HIPAA Compliance Checklist for Behavioral Health Practices

One incorrect permission can expose years of therapy notes. One rushed email can send a diagnosis to the wrong family member. An unreviewed vendor can also put sensitive patient data at risk.

A generic HIPAA checklist is not enough for behavioral health practices. Practices must address psychotherapy notes, minor consent, family communication, substance use records, telehealth, and crisis disclosures.

Policies matter, but staff must know how to use them. The real test comes when a privacy decision is urgent or unclear.

This guide offers general operational guidance, not legal advice. Federal and state requirements may differ based on your services and location.

What Is HIPAA Compliance for a Behavioral Health Practice?

HIPAA compliance is the ongoing practice of protecting patient information across its entire lifecycle, from the moment it’s collected through how it’s used, shared, stored, updated, retained, and eventually destroyed.

For behavioral health specifically, compliance goes beyond a generic checklist. It means applying HIPAA’s three core rules in ways that account for psychotherapy notes, minor consent, family and group therapy dynamics, substance use records, and crisis disclosures. 

The three HIPAA rules most relevant to protecting behavioral health information address different parts of that responsibility.

HIPAA Rule	What it Covers	Behavioral Health Example
Privacy Rule	Uses, disclosures, patient rights, notices, and authorizations	Deciding whether a parent may receive an adolescent’s treatment record
Security Rule	Administrative, physical, and technical protection of electronic PHI (ePHI)	Limiting access to clinical notes and protecting remote devices
Breach Notification Rule	Assessment and notification following certain impermissible uses or disclosures of unsecured PHI	Investigating a treatment plan sent to the wrong recipient

The Privacy Rule establishes national standards for the protection of health information maintained by covered entities and, where applicable, their business associates. The Security Rule requires appropriate administrative, physical, and technical safeguards for electronic protected health information.

Mental health information generally receives the same HIPAA protection as other health information. Psychotherapy notes receive added protection. To qualify, they must meet the HIPAA definition and remain separate from the medical record.

Does HIPAA Apply to Every Therapist or Mental Health Provider?

HIPAA applies when a provider qualifies as a covered entity. This often happens when the provider sends electronic claims, eligibility requests, claim status requests, or payment transactions. Outsourcing those transactions to a billing service does not relieve the provider of their obligations.

Use this scope check:

• Determine whether the practice conducts covered electronic transactions.
• Identify which clinicians operate under the practice and which operate independently.
• List every vendor that handles PHI. Then decide whether each vendor qualifies as a business associate.
• Check whether the practice is a Part 2 program. Also check whether it receives, stores, uses, or rediscloses Part 2 records.
• Review privacy, consent, breach, and retention laws in each state where patients receive care.
• Repeat the assessment after ownership, billing, technology, location, or service changes.

Cash payment alone does not decide whether HIPAA applies. A cash-pay provider may still be a covered entity because of other electronic transactions.

HIPAA Compliance Checklist for Behavioral Health Practices

A useful checklist does more than mark a requirement as complete. It shows who owns the control, what evidence proves it is working, when it was reviewed, and what must happen when a gap is found.

Control	Owner	Evidence	Review trigger
Risk analysis	Security official	Risk register and remediation records	Material operational or technology change and scheduled reassessment
Access controls	EHR administrator	Permission and termination reports	Hiring, role change, separation
Vendor review	Privacy or security official	Vendor inventory, risk review, contract, and BAA were required	New vendor or contract change
Training	Privacy official	Attendance and training records	Onboarding, role change, policy change, and identified training gap
Breach response	Incident response lead	Assessment and notification file	Every suspected incident

1. Assign Privacy and Security Responsibility

Designate a privacy official and a security official. A small practice may assign both functions to one person, but the responsibilities should be written and understood.

The designated role should oversee:

• Privacy and security policies
• Security risk analysis
• Patient rights requests
• Staff access
• Workforce training
• Vendor agreements
• Privacy complaints
• Security incidents
• Breach assessments
• Corrective actions

As an operational safeguard, name a backup who can act when the primary official is unavailable.

2. Map Every Location Where PHI Exists

Protected health information rarely stays inside one clinical system. It may also appear in appointment scheduling software, intake forms, billing applications, email, telehealth tools, mobile devices, scanned documents, cloud storage, staff downloads, and backups.

For each location, document:

• Patient information contained in the system
• Users and vendors with access
• Business reason for each type of access
• Vendor and subcontractor involvement
• BAA status
• Security safeguards
• Retention period
• Return and destruction procedure

The electronic security risk analysis focuses on ePHI, but the broader privacy inventory should also include paper records, printed schedules, handwritten notes, and physical archives.

