HIPAA Compliance Checklist for Therapists: A Plain-English Guide for Solo and Small Practices

Posted by

Cyhornet

If you run a solo or small therapy practice, you are a HIPAA covered entity the moment you bill insurance electronically, and most private-pay practices follow the same rules because clients expect it. The problem is that most HIPAA guidance is written for hospitals. You need a short list of what actually applies to a practice of one to ten people, and a way to prove you did it.

This HIPAA compliance checklist for therapists walks through the essentials in plain English: the risk analysis, the policies, the vendor agreements, telehealth, breaches and the yearly review. If you would rather start from finished templates, the Therapist HIPAA & No-Show Kit covers every item below.

This article is general guidance, not legal advice. Have qualified counsel review your policies before you adopt them.

Why a checklist matters for a small practice

HIPAA does not expect a solo counselor to have a compliance department. It does expect you to understand where client information lives, protect it in reasonable ways for your size, and write down what you decided. When a client complains, a laptop goes missing or an auditor asks, the question is simple: can you show your work? A checklist turns a vague worry into a set of documents you can point to.

The HIPAA compliance checklist for therapists

Name your privacy and security officer. In a solo practice that is you. Write it down anyway, with the date.
Do a security risk analysis. This is the item most often missing in small practices. List where protected health information (PHI) lives: your EHR, email, phone, laptop, paper files, backups and telehealth platform. For each, note the risk and what you do about it. The free HHS Security Risk Assessment Tool is one option; a simpler guided worksheet works for many solo practices.
Write your privacy and security policies. Cover who can access records, minimum necessary use, passwords and device locks, encryption, backups, remote work, disposal of records, and how clients request their records.
Publish a Notice of Privacy Practices. Start from the HHS model notice, fill in your details, post it in your office and on your website, and get a signed acknowledgement from each client.
Sign a Business Associate Agreement (BAA) with every vendor that touches PHI. That usually means your EHR, telehealth platform, secure email, billing service, answering service and cloud storage. Keep a list of vendors, what data each one sees and the date the BAA was signed. A simple vendor inventory and review tracker keeps this in one place.
Secure your devices. Turn on full-disk encryption (BitLocker or FileVault), screen lock and remote wipe on every laptop and phone used for client work. Use a password manager and multi-factor sign-in on your EHR and email.
Lock down telehealth. Use a platform that signs a BAA, hold sessions from a private space, use waiting rooms or unique links, and never record sessions without written consent.
Train yourself and any staff. Even a sole proprietor should complete and sign a short yearly training record. Add a line on AI tools: never paste client details into a chatbot that has not been approved and covered by a BAA.
Have a breach response plan. Know what to do if a phone is lost, an email goes to the wrong client or an account is hacked: contain it, assess the risk, decide whether notification is required and log it. Our free security incident first 24 hours checklist is a good companion.
Remove access when people leave. When a biller, intern or associate leaves, turn off their accounts the same day. The free offboarding access removal checklist lists the usual systems.
Keep records and review yearly. Keep policies, the risk analysis, training sign-offs and BAAs for at least six years, and put an annual review date on your calendar.

Common gaps we see in solo practices

No written risk analysis, even though the practice has good habits.
Using regular email or text for scheduling and clinical details without a BAA or client consent.
A BAA with the EHR but none with the telehealth or billing vendor.
Client notes on a personal laptop with no disk encryption.
No breach log, so a small incident is never documented.
Staff trying free AI note-taking or chat tools with real client details. If you allow AI at all, set rules first; our AI acceptable use policy template guide and AI tool approval checklist explain how.

Add a cancellation and no-show policy while you are at it

Your intake paperwork is the right place for a clear cancellation and no-show policy with card-on-file consent. It protects your income and sets expectations from the first session. Reminder messages should share only what is needed, such as the date and time, not the reason for the visit. You can download a free cancellation and no-show policy for therapists with a consent form and 48-hour, 24-hour and missed-session reminder scripts.

Skip the blank page: the Therapist HIPAA & No-Show Kit

The Therapist HIPAA & No-Show Kit is built for solo therapists, counselors, psychologists and small group practices. It includes:

A solo-practice security risk analysis worksheet that links to the free HHS SRA Tool.
12 plain-English privacy and security policies with regulation references.
A Notice of Privacy Practices customization guide based on the HHS model notice.
A BAA tracker and vendor list covering EHR, telehealth, email and billing.
A telehealth privacy checklist.
A breach response checklist and log.
A workforce and sole-proprietor training sign-off.
An annual review calendar.
A cancellation and no-show policy, consent form and reminder scripts.

It comes as editable Word and Excel files plus PDFs in an instant ZIP download and works with any EHR. If you want it finished in one sitting, the 90-minute 1:1 setup session includes the kit and fills in the risk analysis, policies, BAAs and no-show policy with you remotely, followed by an email summary of next steps.

The kit is templates and guidance based on HHS and NIST public resources. It does not certify or guarantee compliance, Cyhornet LLC is not a law firm, and it is not affiliated with HHS or any government agency.

Get your HIPAA paperwork done this week

Block two hours, work through the checklist above and file the results in one folder. To save most of that time, get the Therapist HIPAA & No-Show Kit and start from finished, plain-English templates today, or grab the free no-show policy first.

Frequently asked questions

Do solo therapists need to comply with HIPAA?

If you transmit health information electronically for billing or other standard transactions, you are a covered entity under HIPAA. Many private-pay therapists follow the same safeguards because clients expect privacy. Check your situation with qualified counsel.

What is the most commonly missed HIPAA item in small practices?

A written security risk analysis. Many practices have good habits but no document showing where client data lives, what the risks are and what was done about them.

Do I need a BAA with my EHR and telehealth platform?

Yes, any vendor that creates, receives, stores or transmits protected health information for you should sign a Business Associate Agreement. Keep a list of vendors and signed dates.

How long should I keep HIPAA documentation?

HIPAA requires keeping policies, risk analyses and related documentation for six years from creation or last effective date. State rules for clinical records may differ.

Is the Therapist HIPAA & No-Show Kit legal advice?

No. It is templates and guidance based on HHS and NIST public resources. Have qualified counsel review before adoption.

Which EHRs does the kit work with?

Any. The BAA tracker includes common therapy platforms as examples, and the files are editable Word, Excel and PDF.