Most gyms are not covered by HIPAA. The law applies to health plans, clearinghouses and health care providers that send certain transactions electronically, such as insurance claims. A gym that sells memberships, runs classes and tracks heart rate or workout scores usually does none of that. But "HIPAA doesn't apply" is not the same as "member data is unregulated." State biometric laws, FTC rules and plain breach risk still land on your desk.
This guide shows how to check your own status, the situations that can change the answer, and the privacy and security habits worth adopting either way.
TL;DR
- HIPAA covers health plans, clearinghouses and health care providers that conduct standard electronic transactions. A gym that only handles memberships, scheduling and performance tracking is generally not one of them.
- Billing insurance, running a medical or physical therapy service, or partnering with a clinic can change that, so check before you assume.
- Even outside HIPAA, you face other rules: the FTC's health data enforcement, state privacy laws and biometric laws such as Illinois BIPA.
- Treat the HIPAA Security Rule's safeguards as a benchmark: access controls, encryption, audit logs, a vendor contract and a breach plan.
- Ask your software vendor how it protects data, who can see it, and what happens to it if you leave.
Table of Contents
- Who HIPAA actually covers
- When a gym can end up inside HIPAA
- What happens if you are covered and get it wrong
- What still applies to you if HIPAA does not
- Treat the Security Rule as your benchmark
- Vet your software like a business associate, even if the law doesn't make you
- Our perspective
- Where VO2WOD fits
- A practical checklist for this month
- FAQ
- Sources
Who HIPAA actually covers
HIPAA, the Health Insurance Portability and Accountability Act of 1996, regulates two groups: covered entities and business associates. Covered entities are health plans, health care clearinghouses and health care providers who transmit health information electronically in connection with standard transactions. The Centers for Medicare & Medicaid Services (CMS) keeps a plain-language page, Are You a Covered Entity?, and it also publishes a decision tool for covered providers that starts with one question: does the business furnish, bill or receive payment for health care in the normal course of business?
The standard transactions are the administrative ones: claims, eligibility inquiries, enrollment, payment and remittance advice, claim status requests and referral authorizations. If none of those describe your operation, you are not a covered entity.
Two things do not make you one:
- Collecting health-related information. Tracking a member's heart rate during a workout, logging a one-rep max, or noting an injury on an intake form does not create covered-entity status by itself.
- Having an app. Offering a member app or keeping a performance history is not a HIPAA trigger. What matters is whether you are a health care provider conducting those standard electronic transactions.
This is why the older top-ranking articles on the topic disagree in tone. Some warn gyms about fines, others say the law was never read to cover fitness facilities. Both can be right, because the answer depends on what a specific business does, not on the word "gym."
When a gym can end up inside HIPAA
The edge cases are where owners get caught out. Look honestly at these situations.
You bill insurance or health plans
If your facility offers physical therapy, chiropractic care, medically supervised rehab or any service where you submit claims to an insurer electronically, you may be a covered health care provider for that part of the business. That is the clearest route in. A gym that accepts payment from members by card is not doing this: ordinary card payments for a membership are not health care claims.
You operate a clinic under the same roof
Some functional fitness gyms share a space or an owner with a physical therapy practice. The clinic may be covered. The gym side may not be. The risk is blending the two: if member records and patient records sit in one system, or staff move freely between them, you can create compliance problems or expose clinical records through a gym tool. Keep them separated, and ask a health care attorney how the arrangement should be structured.
You work with a covered entity
If a hospital, doctor or insurer contracts with you, for example to run a referral program or a wellness benefit, the covered entity may require you to sign a business associate agreement (BAA) or comply with specific terms. Read what you are signing. HHS explains that a business associate is a person or organization that performs functions for a covered entity involving protected health information, and the HHS covered entities and business associates page is the place to start.
You run an employer wellness program
Wellness programs tied to a group health plan have their own rules. If an employer or insurer hires you to deliver one, ask who is the covered party and what data they expect you to hold.
If any of these fit, talk to a health care attorney, not a blog post. The cost of a one-hour consultation is small next to a federal investigation.
What happens if you are covered and get it wrong
For the businesses HIPAA does reach, penalties are real. HHS's summary of the Privacy Rule lists civil money penalties for violations after November 3, 2015, which with the 2022 inflation adjustment ranged from $127 to $63,973 per violation, with a calendar-year cap of $1,919,173 for identical requirements. Penalties are reduced or barred when the failure was not willful neglect and was corrected within 30 days. These figures are adjusted for inflation each year, so check the current table before you quote them.
