HIPAA compliance checklist for therapists, counselors and behavioral health programs

HIPAA has three parts that matter day to day: the Privacy Rule (who may see and receive records, and clients' rights), the Security Rule (how electronic records are protected) and the Breach Notification Rule. A solo therapist who bills insurance electronically is a covered entity just like a 50-bed program; the rules scale to your size, but none of them is optional. If you treat substance use disorders, the stricter 42 CFR Part 2 rules apply on top of HIPAA.

1. Name a privacy officer and a security officer

HIPAA requires a designated privacy official (45 CFR 164.530(a)) and a security official (164.308(a)(2)). In a solo practice that's you, twice. In a program it's usually the clinical director or compliance lead for privacy and the operations lead for security. Write the names in your policy manual and in your notice of privacy practices, which must tell clients who to contact.

2. Do the security risk analysis, in writing

The risk analysis (164.308(a)(1)) is the foundation of the Security Rule, and a missing or stale one is among the findings OCR cites most often. HHS's risk analysis guidance and the free HHS Security Risk Assessment Tool walk through it. For a small behavioral health practice it comes down to:

1. List everywhere client information lives: the EHR, email, your phone (texts, photos, voicemail), laptops, the fax line or e-fax service, the clearinghouse, the telehealth platform, paper intake forms, the printer, backups, and any spreadsheet someone keeps "just for tracking".
2. For each, list what could go wrong: a stolen laptop, a phished password, a former employee who still has a login, an email to the wrong client, a vendor breach, ransomware, a flood.
3. Rate each risk by how likely it is and how bad it would be, and note what already protects against it.
4. Write the fix list with an owner and a date for each item: turn on disk encryption, require two-step sign-in, get the missing BAA, shred the old intake files.
5. Sign and date it. Redo it every year and whenever something big changes: a new EHR, a new office, telehealth, a new service line, a breach.

The two most common gaps we see: an analysis that covers only one system (just the EHR, or just the client portal) and one that was never signed or dated. It has to cover every system that holds client records, and say when it was done and by whom.

3. Get a Business Associate Agreement from every vendor that touches records

A business associate is any vendor that creates, receives, keeps or sends client information for you (164.504(e)). Before they touch a record you need a signed BAA. For a behavioral health practice that usually means:

Vendor	Needs a BAA?
EHR and client portal	Yes. It should come with the account, not by request.
Clearinghouse, billing company, credentialing service with chart access	Yes.
Email and file storage (Google Workspace, Microsoft 365)	Yes, on business plans that offer one, and configured as their BAA requires. A free personal Gmail account doesn't qualify.
Telehealth video, e-fax, texting and reminder services, AI note tools	Yes.
IT support, answering service, shredding company	Yes, if they can see or handle records.
Card processor for client payments	Usually no, when it only processes the payment. Keep diagnosis and visit details out of payment descriptions.
Consumer calendars (personal Google, Apple)	They don't sign one, so don't put client names or reasons for visits in them.

Keep a vendor list with each BAA's date and file. For substance use records, the agreement also needs Part 2's qualified service organization terms.

4. Logins and access: unique, two-step, minimum necessary

• Unique logins for everyone (164.312(a)). No shared front-desk password, ever.
• Two-step sign-in on the EHR, email and anything else with client data. Passkeys are better still: they can't be phished.
• Minimum necessary. Billing sees claims, not therapy notes; the front desk sees the schedule, not screening results. Set roles in the EHR so the system enforces it.
• Automatic logoff after a short idle time, and screens that lock when someone walks away.
• Same-day offboarding. When someone leaves, remove their EHR, email and portal access that day, and collect devices and keys.
• Audit controls (164.312(b)): a log of who opened which chart. Review it when something looks wrong, and spot-check it monthly in a program.

