Business & Professional Practice

Lesson 5 of 10

Privacy, consent, and medicolegal responsibility

Ethical practice means protecting private information, obtaining meaningful consent, and staying within professional scope. HIPAA applies to covered entities and business associates as defined by federal law; it does not automatically cover every massage practice, though confidentiality duties may still arise from state law, contracts, ethics, or other rules. Consent is ongoing, specific, and revocable. Good risk management includes recognizing when to stop, document, or refer.

Key points

• Limit access to client information and share it only with authorization or a valid legal basis.
• Use plain language to explain techniques, draping, expected sensations, and alternatives.
• A client can pause or withdraw consent; respond promptly without pressure or retaliation.
• Scope of practice is defined by jurisdiction and credential; do not diagnose or promise medical cures.
• Negligence generally concerns failure to meet a duty of care that causes foreseeable harm; facts and law matter.
• Know applicable retention and secure-disposal rules for records; do not keep or destroy them arbitrarily.
• Report privacy incidents or safety concerns through the appropriate channels and seek guidance.

Key terms

HIPAA

U.S. federal health-information privacy and security law applying to defined covered entities and associates.

Confidentiality

Duty to protect private information and limit its disclosure appropriately.

Informed consent

Voluntary agreement made after receiving understandable information about a proposed service.

Scope of practice

Activities a practitioner may perform under applicable law, regulation, and credential.

Negligence

A legal concept involving breach of a duty of care and resulting harm, as defined by law.

Retention period

Required or adopted duration for keeping a particular record.

Referral

Directing a client to another qualified provider when needs exceed the practitioner's role.