3. Conduct an Accurate Security Risk Analysis

A HIPAA security risk analysis shows where ePHI exists and what could expose it. It also reviews current safeguards and identifies the risks the practice still needs to address.

HHS describes risk analysis and security risk management as required elements of the Security Rule. The assessment must cover all electronic PHI, not only the primary EHR.

Review risks involving:

• Weak or shared passwords
• Excessive user permissions
• Former staff accounts
• Lost or stolen devices
• Unencrypted downloads
• Phishing and malicious files
• Unsupported software
• Missing backups
• Untested recovery plans
• Home networks used for remote care
• Telehealth access links
• Vendor and subcontractor access
• Unapproved applications

The risk register should record the affected system, threat, vulnerability, existing safeguard, likelihood, potential impact, assigned owner, due date, corrective action, and evidence of completion.

HIPAA does not set a universal annual risk analysis deadline. The assessment must remain accurate and should be updated when technology, vendors, services, locations, threats, or operations materially change.

4. Apply Administrative, Physical, and Technical Safeguards

Safeguard Area	Practical Controls	Evidence to Retain
Administrative	Policies, access approval, training, sanctions, incident response, contingency planning	Approved policies, training records, risk register, incident files
Physical	Private work areas, screen protection, locked storage, device inventory, secure disposal	Office reviews, asset lists, disposal records
Technical	Unique accounts, authentication, access controls, audit logs, backups, secure transmission	Configuration records, access reports, log reviews, recovery tests

Common risk reduction measures include multifactor authentication, encryption, automatic screen locks, endpoint protection, tested backups, software patching, and device management. Practices should also review whether their HIPAA-compliant EHR supports role-based access, audit logs, encrypted storage, and secure data transmission.

These controls should be evaluated through the practice’s risk analysis. HHS has proposed stronger cybersecurity requirements, including wider use of encryption and multifactor authentication. The current Security Rule still applies until HHS issues a final rule.

5. Restrict Access According to Job Function

Access should be based on the person’s responsibilities, not convenience or seniority. Front desk staff may need scheduling and demographic information without needing unrestricted access to therapy narratives.

The access process should include:

• Written approval before account creation
• Unique user credentials
• Role-based permissions
• Prompt updates after job changes
• Immediate deactivation after separation
• Periodic access reviews
• Review of privileged accounts
• Audit log monitoring
• Documented exceptions

Shared accounts weaken accountability because the practice cannot reliably determine who opened, changed, printed, or exported a record.

HIPAA requires practices to authorize and control electronic access and to limit internal PHI use according to workforce roles and responsibilities.

6. Separate Progress Notes From Psychotherapy Notes

Psychotherapy notes contain a clinician’s private analysis of a counseling session. To receive added HIPAA protection, the clinician must store them separately from the medical record. Ordinary therapy progress notes do not become psychotherapy notes simply because a clinician labels them private or uses the term process note.

Record Type	Typical Contents	HIPAA Treatment
Progress Note	Symptoms, interventions, diagnosis, risk, treatment goals, response, and progress	Part of the clinical record
Psychotherapy Note	Separate clinician analysis of a counseling conversation	Receives additional protection
Medication Record	Prescriptions, monitoring, adherence, response, and adverse effects	Not a psychotherapy note
Treatment Plan	Goals, frequency, methods, and planned services	Not a psychotherapy note
Assessment Result	Screening, testing, or diagnostic findings used for care	Not a psychotherapy note

Psychotherapy notes do not include medication information, session times, treatment frequency, test results, diagnoses, functional status, treatment plans, symptoms, prognosis, or progress summaries.

Most uses and disclosures require a specific authorization. 

Limited exceptions may allow the notes to be used for:

• Treatment by the clinician who wrote them
• Certain supervised training activities
• Defense in a case brought by the patient
• HHS investigations or lawful oversight
• Disclosures required by law
• Coroner or medical examiner duties
• A serious and immediate safety threat

Although HIPAA does not create a right of access to psychotherapy notes, a provider may have discretion to disclose them directly to the patient when state law and professional obligations permit.

7. Determine Whether 42 CFR Part 2 Applies

Part 2 may apply to federally assisted programs that diagnose or treat substance use disorders. It may also cover programs that refer patients for SUD treatment. Practices may also acquire responsibilities when they receive, maintain, use, or disclose records protected by Part 2.

The current rule allows a patient to provide one consent for future treatment, payment, and healthcare operations uses and disclosures. HIPAA-covered entities and business associates that receive the records under that consent may generally redisclose them according to HIPAA, subject to 42 CFR Part 2 restrictions.

