top of page
  • Writer's pictureMac Rinehart

What Therapists Need to Know about HIPAA-Compliant Mail Services

Updated: Feb 7

If you’re a mental or behavioral health professional delivering telehealth services from home, you are, like many providers, interested in protecting the privacy of your home address from clients and the public. That puts you in the market for commercial mail services, but did you know that most solutions do not meet the regulatory requirements for healthcare professionals?


Brightside Coworking has done the research for you on different types of commercial mail services and are ready to explain why practically all commercial mail services do not meet the regulatory requirements for HIPAA compliance, and furthermore why you can use the Brightside Coworking address as your place of business.


What Type of Mail Service Options Are Available?

Before we get into the regulations, I will briefly touch on the types of mail services available. The United States Postal Service, not surprisingly, is the de facto mail service provider for all physical addresses. And we have various parcel delivery services like UPS, FedEx, and DHL. Beyond these services, you’ll find there are several types of commercial mail service providers that provide a “virtual address” for clients. Here are some examples:

·       Registered Agent Service, also called statutory agents, provide a focused service of allowing their clients to use their address for state business licenses and registrations. Because business filings are public records, and they contain name and address information for filers, the registered agent acts as an intermediary, putting their agency address in place of the actual business registrant. That allows a layer of privacy and protection. But registered agents may offer limited mail services beyond receiving and forwarding official state communications regarding the business registration.

·       Commercial Mail Receiving Agencies (CRMA) are service providers that provide private or business mailboxes in competition with the USPS PO Box rental service. In addition to the mailbox service, CRMAs may offer a variety of additional services that make them a convenient place to receive and handle mailing services. Postal Annex and UPS Store are examples of a CRMA service providers.

·       United States Postal Service provides Post Office Boxes for rent. While not considered a Physical Address, for many organizations the PO Box is a great way to handle mail services.


How Does HIPAA Affect Service Options for Healthcare Professionals?


So, with a basic understanding of the types of service available, the next question is, what options work for healthcare professionals. This is where a deeper understanding of healthcare policy reveals that the lowest cost solutions are necessarily sufficient to the needs of organizations that must comply with HIPAA regulation.

All healthcare professionals and organizations that electronically transmit any HIPAA standard transactions are required to obtain a National Provider Identification (NPI) number. “HIPAA Standard Transactions” means any type of document that is protected by HIPAA regulation; it could be a health insurance claim, or an electronic medical record, or an Estimation of Benefits. If you or your business are interacting with electronically communicated information, then you and your organization must have an NPI, and this is where regulation precludes the use of most mail services.

The NPI application requires the provider or organization to supply an address for their practice location. Regulation requires that the Practice Location be an actual physical address. The National Plan & Provider Enumeration System (NPPES), which administers the provision of NPIs, researches the practice location address supplied in each NPI application, and the NPI application can be rejected if the practice location is not valid. In Fact, NPPES regulations specifically prohibit the use of register agents, PO Boxes, or Commercial Mail Receiving Agencies from being identified as the practice location. So if you’ve considered using any of these services for your place of business, think again.

Why Does Brightside Coworking satisfy the requirement?

Brightside Coworking is distinct from these providers because our business is specifically designed to work as a practice location for mental and behavioral health professionals. Brightside meets the requirements because we provide office space for our members to deliver services to their clients.


While Brightside Coworking is exempt from HIPAA regulations because we do not provide any services that involve transmittal of HIPAA standard transactions, we are sensitive to the needs of healthcare professionals, which is why our mail services are located housed in a secure, passcode protected office that only authorized members can access. And, unlike some providers that will open and scan mail, resulting in potential HIPAA violations, Brightside never opens any mail received on member’s behalf.

bottom of page