HIPAA for Mental Health Providers: Requirements, Violations, and a Compliance Checklist

Why HIPAA Compliance Is Different for Mental Health Practices

Mental health providers are among the most heavily regulated entities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This is because the information they handle is among the most sensitive protected health information (PHI). Handling therapy records, psychiatric evaluations, treatment plans, and substance use disorder documentation all require heightened attention to privacy and security.

Many therapists, psychologists, counselors, psychiatrists, and social workers enter private practice with limited compliance infrastructure. As a result, administrative oversights often lead to Office for Civil Rights (OCR) investigations, patient complaints, and licensing board actions. The risk grows as practices adopt electronic health records, telehealth platforms, cloud storage, patient portals, and digital intake systems.

Does HIPAA Apply to Your Mental Health Practice?

Yes, most mental health providers qualify as HIPAA-covered entities because they transmit protected health information electronically. Submitting insurance claims, using an EHR system, sending referrals, receiving electronic payments, and communicating with other providers electronically are all activities that typically trigger HIPAA obligations.

There is a limited exception. A solo practitioner who accepts only cash-pay clients, does not use electronic billing, and does not transmit PHI electronically may fall outside HIPAA’s scope. However, state mental health confidentiality laws continue to apply regardless of HIPAA status.

Determining whether a practice is a covered entity should be one of the first compliance questions addressed when opening a practice. It is best to confirm that determination with a healthcare attorney rather than make an assumption that could bring harsh consequences later.

The Four HIPAA Frameworks Mental Health Providers Must Understand

HIPAA is a collection of interrelated rules that create distinct compliance obligations. Mental health providers are generally subject to all of them simultaneously, so they need a comprehensive compliance program.

1. The Privacy Rule

The HIPAA Privacy Rule (45 CFR Parts 160 and 164) governs how PHI may be used and disclosed. It establishes when patient information can be shared, who may receive it, and under what circumstances disclosure is permitted.

All HIPAA mental health records are protected health information and are subject to the minimum necessary standard. Mental health providers should collect, access, use, and disclose only the information necessary to accomplish a legitimate purpose.

One of the most important distinctions for behavioral health providers involves HIPAA psychotherapy notes. Under the Privacy Rule (45 CFR section 164.508(a)(2)), psychotherapy notes receive heightened protection beyond ordinary medical records and generally cannot be disclosed without patient authorization except in limited circumstances. Additionally, another section (45 CFR Section 164.501) requires psychotherapy notes to be maintained separately from the general medical record.

HIPAA also permits disclosures when a provider believes a patient presents a serious and imminent threat to the health or safety of another person (this is under 45 CFR Section 164.512(j)). However, state duty to warn laws can create additional disclosure obligations. Mental health providers must analyze both frameworks together.

2. The Security Rule

The HIPAA Security Rule (45 CFR Part 160 and Subparts A and C of Part 164) governs the protection of electronic protected health information (ePHI). It applies to all patient information stored, transmitted, or received electronically.

For behavioral health providers, covered systems often include:

• EHR platforms
• Telehealth software
• Patient portals
• Encrypted email systems
• Cloud storage providers
• Scheduling software
• Digital intake tools

Each vendor that creates, receives, maintains, or transmits PHI on behalf of the practice generally requires a HIPAA business associate agreement before patient information is shared.

Required safeguards include:

• Unique user IDs
• Automatic logoff functionality
• Encryption of stored and transmitted ePHI
• Audit controls
• Role-based access restrictions

For example, practices should ensure that HIPAA psychotherapy notes stored within an EHR are maintained in a restricted-access section. Billing personnel, administrative staff, and clinicians not involved in treatment should not have unrestricted access to these records.

Mental health providers should also monitor the proposed HIPAA Security Rule update published in the Federal Register. For example, on January 6, 2025 (NPRM, 90 FR 1), OCR proposed a new requirement that safeguards such as multi-factor authentication (MFA), encryption, and network segmentation would be mandatory. Although OCR’s regulatory agenda identified May 2026 as the target date for a final rule, no final rule has been published as of the date of this article.

Once this rule is issued, providers will likely have a 240-day compliance window. Practices should not treat the delay as a reason to wait. They should be assessing their current security controls and preparing for these requirements now.

3. The Breach Notification Rule

The HIPAA Breach Notification Rule (45 CFR Part 165 Subpart D) requires covered entities to notify affected individuals, the U.S. Department of Health and Human Services, and, in some cases, the media following unauthorized uses or disclosures of unsecured PHI.

Many providers assume breaches only occur through cyberattacks. A single misdirected progress note, an unencrypted text message containing treatment information, or a lost device containing patient records can trigger notification obligations.

Affected individuals generally must be notified within 60 days of the discovery of a reportable breach.

Common mental health practice triggers include:

• Emailing therapy records to the wrong recipient
• Using non-compliant messaging platforms without proper safeguards
• Sending records without verifying authorization requirements
• Losing devices containing patient information
• Improperly disclosing psychotherapy notes

4. The Stricter Standard for Substance Use Disorder Treatment

Many behavioral health providers must comply with an additional federal confidentiality law under 42 CFR Part 2 (Part 2). Practices that diagnose, treat, or refer patients for substance use disorder services often fall under both HIPAA and Part 2.

Part 2 restricts disclosure of substance use disorder records more aggressively than standard HIPAA. It requires its own consent requirements for disclosures, including disclosures to other treating providers.

Another significant distinction involves Treatment, Payment, and Healthcare Operations (TPO). Under standard HIPAA rules, providers may often disclose PHI for TPO purposes without separate authorization. Under Part 2, substance use disorder records generally cannot be shared for these purposes without patient consent.