5. Devices, encryption and backups

• Encrypt every laptop and desktop (FileVault on a Mac, BitLocker on Windows) and require a passcode on every phone that gets work email or texts. Encryption is "addressable" under the Security Rule, which means you either do it or document why an equal alternative works. In practice, do it: records encrypted to HHS's guidance on securing health information aren't "unsecured," so a lost encrypted laptop usually isn't a reportable breach.
• Turn on remote wipe for phones and laptops, and a way to sign a lost device out of email and the EHR.
• Keep updates on for operating systems and browsers, and use a supported antivirus.
• Have a contingency plan (164.308(a)(7)): backups, how you'd keep seeing clients if the EHR or the office were down, and how you'd restore. Know where your EHR's backups are and how long they're kept.
• Paper: locked cabinet, clean desk, cross-cut shredding or a shredding vendor with a certificate.

6. Training, sanctions and written policies

• Train every workforce member on your policies (164.530(b)), including contractors and interns. In Texas, new staff must be trained within 90 days of hire, and again after a material change in law, and each person signs a statement that they completed it (Health and Safety Code 181.101). The 2024 Part 2 rule was such a change for substance use programs.
• Have a sanctions policy (164.530(e)) and apply it when someone breaks the rules. Document what you did.
• Write the policies: privacy, security, breach response, client rights, minimum necessary, device and remote work, email and texting with clients, and records retention. Keep policies, risk analyses, BAAs and training records for 6 years from when they were created or last in effect (164.316(b)(2), 164.530(j)).

Writing these from scratch takes days. Cima Consulting's practice policies and forms kit ($750) includes HIPAA privacy and security policies, a risk assessment worksheet, the notice of privacy practices and a Part 2-ready release, under your practice's name. A live staff training session is $500 per session, with an attendance record for your files. See the compliance services and prices.

7. Client rights requests: the deadlines

Every practice gets these requests. Log the date each arrives, because the clock starts then.

Request	Deadline	Rule
Copy of their records	HIPAA: 30 days, one 30-day extension. Texas: 15 business days for a written request when you keep records electronically.	45 CFR 164.524; HSC 181.102
Change to their record (amendment)	60 days, one 30-day extension. A denial is in writing, and the client's statement of disagreement stays with the record.	45 CFR 164.526
Accounting of disclosures	60 days, one 30-day extension; covers non-routine disclosures in the past 6 years.	45 CFR 164.528
Restriction	You may decline most, but must agree not to tell a health plan about a service the client paid for in full when they ask.	45 CFR 164.522
Confidential communications	Honor reasonable requests, such as a different phone number or no mail to home.	45 CFR 164.522(b)

HHS's right of access guidance covers fees (a reasonable, cost-based fee) and format. Psychotherapy notes kept separately from the record aren't part of the right of access under HIPAA. For mental health records, Texas lets a professional deny access to the part that would harm the client, with a written reason (HSC 611.0045). Give your notice of privacy practices at the first visit, ask the client to acknowledge it, post it in the office and put it on your website (164.520).

8. Incident and breach response

1. Contain it: sign the lost device out, reset the password, recall the email, call the vendor.
2. Write down what happened: when, what records, how many people, who found it. Your EHR's access log helps scope it.
3. Assess the risk using HIPAA's four factors: what information, who got it, whether it was actually viewed, and how far the risk was reduced. If you can't show a low probability of compromise, it's a breach.
4. Notify clients without unreasonable delay and no later than 60 days after discovery.
5. Notify HHS: within 60 days if 500 or more people are affected (and the media, if more than 500 in one state); for fewer, in HHS's log within 60 days after the end of the calendar year.
6. Notify the Texas Attorney General within 30 days when 250 or more Texans are affected (Business and Commerce Code 521.053).
7. Fix the cause and keep the file for 6 years, including incidents you decided weren't breaches and why.

Your vendors must tell you about their breaches too. Read each BAA for how fast; HIPAA's outer limit is 60 days.

What Texas adds

• A broader definition of "covered entity." Texas's medical privacy law (Health and Safety Code chapter 181) reaches anyone who handles health information, not only HIPAA covered entities.
• Training within 90 days of hire, with a signed statement (HSC 181.101).
• 15 business days for a copy of electronic records (HSC 181.102).
• Notice of electronic disclosure: tell clients their information may be disclosed electronically, for example with a notice in the office or on your website, and get authorization for electronic disclosures outside treatment, payment and operations (HSC 181.154).
• US-only storage of electronic health records since January 1, 2026, including by vendors and cloud services, under the 2025 law that added Health and Safety Code chapter 183 (SB 1188). Ask every EHR and storage vendor where the data lives.
• Records retention rules by license type: see our Texas records retention guide.

