HIPAA Compliance for Therapists

Start by determining whether HIPAA applies

HIPAA applies to covered entities and business associates that meet the applicable definitions and requirements. Working as a therapist or operating a private practice does not by itself determine HIPAA applicability.

Review where PHI is stored and shared

Identify where protected health information may exist throughout your practice.

• EHR and practice-management systems
• Intake forms
• Email and messaging
• Billing systems
• Telehealth platforms
• Cloud storage
• Computers and mobile devices
• Backups

Review administrative safeguards

• Security policies and procedures
• Risk analysis and risk management
• Workforce access
• Security awareness and training
• Incident-response procedures

Review physical safeguards

• Workstation access
• Device security
• Workspace privacy
• Device disposal and reuse procedures

Review technical safeguards

• Access controls
• User authentication
• Audit and activity review practices
• Protection of ePHI during electronic transmission

Review vendors and Business Associate Agreements

Review vendors that may create, receive, maintain, or transmit PHI on behalf of your practice and determine whether an appropriate Business Associate Agreement is required.

Review telehealth workflows

If you provide remote care, include telehealth platforms, remote devices, communications, vendors, and related workflows in your HIPAA review.

Review Telehealth HIPAA Compliance →

Review documentation

Policies, risk analysis records, training documentation, Business Associate Agreements, and incident-related records are important areas to organize and maintain as applicable.

Run a guided HIPAA compliance assessment

GetHIPAAcheck helps therapists and small practices review key HIPAA requirements, identify potential gaps, and receive recommended next steps.

Start Free HIPAA Compliance Assessment