HIPAA Compliance Checklist for Mental Health Providers

Last updated: 2026-04-07 — ComplianceStack Editorial Team

17 items
Progress 0 of 17 reviewed

Mental health providers face HIPAA requirements that go beyond standard healthcare compliance. Psychotherapy notes receive special protections that even other providers cannot access without explicit authorization. Substance abuse treatment records fall under 42 CFR Part 2, which imposes stricter consent requirements than HIPAA alone. Telehealth sessions add transmission security obligations. This checklist addresses the 17 items that mental health practices most often miss.

Priority Legend:
● Critical ● High ● Medium ● Ongoing

HIPAA Compliance Checklist for Mental Health Providers

1

Separate psychotherapy notes from the general medical record

Critical 1-2 days

Psychotherapy notes (personal observations recorded during a session) must be stored separately from the patient's clinical record. They cannot be included in the designated record set and require a separate, specific authorization for disclosure — even to the patient's insurance company.

45 CFR 164.501 (definition of psychotherapy notes); 45 CFR 164.508(a)(2)
2

Conduct a Security Risk Assessment covering all ePHI systems

Critical 2-4 days

Include your EHR, telehealth platform, encrypted messaging tools, cloud storage, and any personal devices used for patient communication. Document every identified risk and your mitigation plan.

45 CFR 164.308(a)(1)(ii)(A)
3

Implement 42 CFR Part 2 consent procedures for substance abuse records

Critical 2-3 days

If you treat patients for substance use disorders, their records receive extra protection under 42 CFR Part 2. Disclosure requires patient written consent that names the specific recipient, purpose, and expiration date. General HIPAA authorizations are not sufficient.

42 CFR Part 2, Subpart C (Disclosures with Patient Consent)
4

Verify your telehealth platform is HIPAA-compliant with a signed BAA

Critical 1 day

Consumer video tools (FaceTime, Skype, standard Zoom) are not HIPAA-compliant. Use platforms that offer a BAA and end-to-end encryption: Zoom for Healthcare, Doxy.me, SimplePractice Telehealth, or TherapyNotes. Keep the signed BAA on file.

45 CFR 164.312(e)(1) (Transmission Security); 45 CFR 164.502(e) (BAA requirement)
5

Establish minor consent and parental access policies

Critical 2 days

State laws vary on whether parents can access a minor's mental health records. In many states, minors 12+ can consent to outpatient mental health treatment without parental consent, and the provider may deny parents access to those records. Document your state's rules and your practice policy.

45 CFR 164.502(g) (Personal Representatives); state-specific minor consent laws
6

Designate a HIPAA Privacy and Security Officer

High 1 day

Solo practitioners may serve as their own officer but must document the designation. The officer is responsible for policy development, staff training, and breach response coordination.

45 CFR 164.530(a)(1); 45 CFR 164.308(a)(2)
7

Create an authorization form specific to psychotherapy notes

High 1 day

A general HIPAA release does not authorize disclosure of psychotherapy notes. You need a separate, specific authorization form that clearly identifies the notes being released and cannot be combined with other authorizations.

45 CFR 164.508(b)(3)(ii)
8

Encrypt all devices used for patient communication

High 1 day

Laptops, tablets, smartphones — if any device stores or accesses ePHI, enable full-disk encryption. This includes personal devices used for after-hours patient calls or secure messaging.

45 CFR 164.312(a)(2)(iv)
9

Implement secure messaging for patient communication

High 1-2 days

Standard SMS and email are not encrypted. Use a HIPAA-compliant patient portal or encrypted messaging system for appointment reminders, session follow-ups, and prescription coordination.

45 CFR 164.312(e)(2)(ii)
10

Train staff on handling crisis calls and mandatory reporting without violating HIPAA

High 1 day

HIPAA permits disclosure to prevent serious and imminent threat to health or safety (45 CFR 164.512(j)). Staff must know when mandatory reporting obligations (child abuse, elder abuse, danger to self or others) override confidentiality, and how to document the disclosure.

45 CFR 164.512(j); 45 CFR 164.512(c) (required by law)
11

Establish a written breach notification procedure

High 2 days

Mental health breaches are especially sensitive. Define how you will investigate, assess harm, notify patients within 60 days, and document corrective actions. Consider offering credit monitoring for breaches involving SSNs or financial data.

