HIPAA compliance for mental health practices requires the same Privacy Rule, Security Rule, and Breach Notification Rule foundations as other covered entities, plus careful handling of psychotherapy notes, telehealth, and patient communications. The practical priority is to document your risk analysis, control access to electronic protected health information, obtain required business associate agreements, and keep psychotherapy notes separate when they meet HIPAA's definition.
Mental health information can reveal treatment status, diagnosis, medication, and appointment details. A small practice should treat its EHR, telehealth platform, email, text messaging, home-office devices, and vendors as part of one documented security program.
Quick Answer
Mental health practices must apply HIPAA safeguards to all protected health information, including records, appointment information, telehealth activity, and communications that reveal treatment. Psychotherapy notes receive special protection when they are created by a mental health professional, document or analyze counseling conversations, and are kept separate from the medical record. HIPAA does not prescribe one product or one annual checklist, but it does require documented, reasonable safeguards based on the practice's risks.
Healthcare breach cost context
What counts as mental health PHI
Mental health protected health information, or PHI, includes more than therapy notes. Diagnosis codes, treatment plans, medication records, billing records, referrals, appointment schedules, and a patient's relationship with a mental health provider can be PHI when linked to an identifiable person.
The HIPAA Privacy Rule generally requires reasonable limits on uses, disclosures, and requests for PHI under the minimum necessary standard. That standard has important exceptions, including disclosures for treatment, so practices should map each workflow instead of assuming every disclosure follows the same rule. HHS explains the standard in its Minimum Necessary Requirement guidance.
Psychotherapy notes need separate handling
HIPAA defines psychotherapy notes as notes recorded by a mental health professional documenting or analyzing counseling conversations, when kept separate from the rest of the medical record. Medication prescriptions and monitoring, session times, treatment modalities, diagnosis, treatment plans, symptoms, prognosis, and progress summaries are specifically excluded from that definition.
Under 45 CFR 164.508, most uses and disclosures of psychotherapy notes require an authorization, with limited exceptions. Configure the EHR so qualifying notes are actually separate, restrict access to people with a legitimate role, and make sure staff know that a standard release does not automatically cover psychotherapy notes.
Telehealth compliance starts with the platform and its settings
For mental health telehealth, select a platform and workflow that can support your HIPAA obligations. Confirm whether the vendor will sign a business associate agreement, or BAA, before it creates, receives, maintains, or transmits PHI on your behalf. A BAA alone is not a security configuration, so review account access, meeting links, waiting-room settings, recordings, chat retention, and administrator access.
HHS announced that its COVID-19 telehealth enforcement discretion ended when the public health emergency expired on May 11, 2023. Practices that adopted consumer communication tools during that period should reassess them under normal HIPAA requirements. See HHS's telehealth enforcement discretion notice and our guide to HIPAA-compliant video conferencing for telehealth providers.
Complete a risk analysis that reflects clinical work
The HIPAA Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to electronic PHI. For a therapy practice, include EHR permissions, psychotherapy-note storage, provider laptops and phones, remote access, email and text workflows, telehealth, cloud backups, billing integrations, and vendors.
Document the risks you identify, the safeguards already in place, assigned remediation actions, and when you review the work. The free HHS Security Risk Assessment Tool can help small practices structure this process, but it does not replace judgment about the systems and workflows in your practice.
Mental health practice security checklist
- Inventory every system, device, vendor, and communication channel that creates, receives, maintains, or transmits PHI.
- Confirm qualifying psychotherapy notes are stored separately and access is limited to the treating clinician or another permitted user.
- Keep signed BAAs for EHR, telehealth, billing, cloud backup, scheduling, and IT vendors that handle PHI.
- Require multi-factor authentication for EHR, email, telehealth, remote access, and administrator accounts where available.
- Train workforce members on privacy, security, reporting concerns, and the practice's communication procedures, then retain the records.
- Maintain written policies, risk-analysis records, BAAs, training documentation, and required HIPAA documentation for six years.
Common gaps that can create a documentation or security problem
A frequent gap is assuming that all clinical notes receive psychotherapy-note protections. Another is treating a patient preference for standard email or text as a substitute for a documented communication policy and a secure option. Review what the practice permits, what staff actually use, and what is recorded in patient-facing notices and procedures.
Unmanaged endpoints also create a practical exposure point. A lost laptop, a shared home computer, or an unpatched workstation can affect access to ePHI even when the EHR itself is well chosen. Managed endpoint detection and response can help a practice monitor and respond to device threats, but it does not by itself make a practice HIPAA compliant. Compare Bellator's managed EDR service and protection plans if you need ongoing endpoint coverage alongside your documented HIPAA program.
Assign ownership and prepare for an incident
HIPAA requires covered entities to designate a privacy official and a security official. In a small practice, one person may hold both roles, but that person needs access to vendor records, systems, and decision-makers. Legal questions about HIPAA, state mental health confidentiality laws, or a particular disclosure should go to qualified counsel.
Keep an incident response process that tells staff how to preserve information, report a suspected event, contain access, and involve the right decision-makers. The HIPAA Breach Notification Rule has specific notice obligations after an impermissible use or disclosure of unsecured PHI is determined to be a reportable breach, so assess incidents promptly and document the decision.
Schedule Your HIPAA Endpoint Review
Review the devices that access your practice's PHI and identify practical endpoint security gaps in your mental health workflow.
Mental health HIPAA questions
No. HIPAA psychotherapy notes are a narrow category of a mental health professional's separate notes documenting or analyzing counseling conversations. Progress summaries, diagnosis, treatment plans, symptoms, and session times are excluded from the definition.
A therapist or practice generally needs a BAA when the vendor creates, receives, maintains, or transmits PHI for the practice as a business associate. Review the service, contract, and actual workflow before using it with patient information.
Evaluate whether the vendor will sign a BAA when needed, supports strong account authentication, provides appropriate access controls and audit information, protects stored content, and lets the practice control recordings, meeting access, and administrator permissions.
HIPAA requires retention of required documentation for six years from the date of creation or the date when it was last in effect, whichever is later.
From requirement to defensible practice
Turn HIPAA requirements into safeguards that fit patient care
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
People also look for
Keep exploring HIPAA security
Connect HIPAA requirements to the safeguards, assessments, and everyday decisions a healthcare practice can actually implement.
- Common question: HIPAA cybersecurity requirementsUse the plain-language HIPAA guideUnderstand administrative, physical, and technical safeguards without sorting through legal language.
- Common question: HIPAA security risk assessmentPrepare for a HIPAA risk assessmentIdentify vulnerabilities, document risk, and prioritize the gaps that matter most.
- Common question: HIPAA Security Rule explainedReview the HIPAA Security RuleSee how the standards and implementation specifications fit together.
- Common question: healthcare ransomware protectionReduce healthcare ransomware riskProtect patient data and keep clinical operations recoverable after an attack.
- Common question: HIPAA endpoint securityProtect practice workstations and devicesApply managed endpoint detection to the devices that access protected health information.