The 2024 Final Rule aligned portions of Part 2 more closely with HIPAA. However, compliance obligations remain substantial, including updated Notice of Privacy Practices requirements. Practices that have not updated their NPP to reflect expanded patient rights and substance use disorder protections risk noncompliance.

Importantly, providers frequently misunderstand when Part 2 applies. For example, a practice that primarily treats anxiety or depression may still trigger Part 2 obligations if it documents a patient’s alcohol use disorder during treatment. That documentation may create additional compliance responsibilities even when substance use treatment is not the primary focus of care.

HIPAA Compliance Checklist for Mental Health Practices

A comprehensive compliance program requires more than a privacy notice and annual training. This HIPAA compliance checklist for mental health practices provides a practical framework for evaluating whether key compliance requirements have been addressed. Every practice is different, but these are the areas that deserve immediate attention.

• Designate a Privacy Officer and a Security Officer. Every practice should formally assign responsibility for HIPAA oversight, even if a solo practitioner serves in both roles.
• Complete a documented risk analysis. Identify all systems that create, receive, maintain, or transmit ePHI and evaluate potential vulnerabilities.
• Develop written HIPAA policies and procedures. Create practice-specific policies covering the Privacy Rule, Security Rule, Breach Notification Rule, and minimum necessary standard.
• Sign BAAs with all vendors handling PHI. Review relationships with EHR vendors, telehealth providers, billing companies, cloud storage services, email providers, and intake software.
• Post and distribute a compliant Notice of Privacy Practices (NPP). Ensure the NPP is provided to patients, available in the office and on the website, and updated to reflect recent regulatory changes.
• Store psychotherapy notes separately from the medical record. Restrict access to the treating clinician and maintain the heightened protections these records require.
• Implement required technical safeguards. Use encryption, unique user IDs, audit logs, access controls, and automatic logoff functionality to protect ePHI.
• Train workforce members annually. The HIPAA training requirements for mental health practices include workforce education that is documented and tailored to actual behavioral health workflows.
• Establish a breach response protocol. Define how potential breaches will be identified, investigated, documented, and reported.
• Review the compliance program annually. Regulations, technology, and practice operations change regularly, so periodic review keeps the program current.

A well-designed compliance program should also include customized mental health practice HIPAA policies and procedures that address the specific risks associated with behavioral health treatment, telehealth services, and psychotherapy documentation.

Our team of healthcare attorneys can help you navigate this process. To learn more, contact us today.

Where Mental Health Practices Most Commonly Violate HIPAA

Most HIPAA violations for mental health practices stem from operational shortcuts, outdated policies, or compliance gaps that develop over time, rather than intentional misconduct.

Common problem areas include:

• Using non-BAA communication tools, such as sending patient information through personal email accounts, consumer messaging applications, or other platforms without a signed BAA can create Security Rule violations.
• Improperly responding to subpoena record requests, like releasing records or psychotherapy notes without verifying authorization requirements or the legal scope of a request.
• Using outdated or generic Notices of Privacy Practices, such as relying on templates that fail to reflect current regulations or the practice’s actual disclosure practices.
• Failing to conduct a documented risk analysis, which OCR lists as one of the most common compliance deficiencies.
• Providing generic workforce training that ignores behavioral health-specific risks often leaves significant compliance gaps unaddressed.

For providers focused on HIPAA compliance for therapists, these issues frequently arise because administrative systems grow more slowly than clinical operations. The same concerns apply to HIPAA compliance for counselors, psychologists, and social workers operating independent practices.

HIPAA Violations: Consequences for Mental Health Providers

The consequences of noncompliance extend beyond federal investigations. A single privacy or security failure can trigger multiple layers of liability and regulatory scrutiny.

Potential consequences include:

• OCR Civil Monetary Penalties: Penalties range from $100 to $50,000 per violation, subject to annual limits that should be reviewed regularly because penalty amounts can change.
• State Licensing Board Action: Confidentiality violations may result in professional discipline ranging from reprimands to suspension or revocation of a professional license.
• State Law Penalties: States such as Illinois (740 ILCS 110), New York (Mental Hygiene Law § 33.13), and Texas (Texas Medical Records Privacy Act) impose additional confidentiality obligations that may be stricter than federal HIPAA requirements.
• Reputational and Civil Exposure: Significant breaches can lead to public reporting, patient complaints, loss of trust, and civil litigation.

For psychiatrists and practice owners, these risks highlight why HIPAA compliance for psychiatrists requires more than simply adopting generic templates. Compliance programs should be tailored to the specific workflows and legal risks associated with behavioral health treatment.

The most effective protection against all these consequences is a compliance program built specifically for a mental health practice rather than adapted from a generic healthcare template and reviewed regularly by a healthcare attorney.

How Jackson LLP Helps Mental Health Providers Build HIPAA Compliance Programs

Maintaining HIPAA compliance for mental health practices requires more than checking regulatory boxes. Therapists, psychologists, counselors, psychiatrists, and social workers face specific confidentiality challenges involving psychotherapy notes, telehealth services, duty-to-warn obligations, and substance use disorder records.

Jackson LLP works with behavioral health providers to develop customized HIPAA compliance programs to address the specific risks and workflows of mental health practices. State-law compliance is incorporated into every compliance program we develop for providers operating in those jurisdictions.

Our services include:

• HIPAA policies and procedures drafting and review
• Risk analysis guidance
• BAA review and execution
• NPP drafting and updating
• Workforce training program development
• Breach response planning
• Intake form drafting and compliance review

Whether you are opening a new practice, updating existing compliance procedures, or responding to a potential HIPAA issue, legal guidance can help identify gaps before they become a significant problem. To learn more, contact us today to book a consultation.

Free Attorney Consultation

Book Now

Frequently Asked Questions About HIPAA Compliance for Mental Health Practices