The therapy practice EHR checklist

Before you look: four facts about your practice

• How you're paid: private pay, out-of-network with superbills, in-network claims, or a mix. Private-pay practices can skip most of the claims section; in-network practices should weight it heavily.
• Who's on the team: just you, you and associates under supervision, or a group with a biller and front desk. Seat pricing and roles follow from this.
• How you see clients: in person, video, or both. Video changes the telehealth section's weight; Cima for therapists uses your own video link rather than built-in video.
• What you treat: if you treat substance use and are federally assisted, 42 CFR Part 2 applies to those records on top of HIPAA. LCDCs and counselors who treat substance use should read Cima for addiction counselors.

Just opening? Our guide to starting a private practice in Texas covers the entity, NPI, insurance panels and paperwork you'll set up in the EHR.

Scheduling and booking

• Day and week views for you, and for the whole practice if you have a team.
• Visit types that carry their length, place of service and billing code.
• Repeating appointments.
• An online booking page that shows only your open hours, with you approving each request.
• New-client requests that send intake paperwork automatically once accepted.
• Sync with Google, Outlook or Apple Calendar, both ways, without client names on your personal calendar.
• No-show and late-cancel tracking, with your fee charged under the policy the client signed.

Cima: all of the above. Visit types carry their length and code, booking requests hold the time until you accept, and accepting confirms by text and email, sends a new client their paperwork and checks their insurance. Your calendar shows visits without client names, and your personal busy times stay off the booking page. There's no waitlist feature.

Reminders

• Text and email reminders at times you choose.
• Clients confirm by replying, and the confirmation shows on your schedule.
• Reminder texts that never say what the visit is for. A text on a shared phone shouldn't reveal therapy.
• Quiet hours, so texts don't go out at 11 PM.
• Texts included in the price, or a clear per-text price.

Cima: text and email reminders 3 days, 2 days, 1 day, 4 hours or 2 hours ahead, as you choose; clients reply C to confirm; quiet hours for texting; texts never name the service. Texting at normal volume is included in every plan.

Notes, plans and screenings

• Templates for the notes you write: intake (90791), progress notes, family sessions, crisis, treatment plans and discharge summaries.
• The CPT code picked from session minutes (90832, 90834, 90837), so time and code always agree.
• Treatment plans with measurable objectives and review dates, and progress notes that ask about the plan's goals.
• A check for missing pieces before you sign: risk, interventions, progress, plan.
• Signed notes locked, with corrections as dated addenda. Late notes marked late, never backdated.
• Supervisor co-sign for associates (LPC-Associates, LMFT-Associates, interns).
• PHQ-9 and GAD-7 scored in the chart, with an alert when a client endorses self-harm.
• If AI drafts notes: it runs under a BAA, it's off until you turn it on, and it drafts only from what you wrote.
• The codes you need beyond therapy, such as psychological testing, if you do it.

Cima: progress (SOAP), intake, treatment plan and discharge templates; minutes pick 90832, 90834 or 90837, with 90846, 90847, 90839, 90840 and 90791 ready. A moderate or high risk rating needs a safety plan before signing; notes signed more than 72 hours after the visit are marked late entries. AI drafting is in every plan and runs on AWS's HIPAA-eligible AI service under a BAA. Psychological testing codes (96130 to 96139) and the Columbia (C-SSRS) screen aren't built in yet. See Cima for therapists for the note workflow.

Client paperwork and portal

• Intake forms sent by text or email, filled in on the client's phone.
• No app to download and no password for the client to forget, but a real identity check on the link.
• Consent to treatment, notice of privacy practices, telehealth consent and financial policy, ready to edit for your state.
• Signatures that become a locked PDF in the chart.
• Clients update their own address and insurance, and you approve the change.
• Screenings (PHQ-9, GAD-7) sent with the paperwork.
• Secure messaging, or at least a record of every text and email sent from the chart.
• A good faith estimate for self-pay and uninsured clients, which the No Surprises Act requires before services.

Cima: clients get a link by text or email that lasts 7 days; they confirm their date of birth, and the link locks after 5 wrong tries. They correct their details and insurance, sign each consent with a finger, and answer the PHQ-9 and GAD-7. Signed forms become a locked PDF in the chart. Clients don't have a login or a portal account, and Cima doesn't produce good faith estimates yet, so keep a GFE template of your own.

Superbills, claims and payments

• Signing the note creates the charge: code, modifiers, place of service, diagnoses and your fee.
• Superbills for out-of-network clients, with your NPI, tax ID, codes and diagnoses.
• Statements for self-pay clients that leave out diagnoses.
• Electronic claims (837P), checked before they go for the errors that cause rejections: NPIs, taxonomy, member IDs, diagnosis format, filing limits.
• ERAs that post payments and adjustments for you.
• Eligibility checks before visits, with the deductible and out-of-pocket left.
• Claim status, denial reasons in plain English, and money owed by payer and age.
• A free login, or a clean export, for an outside biller.
• Card payments: who processes them, at what rate, and whether you can store a card on file.
• Medicare claims for LPCs and LMFTs, who can bill Medicare since January 1, 2024 (CMS).

Cima: the signed note creates the charge; superbills and statements print from the chart; claims are checked and sent as 837P; ERAs post from payers you've enrolled with; insurance is checked automatically the evening before each insured visit. Claims cost 30¢ and ERAs 20¢ at the clearinghouse's standard rate. Cima records card, cash and check payments but doesn't run cards itself, so you use your own card processor. Getting in network first? See Cima Consulting's credentialing service.

