights to request privacy protection for protected health information (eCFR text, Title 45 up to date as of October 29, 2026; paragraph (b)). Checked November 1, 2026.
    Show the passageHide the passage

    “A covered health care provider must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the covered health care provider by alternative means or at alternative locations.”; “A covered entity may require the individual to make a request for a confidential communication described in paragraph (b)(1) of this section in writing.”.
18. Centers for Medicare & Medicaid Services. Medicare Claims Processing Manual, Chapter 1, General Billing Requirements (Pub. 100-04; section 30.3.13, Charges for Missed Appointments, Rev. 3510, effective October 1, 2016). Checked November 1, 2026.
    Show the passageHide the passage

    “CMS's policy is to allow physicians and suppliers to charge Medicare beneficiaries for missed appointments, provided that they do not discriminate against Medicare beneficiaries but also charge non-Medicare patients for missed appointments.”; “the amount the physician/supplier charges Medicare beneficiaries for missed appointments must be the same as the amount that they charge non-Medicare patients”.
19. American Physical Therapy Association. Direct Access Advocacy (APTA advocacy page). Checked November 1, 2026.
    Show the passageHide the passage

    “As of July 1, 2025, all 50 states, the District of Columbia, and the U.S. Virgin Islands have either provisional or unrestricted direct access to physical therapist services for evaluation and treatment.”; “Even though patients may go directly to a physical therapist without a referral, some provisions tied to treatment absent a referral still persist in a number of states”.
20. Centers for Medicare & Medicaid Services. Medicare Benefit Policy Manual, Chapter 15, Covered Medical and Other Health Services (Pub. 100-02, Rev. 13889, issued July 30, 2026; section 220.1.3 and the note in section 220.3 on an evaluation that serves as the plan of care). Checked November 1, 2026.
    Show the passageHide the passage

    ““As soon as possible” means that the physician/NPP shall certify the initial plan as soon as it is obtained, or within 30 days of the initial therapy treatment.”; “Since payment may be denied if a physician does not certify the plan, the therapist should forward the plan to the physician as soon as it is established.”; “A physician/NPP may certify or recertify a plan for whatever duration of treatment the physician/NPP determines is appropriate, up to a maximum of 90 calendar days.”; “Treatment beyond the duration certified by the physician/NPP requires that a plan be recertified for the extended duration of treatment.”; “If the patient presented for evaluation without a referral or order and does not require treatment, a physician referral/order or certification of the evaluation is required for payment of the evaluation.”.
21. Electronic Code of Federal Regulations. 45 CFR 164.520, Notice of privacy practices for protected health information (eCFR text, Title 45 up to date as of October 29, 2026; paragraph (c)(2)). Checked November 1, 2026.
    Show the passageHide the passage

    “A covered health care provider that has a direct treatment relationship with an individual must:”; “No later than the date of the first service delivery, including service delivered electronically, to such individual”; “Except in an emergency treatment situation, make a good faith effort to obtain a written acknowledgment of receipt of the notice provided in accordance with paragraph (c)(2)(i) of this section, and if not obtained, document its good faith efforts to obtain such acknowledgment and the reason why the acknowledgment was not obtained;”; “Post the notice in a clear and prominent location where it is reasonable to expect individuals seeking service from the covered health care provider to be able to read the notice”.
22. Electronic Code of Federal Regulations. 42 CFR 447.15, Acceptance of State payment as payment in full (eCFR text, Title 42 up to date as of October 29, 2026). Checked November 1, 2026.
    Show the passageHide the passage

    “A State plan must provide that the Medicaid agency must limit participation in the Medicaid program to providers who accept, as payment in full, the amounts paid by the agency plus any deductible, coinsurance or copayment required by the plan to be paid by the individual.”.
23. Centers for Medicare & Medicaid Services. CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) (fact sheet). Checked November 1, 2026.
    Show the passageHide the passage

    “Medicare Advantage (MA) organizations, state Medicaid and Children’s Health Insurance Program (CHIP) Fee-for-Service (FFS) programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally Facilitated Exchanges (FFEs), (collectively “impacted payers”; “We are requiring impacted payers (excluding QHP issuers on the FFEs) to send prior authorization decisions within 72 hours for expedited (i.e., urgent) requests and seven calendar days for standard (i.e., non-urgent) requests.”; “Beginning in 2026, impacted payers must provide a specific reason for denied prior authorization decisions, regardless of the method used to send the prior authorization request.”; “These operational or process-related prior authorization policies are being finalized with a compliance date starting January 1, 2026”.
24. Centers for Medicare & Medicaid Services. Medicare Claims Processing Manual, Chapter 5, Part B Outpatient Rehabilitation and CORF/OPT Services (Pub. 100-04; section 10.3, Rev. 4214, effective January 1, 2019). Checked November 1, 2026.
    Show the passageHide the passage

