HIPAA Compliance by Vertical
HIPAA Compliance for Mental Health Practices
HIPAA compliance for mental health practices and teletherapy — psychotherapy notes, the higher disclosure bar, and the new reproductive-health rule.
By the Shieldra Compliance Team · Last updated July 2026
Key takeaways
- PHI in scope: Psychotherapy notes (special HIPAA category), Treatment plans and diagnoses, Medication records and refill requests, Session recordings and async messaging.
- Start with these controls: EHR configured to segregate psychotherapy notes from general PHI; Documented psychotherapy notes disclosure policy; BAA-covered crisis and after-hours messaging platform.
- The most common mistake: EHR exposes psychotherapy notes to billing staff with no separate access control
- A signed BAA is required with every vendor that touches PHI, and no tool is HIPAA compliant on its own.
PHI handled in this environment
- Psychotherapy notes (special HIPAA category)
- Treatment plans and diagnoses
- Medication records and refill requests
- Session recordings and async messaging
- Insurance claims with mental-health diagnoses
Common compliance pain points
- Psychotherapy notes get a higher bar: HIPAA singles out psychotherapy notes — the clinician's personal session notes — and requires explicit patient authorization for almost any disclosure. Most EHRs lump them together with regular treatment notes, creating systemic over-disclosure risk.
- 2024 reproductive-health amendment: The 2024 HIPAA Privacy Rule update added specific protections for reproductive-health information. Mental health practices serving patients across state lines must now be careful about disclosures that could relate to reproductive care.
- Async messaging and crisis routing: Patient text messaging is a regulatory minefield. Crisis lines, on-call routing, after-hours messaging — each path must be encrypted, BAA-covered, and documented. Practices using personal cell phones are creating undocumented PHI flows.
- Family involvement and minor patients: When parents are involved in adolescent care, HIPAA's rules vary by state and by patient age. Practices need a documented decision tree, not ad-hoc judgment per call.
Priority controls
- EHR configured to segregate psychotherapy notes from general PHI
- Documented psychotherapy notes disclosure policy
- BAA-covered crisis and after-hours messaging platform
- No personal cell phone use for clinical communication
- Documented decision tree for minor patients and family involvement
- Reproductive-health disclosure policy aligned to the 2024 Privacy Rule update
Common mistakes
- EHR exposes psychotherapy notes to billing staff with no separate access control
- Personal phone numbers shared for after-hours patient contact
- Crisis messaging routed through a non-BAA SMS gateway
- No documented policy for minor patients and parental access
- Cross-state reproductive-health disclosures handled ad-hoc
Enforcement context
Mental health-focused enforcement has grown alongside teletherapy. The 2024 Privacy Rule update on reproductive health information explicitly targets cross-border disclosure scenarios that came up post-Dobbs. Mental health practices serving patients across multiple states should treat these rules as an active enforcement priority, not background noise.
Frequently asked questions
What PHI do mental health practice organizations handle?
Psychotherapy notes (special HIPAA category); Treatment plans and diagnoses; Medication records and refill requests; Session recordings and async messaging; Insurance claims with mental-health diagnoses. Any of these, combined with an identifier, is protected health information and brings the full Security Rule into scope.
What are the priority HIPAA controls for mental health practice?
EHR configured to segregate psychotherapy notes from general PHI; Documented psychotherapy notes disclosure policy; BAA-covered crisis and after-hours messaging platform; No personal cell phone use for clinical communication; Documented decision tree for minor patients and family involvement; Reproductive-health disclosure policy aligned to the 2024 Privacy Rule update.
What are the most common HIPAA mistakes in mental health practice?
EHR exposes psychotherapy notes to billing staff with no separate access control; Personal phone numbers shared for after-hours patient contact; Crisis messaging routed through a non-BAA SMS gateway; No documented policy for minor patients and parental access; Cross-state reproductive-health disclosures handled ad-hoc.
What does HIPAA enforcement look like for mental health practice?
Mental health-focused enforcement has grown alongside teletherapy. The 2024 Privacy Rule update on reproductive health information explicitly targets cross-border disclosure scenarios that came up post-Dobbs. Mental health practices serving patients across multiple states should treat these rules as an active enforcement priority, not background noise.