Enforcement is also active on the security side. In April 2026, HHS announced that its Office for Civil Rights settled four ransomware investigations under the Security Rule. Those cases involved covered entities and business associates, not gyms. They still show what regulators look for after an attack.
What still applies to you if HIPAA does not
This is the part many gym owners skip, and it is where the real exposure often sits.
The FTC
The Federal Trade Commission has business guidance on its Health Breach Notification Rule. It points out that many companies collecting health information, such as fitness trackers and diet apps, are not covered by HIPAA, and that this does not leave the data without legal protection. The FTC enforces Section 5 of the FTC Act against deceptive or unfair practices. In plain terms: if your privacy policy or your marketing says you protect member data, you need to actually do it. Whether the Health Breach Notification Rule reaches your particular setup depends on the facts, so read the guidance and ask counsel.
State biometric and privacy laws
If your gym uses face, fingerprint or similar scans for check-in, the state law that matters most may be Illinois's Biometric Information Privacy Act (BIPA). It allows private lawsuits, with statutory damages of $1,000 per negligent violation and $5,000 per reckless or intentional one. A 2024 amendment treats repeated collection of the same biometric identifier from the same person as a single violation, which limits damages significantly, according to a law firm summary of the change and the Seventh Circuit's follow-up ruling. Consent, written notice and a retention policy still matter. Other states, including Texas and Washington, have biometric statutes, and several states have broader consumer privacy laws that can reach health-related data. Which ones apply depends on where your members live and what you collect.
A wristband or QR check-in does not involve a face or fingerprint scan. Heart rate readings from a wearable are also not automatically a biometric identifier under BIPA's definition. But how a law treats a given data type is a legal question for your attorney. If you want a practical starting point, our consent for biometric data toolkit covers what a gym should collect and in what form.
Breach risk, whatever the law says
Attackers do not check whether you are a covered entity. HHS's 2024 report to Congress on breaches found that hacking and IT incidents accounted for 81% of reported health-sector breaches affecting 500 or more people, and often involved ransomware on servers. Gyms are not in that dataset, but they hold the same kind of material: names, emails, payment details, birthdates, injury notes and performance history. A breach costs you member trust whether or not a regulator ever calls.
Treat the Security Rule as your benchmark
You are not required to follow the HIPAA Security Rule, but its structure is a sound checklist for any business holding sensitive member data. It sorts safeguards into administrative, physical and technical groups. HHS's January 2026 OCR cybersecurity newsletter stresses that security is an ongoing practice. It points to risk analysis, system hardening, regular security baselines and an up-to-date inventory of technology assets.
Here is how that translates for a gym with 100 to 600 members and a handful of staff.
| Safeguard type | What it means for a gym | Practical first step |
|---|---|---|
| Administrative | Who is allowed to see what, and what you do when something goes wrong | Give coaches access to class and performance data, not billing details. Write a one-page breach response plan. |
| Physical | Where devices and paper records live | Lock the front-desk computer when you step away. Shred paper waivers and intake forms you no longer need. |
| Technical | How data is protected on systems | Turn on multi-factor authentication for every admin account. Remove logins for former coaches the day they leave. |
| Inventory | Knowing what you hold and where | List every tool that touches member data: scheduling, billing, email, wearables, door access. |
If you want a shorter list to start this week, see our post on seven data privacy controls gym owners can implement.
Vet your software like a business associate, even if the law doesn't make you
Every system that touches member data is a vendor with access to your members' information. In HIPAA language, a vendor handling data for a covered entity is a business associate and needs a signed BAA. If you are not covered, a BAA is not legally required for a gym. The underlying idea is still sound: get the vendor's security and privacy commitments in writing.
Before you sign with any gym software provider, ask:
- Who owns the data? Your contract should say the member data is yours.
- Can you export it? Ask what files you get on request and in what format. Our guide to data portability files to demand lists ten.
- How is access controlled? Look for role-based permissions, multi-factor authentication and audit logs.
- What happens in a breach? The vendor should commit to notifying you promptly and explain how.
- How do integrations work? Wearable connections move data between systems. Ask what is shared, with whose consent, and how a member disconnects. Our posts on the Samsung Health pilot and wearable integration timelines show how we approach it.
- Is there a migration plan? Moving workout history is one of the riskiest moments for member data. See how to migrate workout history securely.