    “Contractors apply the financial limitations or thresholds to the MPFS amount (or the amount charged if it is smaller) for therapy services for each beneficiary.”; “These amounts will change each calendar year.”; “When limitations or KX modifier thresholds apply, the Common Working File (CWF) tracks them.”.
25. Centers for Medicare & Medicaid Services. FFS ABN (Beneficiary Notices Initiative; page last modified July 17, 2026). Checked November 1, 2026.
    Show the passageHide the passage

    “is issued by providers (including independent laboratories, home health agencies, and hospices), physicians, practitioners, and suppliers to Original Medicare (fee for service - FFS) beneficiaries in situations where Medicare payment is expected to be denied.”; “The ABN is issued in order to transfer potential financial liability to the Medicare beneficiary in certain instances.”.
26. U.S. Department of Health and Human Services, Office of Inspector General. Office of Inspector General Policy Statement Regarding Gifts of Nominal Value To Medicare and Medicaid Beneficiaries (policy statement, December 7, 2016). Checked November 1, 2026.
    Show the passageHide the passage

    “a person who offers or transfers to a Medicare or Medicaid beneficiary any remuneration that the person knows or should know is likely to influence the beneficiary’s selection of a particular provider, practitioner, or supplier of Medicare or Medicaid payable items or services may be liable for civil monetary penalties”; “the statute defines “remuneration” to include, without limitation, waivers of copayments and deductible amounts (or any part thereof)”.
27. Electronic Code of Federal Regulations. 45 CFR 149.620, Requirements for the patient-provider dispute resolution process (eCFR text, Title 45 up to date as of October 29, 2026; paragraph (a)). Checked November 1, 2026.
    Show the passageHide the passage

    “Substantially in excess means, with respect to the total billed charges by a provider or facility, an amount that is at least $400 more than the total amount of expected charges listed on the good faith estimate for the provider or facility.”.
28. U.S. Department of Health and Human Services, Office for Civil Rights. Incidental Uses and Disclosures (HIPAA Privacy Rule guidance; content last reviewed July 26, 2013). Checked November 1, 2026.
    Show the passageHide the passage

    “does not require that all risk of incidental use or disclosure be eliminated to satisfy its standards”; “By speaking quietly when discussing a patient’s condition with family members in a waiting room or other public area;”; “By avoiding using patients’ names in public hallways and elevators, and posting signs to remind employees to protect patient confidentiality;”; “By providing additional security, such as passwords, on computers maintaining personal information.”; “An incidental use or disclosure that occurs as a result of a failure to apply reasonable safeguards or the minimum necessary standard, where required, is not permitted under the Privacy Rule.”.
29. U.S. Department of Health and Human Services, Office for Civil Rights. May physician’s offices use patient sign-in sheets or call out the names of their patients in their waiting rooms? (HIPAA FAQ; last updated March 14, 2006; content last reviewed December 28, 2022). Checked November 1, 2026.
    Show the passageHide the passage

    “Covered entities, such as physician’s offices, may use patient sign-in sheets or call out patient names in waiting rooms, so long as the information disclosed is appropriately limited.”; “the sign-in sheet may not display medical information that is not necessary for the purpose of signing in (e.g., the medical problem for which the patient is seeing the physician).”.
30. Electronic Code of Federal Regulations. 45 CFR 164.514, Other requirements relating to uses and disclosures of protected health information (eCFR text, Title 45 up to date as of October 29, 2026; paragraph (h)). Checked November 1, 2026.
    Show the passageHide the passage

    “Prior to any disclosure permitted by this subpart, a covered entity must:”; “Except with respect to disclosures under § 164.510, verify the identity of a person requesting protected health information and the authority of any such person to have access to protected health information under this subpart, if the identity or any such authority of such person is not known to the covered entity”.
31. Electronic Code of Federal Regulations. 45 CFR 164.510, Uses and disclosures requiring an opportunity for the individual to agree or to object (eCFR text, Title 45 up to date as of October 29, 2026; paragraph (b)). Checked November 1, 2026.
    Show the passageHide the passage