The checklist

What Cima does, and what stays with you

We run a licensed Texas outpatient program, and we built Cima EHR to carry the record-keeping parts of this list for ourselves. Here is how its security and HIPAA safeguards map to the checklist:

Checklist item	In Cima
BAA	Every practice accepts the Business Associate Agreement at sign-up, with Part 2 QSO terms. We report a breach of unsecured records to you within 5 business days of discovery.
Unique logins and two-step sign-in	Passkeys, or a password plus a 6-digit authenticator code; the owner can allow Google or Microsoft sign-in. Five wrong tries lock the account for 15 minutes; sessions end after 30 idle minutes.
Minimum necessary	Roles enforced by the server: billing never sees note text or screening results, the front desk sees no notes, clinicians see their own caseload.
Audit controls	Every chart view, print, export, release and signature is logged with who, when and why, in a log that can only be added to.
Encryption, backups, US storage	HTTPS for every connection; encrypted disk and nightly encrypted backups kept 6 years; hosted in the US on HIPAA-eligible AWS services.
Client requests	Records requests run on the Texas 15-business-day clock; amendments on 60 days with one extension; a denied change keeps the client's statement with the record; the accounting of disclosures prints in two taps.
Training records	Each staff member's privacy training, due 90 days after hire, with their signed statement. Training records can't be edited or deleted.
Texting and email	Reminders go only to clients who agreed and never say what a visit is for; paperwork emails carry a link that expires in 7 days and asks for the client's date of birth, never health information.

What stays with you: the risk analysis, your policies, staff training itself, the devices people sign in on, and your other vendors' BAAs. No software makes a practice "HIPAA compliant" on its own, and no government agency certifies software for HIPAA.

Questions

Does a solo therapist really need a HIPAA risk analysis?

Yes. Any covered entity, including a solo practice that bills insurance electronically, must do a written risk analysis and act on it. For one person it can be a few pages: where client information lives, what could go wrong, and what you're doing about each risk, signed and dated, redone each year.

Is there such a thing as HIPAA certification?

No. HHS doesn't certify software, practices or training as HIPAA compliant. A vendor that claims "HIPAA certified" is describing its own review. What matters is a signed BAA and the safeguards it actually has.

Can I email or text my clients?

Yes, with care. HIPAA allows it with reasonable safeguards, and a client may ask for unencrypted email or texts after you warn them of the risk; document their choice. Keep the content to scheduling where you can, and use a service that signs a BAA.

Do I need a BAA with my EHR, email and telehealth platform?

Yes, with each vendor that creates, receives, keeps or sends client information for you. Consumer accounts (free email, personal calendars) usually don't offer a BAA, so they shouldn't hold client information.

How fast must I give a client a copy of their records in Texas?

Within 15 business days of a written request when you keep the records electronically (Health and Safety Code 181.102), which is faster than HIPAA's 30 days. Texas allows no extension of that deadline.

How long do I keep HIPAA paperwork?

Six years from when it was created or last in effect: policies, risk analyses, BAAs, training records and breach files. Clinical records follow your licensing board's or facility rules, which are often longer; see our Texas records retention guide.

What happens if I lose a laptop with client records on it?

If the disk was encrypted to HHS's standard, the records usually aren't "unsecured," and it usually isn't a reportable breach; document the incident and your assessment. If it wasn't encrypted, run the four-factor assessment; you'll likely have to notify the clients affected, HHS and possibly the Texas Attorney General.

Sources

• eCFR, 45 CFR Part 164 (Security Rule, Breach Notification Rule and Privacy Rule)
• HHS, Guidance on risk analysis; Security Risk Assessment Tool
• HHS, Breach Notification Rule and guidance on unsecured protected health information
• HHS, Individuals' right of access
• Texas Health and Safety Code 181.101, 181.102, 181.154, 611.0045
• Texas Business and Commerce Code 521.053; SB 1188 (2025), Health and Safety Code chapter 183