HIPAA Checklist for Behavioral Health & Therapy Practices
A practical HIPAA self-review for small behavioral-health and therapy practices
Therapy and behavioral-health teams may handle sensitive patient information across EHRs, telehealth platforms, online intake, scheduling, email, billing, referrals, clinician notes, mobile devices, and outside vendors. A simple review can help the practice organize where PHI moves and where procedures need clarification.
Download the free HIPAA Compliance Starter Checklist →
Areas to review
- Which staff and clinicians can access clinical records, scheduling, billing, and telehealth systems?
- How are access permissions changed when clinicians or staff join, leave, or change roles?
- How are telehealth sessions, links, messages, and related documentation handled?
- Where do online intake forms and patient-submitted documents go after submission?
- How are email, voicemail, text, and portal communications involving PHI handled?
- Which vendors or contractors may create, receive, maintain, or transmit PHI?
- What happens if a clinician's laptop, phone, or other device is lost or compromised?
- Do team members know how and where to report a suspected privacy or security incident?
Want a structured next step?
If the review identifies areas you want to organize, the $49 HIPAA Compliance Starter Pack includes an editable risk-assessment worksheet, PHI Handling SOP template, HIPAA Policy Index, and starter checklist.
One-time $49 payment. Digital toolkit. No subscription.
See exactly what's inside the Starter Pack →
Educational and organizational information only. This resource is not legal advice, does not guarantee HIPAA compliance, and does not replace a formal security risk analysis or qualified professional guidance where appropriate.