    “disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the protected health information directly relevant to such person's involvement with the individual's health care or payment related to the individual's health care.”; “If the individual is present for, or otherwise available prior to, a use or disclosure permitted by paragraph (b)(1) of this section and has the capacity to make health care decisions, the covered entity may use or disclose the protected health information if it:”; “Obtains the individual's agreement;”; “Provides the individual with the opportunity to object to the disclosure, and the individual does not express an objection; or”; “Reasonably infers from the circumstances, based on the exercise of professional judgment, that the individual does not object to the disclosure.”.
32. U.S. Department of Health and Human Services, Office for Civil Rights. Personal Representatives (HIPAA Privacy Rule guidance on 45 CFR 164.502(g); content last reviewed January 5, 2024). Checked November 1, 2026.
    Show the passageHide the passage

    “a person authorized (under State or other applicable law, e.g., tribal or military law) to act on behalf of the individual in making health care related decisions is the individual’s “personal representative.””; “In most cases under the Rule, a parent, guardian, or other person acting in loco parentis (collectively, “parent”) is the personal representative of the minor child and can exercise the minor’s rights with respect to protected health information, because the parent usually has the authority to make health care decisions about his or her minor child.”; “These exceptions generally track the ability of certain minors to obtain specified health care without parental consent under State or other laws, or standards of professional practice.”; “When a parent agrees to a confidential relationship between the minor and a health care provider.”.
33. Electronic Code of Federal Regulations. 45 CFR 92.4, Definitions (Section 1557 rule) (eCFR text, Title 45 up to date as of October 29, 2026). “Covered entity means:”; “A recipient of Federal financial assistance;”. Checked November 1, 2026.
34. U.S. Department of Health and Human Services, Office for Civil Rights, and Centers for Medicare & Medicaid Services. Notice of Vacatur Regarding Certain Provisions of the 2024 Nondiscrimination in Health Programs and Activities Final Rule (notification of court decision, June 2, 2026). Checked November 1, 2026.
    Show the passageHide the passage

    “Specifically, the court vacated certain provisions of the regulation to the extent they expand Title IX's definition of sex discrimination to include gender-identity discrimination.”; “(S.D. Miss. Oct. 22, 2025), vacating portions of the final rule titled “Nondiscrimination in Health Programs and Activities,” published May 6, 2024 (89 FR 37522).”; “The other provisions of the 2024 Rule remain in force.”.
35. Electronic Code of Federal Regulations. 45 CFR 92.8, Policies and procedures (Section 1557 rule) (eCFR text, Title 45 up to date as of October 29, 2026; paragraph (d)). Checked November 1, 2026.
    Show the passageHide the passage

    “A covered entity must implement written language access procedures in its health programs and activities describing the covered entity's process for providing language assistance services to individuals with limited English proficiency when required under § 92.201.”; “how an employee identifies whether an individual has limited English proficiency; how an employee obtains the services of qualified interpreters and translators the covered entity uses to communicate with an individual with limited English proficiency”.
36. Electronic Code of Federal Regulations. 45 CFR 92.11, Notice of availability of language assistance services and auxiliary aids and services (Section 1557 rule) (eCFR text, Title 45 up to date as of October 29, 2026). Checked November 1, 2026.
    Show the passageHide the passage

    “A covered entity must provide a notice of availability of language assistance services and auxiliary aids and services”; “must be provided in English and at least the 15 languages most commonly spoken by individuals with limited English proficiency of the relevant State or States in which a covered entity operates”.
37. Electronic Code of Federal Regulations. 45 CFR 92.9, Training (Section 1557 rule) (eCFR text, Title 45 up to date as of October 29, 2026). Checked November 1, 2026.
    Show the passageHide the passage

    “A covered entity must train relevant employees of its health programs and activities on the civil rights policies and procedures required by § 92.8”; “Thereafter, to each new relevant employee of the health program or activity within a reasonable period of time after the employee joins the covered entity's workforce”; ““relevant employees” includes permanent and temporary employees whose roles and responsibilities entail interacting with patients and members of the public”; “A covered entity must contemporaneously document its employees' completion of the training required by paragraphs (a) and (b) of this section in written or electronic form and retain said documentation for no less than three (3) calendar years.”.
38. Electronic Code of Federal Regulations. 28 CFR 36.301, Eligibility criteria, and 28 CFR 36.104, Definitions (ADA Title III regulations) (eCFR text, Title 28 up to date as of October 29, 2026; 36.301(c) and the 36.104 definition of place of public accommodation). Checked November 1, 2026.
    Show the passageHide the passage

    “A public accommodation may not impose a surcharge on a particular individual with a disability or any group of individuals with disabilities to cover the costs of measures, such as the provision of auxiliary aids”; “professional office of a health care provider”.
39. Electronic Code of Federal Regulations. 45 CFR 92.202, Effective communication for individuals with disabilities (Section 1557 rule) (eCFR text, Title 45 up to date as of October 29, 2026). Checked November 1, 2026.
    Show the passageHide the passage