45 CFR 164.400-414
12

Configure access controls so only treating providers can view clinical notes

High Half day

Front-desk staff should have access to scheduling and billing data but not clinical session notes. Configure role-based access in your EHR to enforce this separation.

45 CFR 164.312(a)(1); 45 CFR 164.502(b) (Minimum Necessary)
13

Develop policies for court-ordered disclosures and legal proceedings

Medium 2 days

Mental health records are frequently subpoenaed in custody disputes, disability claims, and criminal cases. A valid court order differs from a subpoena — know the difference. HIPAA permits disclosure in response to a court order but limits what a subpoena alone can compel.

45 CFR 164.512(e) (Judicial and Administrative Proceedings)
14

Ensure waiting room and office layout protects patient privacy

Medium Varies (physical modifications)

Soundproofing between therapy rooms and waiting areas prevents incidental disclosure. White noise machines, solid-core doors, and check-in procedures that do not require patients to state their reason for visit aloud are all reasonable safeguards.

45 CFR 164.530(c)(1) (Safeguards)
15

Execute BAAs with all vendors: EHR, billing, transcription, cloud backup

Medium 2-3 days

Every vendor who stores, processes, or transmits PHI on your behalf needs a signed BAA. Common oversights: transcription services, online scheduling tools, cloud storage for session recordings.

45 CFR 164.502(e); 45 CFR 164.504(e)
16

Document your data retention and destruction schedule

Medium 1 day

HIPAA requires policies to be retained for 6 years, but state laws often require clinical records to be kept for 7-10 years (longer for minors). Define retention periods for each record type, destruction methods, and responsible personnel.

45 CFR 164.530(j); applicable state retention laws
17

Review and update all policies annually and after any security incident

Ongoing 1-2 days per year

Assign a calendar date for annual policy review. Document all changes, re-train affected staff, and retain prior versions for the six-year retention period.

45 CFR 164.530(j); 45 CFR 164.316(b)(2)(iii)

See How Your Mental Health Provider Scores on HIPAA

Run a free gap analysis to find out which items you have covered and where the risks are.

Gap Analyzer →   Training Tracker →

Common Mistakes That Trigger Enforcement

Including psychotherapy notes in the general medical record
Once mixed in, the special protections are lost. Insurance companies, other providers, and even patients requesting their records may gain access to private session observations.
Using standard Zoom or FaceTime for therapy sessions
Consumer video platforms lack BAAs and may not encrypt recordings. A single intercepted session is a reportable breach affecting highly sensitive information.
Applying general HIPAA authorization forms to psychotherapy notes
Psychotherapy notes require a separate, specific authorization. A combined authorization form is invalid for these notes under 45 CFR 164.508(b)(3)(ii).
Ignoring 42 CFR Part 2 requirements for substance abuse treatment
Part 2 records cannot be re-disclosed by recipients without additional patient consent. Violations can result in criminal penalties up to $500 per violation.
Giving parents automatic access to a minor's therapy records
Many states grant minors the right to consent to mental health treatment independently. Disclosing records without checking state law can violate both HIPAA and state privacy statutes.

Frequently Asked Questions

Can insurance companies access psychotherapy notes?

No, not without a separate, specific written authorization from the patient. Psychotherapy notes are explicitly excluded from the designated record set and from the treatment, payment, and healthcare operations exception. An insurer cannot condition coverage on receiving these notes.

Does 42 CFR Part 2 apply to all mental health providers?

No. 42 CFR Part 2 applies specifically to federally assisted programs that provide substance use disorder treatment. If your practice receives any federal funding (including Medicaid/Medicare) and treats substance use disorders, Part 2 likely applies to those records. General psychotherapy records without a substance abuse component are governed by HIPAA alone.

What telehealth platforms are considered HIPAA-compliant for therapy?

A platform is HIPAA-compliant when the vendor signs a Business Associate Agreement and provides end-to-end encryption. Common compliant options include Zoom for Healthcare, Doxy.me, SimplePractice Telehealth, TherapyNotes, and VSee. The platform itself is not certified by HHS — compliance depends on the BAA and the security configuration you use.

✉ Save This Checklist

Enter your email and we'll send you a clean copy — plus updates when requirements change.

We also offer a free personalized gap analysis for your specific situation.

Related Resources