Compliance Pitfalls That Trigger Audits: HIPAA, Good Faith Estimates & State Rules for PT & Chiropractic

Compliance Pitfalls That Trigger Audits: HIPAA, Good Faith Estimates, and State Rules for PT and Chiropractic Practices in 2026

Independent physical therapy and chiropractic practices face a steady stream of compliance requirements that can trigger audits, complaints, or financial penalties when overlooked. In 2026 the most frequent problem areas remain HIPAA safeguards, Good Faith Estimates under the No Surprises Act, and variations in state practice and billing rules. Practices that treat these requirements as routine operational habits rather than occasional projects reduce risk and protect both reputation and revenue.

This article identifies the common pitfalls in each area and outlines practical steps outpatient rehab clinics can take to stay compliant.

HIPAA Pitfalls That Still Cause Problems

HIPAA enforcement continues to focus on basic, preventable gaps. The most common issues for small practices include failure to complete or update a thorough risk analysis, missing or incomplete business associate agreements, weak access controls, and impermissible disclosures of protected health information.

A risk analysis is not a one-time document. It must cover the current environment, including any new software, remote work arrangements, or mobile devices used for clinical or billing purposes. Practices that skip the analysis or treat it as a static checklist are frequently cited when the Office for Civil Rights investigates a complaint or breach.

Business associate agreements must be in place with every vendor that creates, receives, maintains, or transmits protected health information on the practice’s behalf. This includes billing services, EHR vendors, cloud storage providers, and even some patient-communication platforms. An expired or missing agreement is an easy finding in an audit.

Staff training and access controls also matter. Employees should have access only to the minimum necessary information for their role. Shared logins, unattended workstations, and casual conversations about patients in public areas remain frequent sources of complaints. Regular, documented training and a clear sanctions policy help demonstrate good-faith compliance.

Good Faith Estimates Under the No Surprises Act

The No Surprises Act requires providers to give uninsured or self-pay patients a Good Faith Estimate of expected charges. The estimate must be provided within specific time frames when a service is scheduled or when a patient requests one. Failure to issue a timely and reasonably accurate estimate can lead to patient-provider dispute resolution processes and potential penalties.

For physical therapy and chiropractic clinics the requirement most often applies to cash-pay patients, patients who choose not to use insurance, or patients whose insurance does not cover the planned services. The estimate should list the expected services and the corresponding charges in language the patient can understand. It does not have to be perfect, but it must be issued in good faith based on the information available at the time.

Common pitfalls include forgetting to issue the estimate for new cash-pay patients, using outdated fee schedules, or failing to update the estimate when the plan of care changes significantly. Create a simple trigger in the scheduling or intake process so that every uninsured or self-pay encounter generates a Good Faith Estimate before care begins.

Keep a copy of every estimate in the patient record. If a dispute later arises, the practice needs to show that an estimate was provided and that the final charges were consistent with it or that changes were communicated.

State-Specific Rules That Vary Widely

State practice acts, supervision requirements, and billing regulations differ across the country. What is permissible in one state may create compliance risk in another. Physical therapy supervision rules for assistants, chiropractic scope-of-practice limitations, and state-level surprise-billing or transparency laws all fall into this category.

Practices that operate in multiple states or that employ providers licensed in different jurisdictions must track the stricter applicable rule. Relying solely on federal Medicare guidelines is not enough when state law imposes additional requirements.

Billing rules can also vary. Some states have specific documentation or modifier requirements for workers’ compensation or auto-insurance claims. Others regulate how promptly claims must be submitted or how patient balances may be pursued. A periodic review of the state practice act and the most common non-Medicare payer rules in your primary states prevents avoidable problems.

Documentation and Billing Practices That Attract Scrutiny

Although medical-necessity documentation is covered in detail elsewhere, it remains a major compliance trigger. Incomplete P.A.R.T. findings for chiropractic claims, missing time documentation for timed physical therapy codes, and notes that fail to support continued skilled care frequently lead to audits or recoupments.

Modifier use is another high-risk area. Incorrect or missing AT modifiers on chiropractic claims and improper use of KX, GP, or 59 modifiers on physical therapy claims generate both denials and audit attention. Consistent internal checks before claim submission reduce exposure.

High utilization patterns without corresponding clinical support also draw scrutiny. Practices should monitor visit frequency and duration against diagnosis and progress so that any outlier cases are clinically justified and well documented.

Build Simple, Sustainable Compliance Habits

Compliance does not require a large compliance department. It requires consistent habits. Designate one person (often the office manager or billing lead) as the point person for tracking regulatory updates. Schedule a brief quarterly review of HIPAA policies, Good Faith Estimate processes, and any new state requirements.

Maintain a current list of business associates and confirm that agreements are signed and up to date. Conduct a risk analysis at least annually and whenever significant technology or workflow changes occur. Document the analysis and any remediation steps.

Train staff on HIPAA, Good Faith Estimates, and the financial policy at orientation and at regular intervals. Keep attendance records. When a near-miss or actual issue occurs, treat it as a process improvement opportunity rather than solely as an individual error.

Responding to Complaints or Audit Requests

If a complaint or records request arrives, respond promptly and completely. Designate a single contact person so that communications stay consistent. Gather the requested records, the relevant policies, and any Good Faith Estimates or risk-analysis documentation. Avoid altering records after the fact. Timely, organized responses demonstrate good-faith compliance and often limit further escalation.

A Practical Compliance Check Sequence

Month 1: Confirm that a current risk analysis exists and that all business associate agreements are signed and current.

Month 2: Review the Good Faith Estimate process for uninsured and self-pay patients and verify that estimates are being issued and retained.

Month 3: Check state practice-act and key payer rules for any recent changes and update internal checklists.

Ongoing: Include a short compliance item in regular staff meetings and perform periodic spot checks of documentation and claim accuracy.

Practices that follow this sequence typically identify and close gaps before they become formal findings.

Conclusion

HIPAA, Good Faith Estimates, and state-specific rules remain active sources of compliance risk for physical therapy and chiropractic practices in 2026. The most common pitfalls are basic and preventable: incomplete risk analyses, missing business associate agreements, overlooked Good Faith Estimates, and failure to track state variations. Clinics that embed simple review habits, clear ownership, and regular staff training significantly reduce the chance of audits, complaints, and penalties. Compliance is most effective when it is treated as part of ordinary operations rather than an occasional project.

References

CMS. “Overview of Rules & Fact Sheets – No Surprises Act.” CMS.gov, 2026, https://www.cms.gov/nosurprises/policies-and-resources/overview-of-rules-fact-sheets.

HIPAA Journal. “The Most Common HIPAA Violations You Must Avoid.” HIPAA Journal, 2 Jan. 2026, https://www.hipaajournal.com/common-hipaa-violations/.

Patient Protect. “HIPAA Compliance for Chiropractic Practices.” Patient Protect, 28 Apr. 2026, https://patient-protect.com/post/hipaa-compliance-chiropractic-practices-2026.

OmniMD. “Good Faith Estimate Rules 2026: Compliance Gaps to Avoid.” OmniMD, 2026, https://omnimd.com/blog/good-faith-estimate-compliance-gaps/.

Centers for Medicare & Medicaid Services. “Chiropractic Services.” CMS.gov, 11 Feb. 2026, https://www.cms.gov/training-education/medicare-learning-networkr-mln/compliance/medicare-provider-compliance-tips/chiropractic-services.