    “Such auxiliary aids and services must be provided free of charge, in accessible formats, in a timely manner, and in such a way to protect the privacy and the independence of the individual with a disability.”.
40. U.S. Department of Justice, Civil Rights Division, ADA.gov. ADA Requirements: Effective Communication (guidance; last updated February 28, 2020). Checked November 1, 2026.
    Show the passageHide the passage

    “The rules apply to communicating with the person who is receiving the covered entity’s goods or services as well as with that person’s parent, spouse, or companion in appropriate circumstances.”; “Covered entities are also required to accept telephone calls placed through TRS and VRS, and staff who answer the telephone must treat relay calls just like other calls.”; “They cannot require a person to bring someone to interpret for him or her.”; “This exception does not apply to minor children.”.
41. U.S. Department of Justice, Civil Rights Division, ADA.gov. ADA Requirements: Service Animals (guidance; last updated February 28, 2020). Checked November 1, 2026.
    Show the passageHide the passage

    “Staff may ask two questions: (1) is the dog a service animal required because of a disability, and (2) what work or task has the dog been trained to perform.”; “Staff cannot ask about the person’s disability, require medical documentation, require a special identification card or training documentation for the dog, or ask that the dog demonstrate its ability to perform the work or task.”; “A service animal is a dog that is individually trained to do work or perform tasks for a person with a disability.”.
42. Electronic Code of Federal Regulations. 45 CFR 164.508, Uses and disclosures for which an authorization is required (eCFR text, Title 45 up to date as of October 29, 2026; paragraph (a)(1)). Checked November 1, 2026.
    Show the passageHide the passage

    “Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section.”.
43. U.S. Department of Health and Human Services, Office for Civil Rights. Important Notice Regarding Individuals’ Right of Access to Health Records (notice of the court order in Ciox Health, LLC v. Azar; content last reviewed January 28, 2020). Checked November 1, 2026.
    Show the passageHide the passage

    “On January 23, 2020, a federal court vacated the “third-party directive” within the individual right of access “insofar as it expands the HITECH Act’s third-party directive beyond requests for a copy of an electronic health record with respect to [protected health information] of an individual . . . in an electronic format.””; “the fee limitation set forth at 45 C.F.R. § 164.524(c)(4) will apply only to an individual’s request for access to their own records, and does not apply to an individual’s request to transmit records to a third party.”; “The right of individuals to access their own records and the fee limitations that apply when exercising this right are undisturbed and remain in effect.”.
44. Electronic Code of Federal Regulations. 45 CFR 164.506, Uses and disclosures to carry out treatment, payment, or health care operations (eCFR text, Title 45 up to date as of October 29, 2026; paragraph (c)). “A covered entity may disclose protected health information for treatment activities of a health care provider.”. Checked November 1, 2026.
45. Electronic Code of Federal Regulations. 29 CFR 1904.39, Reporting fatalities, hospitalizations, amputations, and losses of an eye as a result of work-related incidents to OSHA, and 29 CFR 1904.1 (eCFR text, Title 29 up to date as of October 29, 2026). Checked November 1, 2026.
    Show the passageHide the passage

    “Within eight (8) hours after the death of any employee as a result of a work-related incident, you must report the fatality to the Occupational Safety and Health Administration (OSHA), U.S. Department of Labor.”; “Within twenty-four (24) hours after the in-patient hospitalization of one or more employees or an employee's amputation or an employee's loss of an eye, as a result of a work-related incident, you must report the in-patient hospitalization, amputation, or loss of an eye to OSHA.”; “as required by § 1904.39, all employers covered by the OSH Act must report to OSHA any work-related incident that results in a fatality, the in-patient hospitalization of one or more employees”.
46. Child Welfare Information Gateway, Children’s Bureau, U.S. Department of Health and Human Services. Mandatory Reporting of Child Abuse and Neglect (State Statutes Series publication, the PDF linked from this page, state statutes current through May 2023). Checked November 1, 2026.
    Show the passageHide the passage

    “In approximately 17 States”; “and Puerto Rico, any person who suspects child abuse or neglect is required to report.”; “In all States, Territories, and the District of Columbia, any person is permitted to report when they have reason to believe that a child has been subjected to abuse or neglect.”.

Medical disclaimer. This page is for general educational purposes and does not constitute medical advice, diagnosis, or treatment. It is general guidance on running a therapy clinic, not legal, compliance, billing or financial advice. HIPAA, Medicare, Medicaid, payer and state rules apply to each clinic’s own facts, state law adds rules this checklist does not list, and its example is hypothetical.