Review whether the practice:

• Operates as a Part 2 program
• Receives records from a Part 2 program
• Maintains protected SUD records
• Creates separate SUD counseling notes
• Rediscloses SUD information
• Uses records in legal or investigative proceedings
• Has updated its privacy notice and consent workflow

SUD counseling notes maintained separately require specific consent and cannot be disclosed using a broad treatment, payment, and healthcare operations consent.

Compliance with the updated 42 CFR Part 2 requirements became mandatory on February 16, 2026. Practices subject to Part 2 should confirm that consent forms, breach workflows, patient notices, and legal request procedures reflect the current rule.

8. Maintain Patient Notices and Rights Workflows

A behavioral health practice should maintain written procedures for:

• Delivering the Notice of Privacy Practices
• Obtaining or documenting acknowledgment
• Patient access requests
• Amendment requests
• Confidential communication requests
• Restriction requests
• Authorization and revocation
• Personal representative verification
• Accounting of disclosures
• Privacy complaints
• Denials and appeals

A covered entity generally must act on a patient access request within 30 calendar days. One additional 30-day period may be available if the patient receives a written explanation during the initial period.

Do not use a general consent to treatment as a substitute for a HIPAA authorization. Release forms should clearly identify the information, recipient, purpose, expiration, and signature requirements.

9. Create Rules for Minors and Personal Representatives

A parent is often the personal representative of an unemancipated minor. However, the answer may change when the minor consents to care, another person authorizes treatment, or state law limits parental access.

Before releasing a minor’s information, verify:

• Who consented to treatment
• Whether the minor had legal authority to consent
• Custody or guardianship documentation
• The requested record type
• Whether psychotherapy notes are involved
• Whether Part 2 information is involved
• State confidentiality requirements
• Possible abuse, neglect, or endangerment concerns

Personal representative authority generally depends on state or other applicable law. Record the documents reviewed, the decision made, the legal or policy basis, and any limits placed on the disclosure.

A practice should not assume that every parent, spouse, partner, or caregiver automatically has access rights.

10. Handle Group, Couples, and Family Therapy Carefully

Group members are not ordinarily regulated by HIPAA merely because they participate in treatment. A confidentiality agreement can establish expectations, but a clinician cannot guarantee that another participant will keep information private.

Group and family consent materials should explain:

• Who is the identified patient?
• How will records be maintained?
• Will individual communications be accepted?
• Who can authorize disclosure?
• How will access requests be handled?
• What are the limits of participant confidentiality?
• Which mandatory reporting and safety exceptions apply?
• What happens when participants disagree?

Define the record rules before group, couples, or family treatment begins. State who the client is, how records will be stored, and whether private messages will be accepted. Explain who can approve a release and how the practice will handle access disputes.

11. Secure Telehealth, Email, Messaging, and Remote Work

When evaluating EHR telehealth software, practices should review vendor agreements, access controls, recording settings, and data handling procedures. The practice must evaluate the vendor, enter into a business associate agreement when required, configure the service correctly, and train staff on approved use.

Covered providers must deliver telehealth in accordance with HIPAA and use appropriate agreements when a technology vendor functions as a business associate.

A risk-based telehealth workflow should address:

• Patient identity verification
• Provider identity verification
• Private locations where feasible
• Controlled session links
• Waiting room or admission controls
• Recording restrictions
• Protected screen sharing
• Secure devices and networks
• Emergency location procedures
• Documented patient communication preferences

Email communication with patients is permitted when reasonable safeguards are used. Verify addresses, limit sensitive content, and document the process for handling patient requests for less secure communication methods.

A secure behavioral health patient portal can give patients controlled access to forms, appointments, and practice communications without relying on separate consumer messaging tools.

12. Review Business Associates and Other Vendors

A vendor generally needs a BAA when it handles PHI on behalf of the practice. This may include creating, receiving, storing, or sending patient information. This may include creating, receiving, storing, or sending patient information. Not every outside organization is automatically a business associate, so document the reason for each decision.

Before onboarding a vendor, ask:

• What PHI will the vendor handle?
• Why does it need access?
• Where will the data be stored?
• Will subcontractors receive access?
• How will users authenticate?
• How quickly will incidents be reported?
• Are audit records available?
• How will data be returned or destroyed?
• What happens when the agreement ends?

Reassess vendors when services, ownership, integrations, subcontractors, or data flows change.

13. Train Staff With Behavioral Health Scenarios

Training should address the situations staff actually face:

• A parent requesting an adolescent’s records
• A spouse asking whether the patient attended therapy
• A clinician creating separate psychotherapy notes
• A patient sending sensitive information by email
• A telehealth visit from a shared location
• A subpoena requesting the entire chart
• A former employee account remaining active
• A treatment plan sent to the wrong person
• A Part 2 record received from another organization
• A credible threat of harm

Retain evidence such as the training date, participants, subjects covered, knowledge checks, corrective coaching, and follow-up actions.

