Informed Consent, Confidentiality, and HIPAA-Aligned Record Keeping

Why Informed Consent, Confidentiality, and Records Matter

Every massage session legally and ethically begins before your hands touch the client. Informed consent, confidentiality, and accurate record keeping are not paperwork formalities—they are the foundation of a professional, safe, and lawful practice. State licensing boards require them, the MBLEx tests them, and clients deserve them. Skipping any element can result in discipline, loss of your state license, or harm to the person in your care.

What Informed Consent Really Means

Informed consent is the process by which a client is given enough clear information to make a voluntary, knowledgeable decision about receiving massage. It has three parts:

1. Disclosure — You explain, in plain language, what services you will provide, the areas of the body involved, your draping policy, any known risks or contraindications relevant to the session, and the limits of your scope of practice. Clients must know you are a massage therapist, not a medical provider, and that massage does not diagnose or treat disease.

2. Comprehension — You check that the client understands. Ask open-ended questions. If a client has a language barrier or disability, take steps to ensure genuine understanding.

3. Voluntariness — Consent must be freely given. Clients have the right to stop the session at any time, modify the session, or refuse any technique—without penalty or pressure from you.

Consent is documented with a signature on an intake or consent form, along with the date, the therapist's name, and a brief session plan. Verbal explanation alone is not enough for legal and ethical compliance. A client who lacks legal capacity to consent (such as a minor) requires the signature of a parent or guardian.

The Intake Form and Health History

Before the consent form is signed, the client completes a health history intake. This serves two purposes: it screens for contraindications (conditions where massage is unsafe or must be modified), and it creates a legal record. A vague intake—for example, writing "some health issues" instead of noting that a client has a pacemaker—fails both purposes. Document specifics clearly and legibly.

Key elements of a complete intake and consent packet:

• Client's full name, contact information, and date
• Detailed health history including medications, recent surgeries, skin conditions, and chronic conditions
• Description of the services to be provided that session
• Statement of the client's right to stop or modify the session
• Draping policy explained in plain language
• Scope-of-practice disclosure (what massage therapists do and do not do)
• Contraindication screening results and therapist's notes on session modifications
• Client signature and date
• Therapist's printed name

SOAP Notes and Accurate Record Keeping

After (or during) each session, you complete a SOAP note. SOAP stands for:

• S — Subjective: What the client tells you (chief complaint, pain level, symptoms).
• O — Objective: What you observe and assess (posture, range of motion, tissue texture, areas worked).
• A — Assessment: Your professional observations about what you found (use massage-appropriate language; do not diagnose).
• P — Plan: What you did, techniques used, areas addressed, and recommendations for future sessions.

SOAP notes are legal documents. Write them in ink, avoid correction fluid (draw a single line through errors and initial them), and sign and date every entry. Incomplete or altered notes can be used as evidence of negligence or fraud.

Confidentiality and HIPAA-Aligned Practice

Everything a client shares with you—health history, personal circumstances, the fact that they are your client at all—is confidential. You may not discuss a client's information with anyone outside of direct treatment without written authorization from the client. This includes friends, family members, other practitioners not involved in the client's care, and social media.

The Health Insurance Portability and Accountability Act (HIPAA) sets federal standards for protecting health information in covered healthcare settings. Not every private massage practice is a covered entity under HIPAA, but the ethical standard of confidentiality applies to all massage therapists regardless of business structure. Many state licensing boards hold therapists to HIPAA-aligned practices as a professional standard even when strict legal HIPAA coverage does not apply. Following HIPAA-aligned practices—securing paper records, password-protecting electronic records, limiting who can access files—is both ethically required and professionally protective.

Never share a client's Protected Health Information (PHI) without written, signed authorization. Common violations include:

• Discussing a client's condition within earshot of others in a waiting room
• Sending unencrypted emails containing health details
• Sharing information about a mutual friend who is also your client, even casually

Safety Considerations

The intake and consent process is your primary safety screen. A contraindication discovered on the intake form can prevent serious harm—for example, avoiding deep pressure over an area of recent surgery, or referring a client with an acute DVT (deep vein thrombosis) to a physician before proceeding. Never skip or rush the intake to accommodate a schedule. Document any modifications made to protect the client, and note when a referral was recommended. When in doubt about a client's condition, obtain physician clearance before proceeding.

Connecting to Your Credentials

The MBLEx includes a Laws and Regulations domain that tests exactly this content—consent, confidentiality, record keeping, and scope of practice. Your state license depends on practicing within the law, which means maintaining complete, confidential, accurate records and obtaining proper consent before every session. Building these habits as a student means they will be second nature when you are licensed.