If a vendor says its software is "HIPAA compliant," ask what that means. No software makes a business HIPAA compliant by itself. What you want is evidence: encryption, audit controls, access management and a contract that backs it up.
Our perspective
We build software for functional fitness gyms, and the HIPAA question reaches us often. Owners see heart rate on a screen, a performance history and a member's birthday in one place, and they reasonably wonder if they have stepped into medical territory. Usually they have not.
The bigger risk is a different mistake: owners spend their worry on a law that probably does not reach them, and then leave the basics undone. Shared passwords at the front desk. A former coach whose login still works. A spreadsheet of member details emailed around. Those are the things that actually cause breaches.
Our view is that a gym should earn trust by being open about member data. Members who wear a heart rate monitor in class are sharing something personal. Tell them what you collect, why, who sees it, and how they can delete it. Keep it in one platform instead of five disconnected tools, because every extra tool is another place data can leak. Use a vendor that will tell you plainly how it handles security, and that will hand your data back when you ask.
We also think the HIPAA Security Rule's three safeguard groups are a fair standard for a gym to hold itself to, even though it is not a legal obligation for most gyms. And when something looks like it crosses into health care, with insurance billing, a clinic or a hospital partnership, we say the same thing every time: get a qualified attorney involved before you launch.
— Marcus
Where VO2WOD fits
VO2WOD is management software built for functional fitness gyms. It combines live in-class heart rate monitoring, automatic workout scoring, memberships and recurring billing, class scheduling, QR or wristband check-in, lead tracking and member messaging in one platform. Consolidating those functions means fewer separate tools holding copies of your member list. We offer free data migration, one month of complimentary service and a dedicated team to help you switch.
To see what the platform does, visit VO2WOD. If you are weighing a switch, our page on why gyms change software explains what we do differently, and you can ask us about security and data ownership during onboarding.
A practical checklist for this month
- Write down your status. Do you bill insurance, run clinical services or have a covered-entity partner? If yes, speak to a health care attorney. If no, note why you believe HIPAA does not apply.
- Inventory your data. List each system holding member information and who has access.
- Lock down logins. Multi-factor authentication on admin accounts, individual logins for every staff member, and immediate removal when someone leaves.
- Update consent and privacy language. Make sure your waiver, privacy policy and app notices match what you actually collect, especially for wearables and any biometric check-in.
- Review vendor contracts. Confirm data ownership, export rights and breach notification.
- Plan for a breach. Decide who calls whom, how you notify members and where your records are backed up.
- Revisit once a year. The HHS guidance describes security as ongoing, and state laws keep changing.
FAQ
Do gyms have to be HIPAA compliant?
Most do not. HIPAA applies to covered entities and their business associates, and a gym that only sells memberships and tracks workouts is generally neither. If you bill insurance, run a clinical service or contract with a covered entity, the answer may change, so check with a health care attorney.
Do personal trainers have to follow HIPAA?
Personal trainers and other non-medical fitness professionals are generally not covered entities. Discussing a client's health or tracking their heart rate does not change that. A trainer who works inside a clinic or under a contract with a covered entity may have obligations through that relationship.
Is heart rate data protected health information?
Only if it is held by a covered entity or business associate in that capacity. A gym's heart rate data is generally not PHI under HIPAA. It is still sensitive personal data, and state privacy and biometric laws, FTC enforcement and your own privacy promises can apply to it.
Should my gym software be HIPAA compliant?
It is not required for a typical gym. It is a useful signal, though. Ask any vendor about encryption, access controls, audit logs, breach notification and data export, and get the answers in the contract.
What are the penalties for violating HIPAA?
For covered entities, civil penalties after the 2022 inflation adjustment ranged from $127 to $63,973 per violation, with an annual cap of $1,919,173 per identical requirement, according to HHS. These figures are adjusted each year. If HIPAA doesn't apply to you, other laws, such as state biometric statutes, carry their own penalties.
Sources
- Covered Entities and Business Associates, HHS
- Are You a Covered Entity?, CMS
- Is a Person, Business, or Agency a Covered Health Care Provider, CMS
- Summary of the HIPAA Privacy Rule, HHS
- HHS Office for Civil Rights settles four ransomware investigations
- Complying with FTC's Health Breach Notification Rule
- Seventh Circuit on the BIPA damages amendment, Davis Wright Tremaine
- Annual Report to Congress on Breaches of Unsecured PHI, Calendar Year 2024
- January 2026 OCR Cybersecurity Newsletter, HHS