HIPAA requires appropriate workforce sanctions when staff fail to follow privacy and security policies.

14. Retain Required HIPAA Documentation

Keep required HIPAA documents for at least six years. Count from the date each document was created or last in effect, whichever is later. Confirm the applicable retention basis for each document category.

Retain:

• Risk analyses
• Risk management plans
• Policies and procedures
• Training records
• Personnel designations
• Access approvals
• Security evaluations
• Incident assessments
• Breach decisions
• Complaints
• Corrective actions
• Business associate agreements

HIPAA does not establish one general retention period for medical records. State law, licensing rules, payer requirements, and other obligations usually determine how long clinical records must be retained.

What Should a Practice Do After a Suspected HIPAA Breach?

Act immediately after a suspected breach. Stop the exposure, report it internally, preserve the evidence, assess the event, and document the decision. Staff should follow the approved response plan rather than deleting evidence, contacting affected individuals independently, or deciding informally that an event requires no review.

Follow this response sequence:

• Stop the ongoing access or disclosure.
• Notify the privacy or security official.
• Preserve logs, messages, files, and devices.
• Identify the information involved.
• Determine who received or accessed it.
• Confirm whether the information was viewed or acquired.
• Retrieve information or disable access where possible.
• Complete the breach risk assessment.
• Evaluate federal and state notification duties.
• Correct the underlying weakness.
• Document the final decision and evidence.

HIPAA generally presumes that an improper acquisition, access, use, or disclosure of PHI is a breach. The practice must document why an exception applies or why the chance of compromise was low.

When notice is required, HIPAA requires individual notification without unreasonable delay and no later than 60 calendar days after discovery. State laws may impose separate or shorter obligations.

HIPAA Compliance Review Schedule

HIPAA does not prescribe each cadence below. The schedule is a practical management model that should be adjusted according to the practice’s risks, size, systems, incidents, and state requirements.

Review activity	Recommended trigger
Open risks and corrective actions	Monthly until resolved
User permissions	Quarterly and immediately after role changes or separation
Privileged access	Monthly or quarterly based on risk
Vendor inventory and BAAs	Quarterly and before onboarding or renewal
Backup restoration	According to the contingency plan, with documented results
Policies	Annually as a management practice and after material changes
Workforce training	At onboarding and after relevant policy or workflow changes
Risk analysis	Ongoing, after material changes, and on a documented recurring schedule

Bring Privacy, Access, and Workflows Into One System

HIPAA compliance becomes harder when scheduling, telehealth, clinical notes, patient communication, and billing sit in separate systems. Each additional tool creates more user permissions, vendor relationships, data transfers, and audit records for your practice to manage.

Vozo EHR brings core behavioral health workflows into one connected platform, helping practices reduce manual handoffs and maintain clearer control over sensitive patient information. 

Start your free trial and see how a more connected workflow can support your daily privacy and security processes.

Frequently Asked Questions

1. What are the steps for HIPAA compliance in behavioral health?

Start by confirming whether the practice is a covered entity and identifying every location where PHI is stored or shared. Then complete a security risk analysis, assign privacy and security responsibility, limit staff access, review vendors, sign BAAs where required, train the workforce, document patient rights procedures, and create an incident and breach response plan.

2. How can behavioral health practices maintain HIPAA compliance?

Practices can maintain compliance by reviewing access permissions, training staff, tracking unresolved risks, testing backups, monitoring vendors, and updating policies when services or systems change. Compliance should be supported by written evidence, including risk reviews, access reports, training records, vendor agreements, incident files, and corrective actions. A yearly checklist alone is not enough to manage changing risks.

3. What are the key components of HIPAA for behavioral health?

The key components are the Privacy Rule, Security Rule, and Breach Notification Rule. The Privacy Rule governs how PHI is used and shared. The Security Rule protects electronic PHI through administrative, physical, and technical safeguards. The Breach Notification Rule explains how practices must assess and report certain incidents involving unsecured patient information.

4. How does HIPAA differ from other healthcare regulations?

HIPAA sets federal standards for health information privacy, electronic security, and breach notification. Other laws may address different risks or impose stricter protections. For example, 42 CFR Part 2 covers certain substance use disorder records, while state laws may govern minor consent, mental health confidentiality, record retention, and breach deadlines. Practices may need to follow several rules at the same time.

5. Which behavioral health records receive additional privacy protection?

Qualifying psychotherapy notes receive additional HIPAA protection when they contain a clinician’s private analysis of a counseling session and are stored separately from the medical record. Certain substance use disorder records may also receive added protection under 42 CFR Part 2. Ordinary progress notes, treatment plans, medication records, diagnoses, and assessment results do not automatically receive psychotherapy note status.