Telehealth

• Built-in video, or a field for your own HIPAA-ready video link, sent in the reminder.
• Telehealth visits billed with modifier 95 and the right place of service (10 at home, 02 elsewhere), per each payer's rules.
• A telehealth consent in the intake paperwork.

Cima: video isn't built in. You add your own video link (from a video service that signs a BAA) to the visit, it goes in the reminder, and Cima bills with modifier 95 and place of service 10 or 02. If you want video inside the EHR, weigh that heavily on the sheet.

If you're a group practice

• Each clinician sees their own caseload; the owner sees everything.
• Roles for billing (claims, never the text of a note) and front desk (schedule and payments).
• Associates' notes routed to their supervisor to co-sign.
• Reports by clinician: visits, notes owed, billed and collected.
• Non-clinical logins that are free, or priced clearly.

Cima: owner, clinician, billing and front-desk roles; notes by an LPC-A, LMFT-A, LCDC-I or intern wait for a licensed supervisor's co-sign; each added clinician is $39 a month and billing and front-desk logins are free. More on Cima for group practices.

Data export and the BAA

• A business associate agreement signed at sign-up, as HIPAA requires of vendors that hold your records (45 CFR 164.308(b)).
• Multi-factor sign-in for every user, and automatic sign-out when idle.
• A log of every view, print and export of a chart.
• A full export of your practice, any time, free, in a format another system can read.
• One client's whole chart as a PDF, for records requests.
• Records readable after you cancel, for a stated number of days.
• A client list import from your current EHR, with a preview.

Cima: a BAA at sign-up; sign-in with a passkey or a password plus a 6-digit code, signed out after 30 idle minutes; every chart view logged in a log that can't be edited. Export the whole practice in one file or one chart as a PDF, free, any time, and for at least 90 days after you cancel. Client lists import from a CSV; past notes stay in your old system's export. Read how Cima protects records and how switching works. The HIPAA Security Rule still expects your own risk analysis, whatever EHR you choose.

Price and contract

• The monthly total for your practice, with every line: plan, seats, claims, ERAs, eligibility checks, add-ons, card processing.
• No percentage of your collections.
• Month to month, or a term you're comfortable with; no automatic multi-year renewal.
• Days of notice before a price increase.
• A free trial long enough to run real visits through it.
• Support you can reach, by the channel you prefer, with stated hours.

Cima: Solo is $59 a month; a solo therapist sending 80 claims a month pays $99.00 in all. Month to month, 30 days free with no card, 30 days' notice of any price change, never a percentage. Our guide to how EHR pricing works compares published prices and has a total-cost worksheet; Cima's full price list is on the pricing page.

Questions to ask every vendor

• What does my practice pay a month, every line included, at my number of clinicians and claims?
• Which features in the demo are add-ons? What does each cost?
• Do clients need an account or an app to fill in paperwork or book?
• What do reminder texts say? Can I set quiet hours?
• Can a signed note be changed? How are late notes marked?
• If I use AI note help, where does it run, is it under your BAA, and what does it keep?
• Which clearinghouse do you use, and what does each claim, ERA and eligibility check cost?
• Who processes client card payments, and at what rate?
• Is video built in? Is it covered by the BAA?
• What can I export, in what format, at what cost, and for how long after I cancel?
• What's the contract term, does it renew on its own, and how much notice do you give before a price increase?
• What's on your roadmap that I'd be counting on, and is it dated?

Score the finalists

Set each weight for your practice (0 if you don't need it), then score each vendor 0 to 3 from what you saw yourself on a trial or live demo. Nothing is sent anywhere or saved.

Running an IOP or PHP, not a therapy practice? Use the IOP and PHP EHR checklist instead: groups, per diem billing and utilization review change the criteria.

Questions

What should I look for in an EHR for a private therapy practice?

Six things: booking and reminders clients actually use, paperwork they can finish on their phone, notes that are quick and lock when signed, billing that matches how you're paid (superbills, claims or both), a full data export, and a signed BAA. Then compare the total monthly cost, every line included.

Do I need an EHR if I'm private pay only?

You still need secure records, signed consents, notes and receipts, and HIPAA still applies to your records. A private-pay practice can weight claims features at zero and focus on scheduling, paperwork, notes, statements and superbills.

Is a client portal necessary?

What matters is that clients can fill in forms, sign consents, book and confirm on their phone. Some EHRs do that through a portal account; others, like Cima, through a secure link with an identity check, so there's no password to forget.

Can I switch EHRs later?

Yes, if you can get your data out. Ask before you sign what the export includes and costs. Client lists usually move by CSV; past notes usually stay in the old system's export, which you must keep for as long as your state and licensing board require.

What is a superbill?

A receipt with your NPI, tax ID, CPT codes, diagnosis codes and fees that an out-of-network client sends to their insurance plan to ask for reimbursement. Your EHR should print one from the chart.

Does the EHR need to sign a BAA?

Yes. Any vendor that stores or handles your clients' health information on your behalf is a business associate under HIPAA and must sign a business associate agreement. Don't put client records in a system that won't sign one.

Sources

1. eCFR, 45 CFR 164.308 (business associate contracts); HHS, HIPAA Security Rule.
2. CMS, No Surprises Act (good faith estimates for uninsured and self-pay clients).
3. CMS, Marriage and family therapists and mental health counselors (Medicare billing since January 1, 2024).
4. eCFR, 42 CFR Part 2, Confidentiality of Substance Use Disorder Patient Records.
5. Cima EHR's own behavior: the app's scheduling, reminder, paperwork, note, billing and export features (alturaops server/solo), checked October 24, 2026.

General information, not legal or billing advice. Payer rules for telehealth modifiers and places of service vary; confirm with each plan.