HIPAA & Practice Compliance
for Therapists
HIPAA compliance for therapists involves more than protecting client confidentiality. Mental health practices must navigate federal HIPAA Privacy, Security, and Breach Notification Rules alongside applicable state laws, licensing requirements, and professional ethics.
Guardian Clinical Essentials™ provides HIPAA and practice compliance articles for therapists, counselors, social workers, psychologists, and behavioral health practice owners, covering risk assessments, documentation, telehealth, AI, technology, and regulatory changes.
What Therapists Need to Know About HIPAA Compliance
Most therapists receive extensive clinical training but little preparation for managing the regulatory and operational responsibilities of private practice. HIPAA compliance involves policies and procedures, security risk analysis, business associate agreements, breach response, and ongoing safeguards. State confidentiality laws and licensing requirements can add further obligations that affect how therapists document care, use technology, and manage client information.
Compliance Guidance Written for
Mental Health Practices
General healthcare compliance guidance doesn’t always address the questions that arise in behavioral health practice. Psychotherapy notes, treatment documentation, coordination of care, telehealth, AI tools, and third-party vendors can create additional considerations for therapists and practice owners.
Written from a clinician’s perspective, Guardian Clinical Essentials articles connect HIPAA requirements, state regulations, technology risks, and behavioral health practice operations to help mental health professionals understand their responsibilities and identify where closer attention is needed.
Explore Compliance Topics
HIPAA Compliance for Therapists
Clear explanations of HIPAA privacy, security, and breach rules as they apply to mental health private practice.
State-Specific Compliance Requirements
Guidance on how state laws, licensing boards, and professional regulations intersect with HIPAA.
Website & Digital Privacy Compliance
Common compliance issues related to therapist websites, contact forms, email, analytics, and online tools.
Telehealth & Technology Compliance
Requirements and risk considerations for telehealth, devices, and digital platforms used in clinical practice.
Documentation & Record Retention
What therapists need to know about documentation standards, record storage, and retention timelines.
BAA vs Confidentiality: What Actually Applies
Learn when a Business Associate Agreement is required and when a simple confidentiality acknowledgment is the correct approach.
Includes a FREE Shared Space Confidentiality Acknowledgment for therapy practices.
Practice Compliance Guidance for Therapists
Start Here: Think You Made a HIPAA Mistake?
If you think you may have made a HIPAA mistake, the most important thing is knowing what to do next. Most therapists are not trained in how to assess a potential breach, determine whether it is reportable, or document their decisions in a way that can be supported if reviewed.
This guide walks you through exactly what to do, step by step, so you are not trying to figure it out in the moment.
HIPAA Compliance & Practice Requirements
Start with the most commonly misunderstood areas of HIPAA and practice compliance, then work through topics based on your needs.
A clear, therapist-specific explanation of what HIPAA requires for Security Risk Analysis and ongoing compliance in mental health practice.
A therapist-focused overview of HIPAA documentation requirements, including policies, procedures, workforce oversight, and how compliance is demonstrated in practice.
Clarifies when updated federal substance use confidentiality rules apply to therapy practices, including referrals from federally assisted programs and documentation considerations.
State Laws & Regulatory Updates for
Mental Health Practices
California’s new AI laws, AB 1979 and SB 503, take effect January 1, 2027, introducing requirements involving clinical decision-making, professional judgment, and AI-related privacy protections. Learn what these laws mean for therapists and behavioral health practices, which requirements apply, and what to review before they take effect.
Behavioral health compliance is changing across multiple states in 2026, with new and proposed requirements involving AI, client records, telehealth, confidentiality, psychotherapy, and professional practice. This article breaks down developments in eight states, including what changed, when it takes effect, and who the requirements actually apply to.
Colorado passed new laws in 2026 affecting how mental health providers use AI, including new restrictions on AI in psychotherapy signed into law on June 3 and effective August 12, 2026. This article breaks down what changed, what Colorado providers need to know now, and why therapists in other states should be paying attention.
A practical breakdown of the proposed 2026 HIPAA Security Rule changes, where things currently stand, and what mental health practices should realistically be paying attention to right now. This evolving resource focuses on operational compliance, cybersecurity expectations, ongoing risk management, and what these proposed updates may mean for therapists and group practices moving forward.
Break down the confusion around the April 2026 ADA website rule and what actually applies to therapists. Learn where your practice may still be at risk and what to pay attention to moving forward.
AI, Technology & Digital Privacy for Therapists
Artificial intelligence is creating new compliance questions for therapists, group practices, and behavioral health organizations.
Whether you’re evaluating AI note tools, documentation assistants, treatment planning tools, transcription services, or workflow automation platforms, understanding how HIPAA applies requires more than simply asking whether a tool is “HIPAA compliant.”
Explore therapist-focused guidance, compliance tools, and practical resources in our dedicated AI & HIPAA Resource Hub.
Included in the Hub are the Google Workspace Configuration Guides
Featured AI & HIPAA Articles
Is AI HIPAA Compliant for Therapists?
Most therapists are asking whether AI is HIPAA compliant, but that question misses what actually matters. This article breaks down how AI tools interact with protected health information and how to evaluate whether your use is actually compliant.
A therapist-focused look at AI-assisted documentation, including documentation defensibility, clinician oversight, workflow considerations, and the difference between using AI to support documentation versus allowing AI to generate the clinical record.
This article explains how therapists can use AI to assist with treatment planning while addressing HIPAA, client information, BAAs, and clinical responsibility. It also explores the important difference between using AI to support documentation and relying on it to make clinical decisions.
Expert Conversations: Technology, Compliance & Behavioral Health
Go behind the scenes with Uriah Guilford as he shares what it takes to build AI tools specifically for therapy practices. This conversation explores the development of SimpleIntake, the challenges of responsible AI integration, and what therapists should consider as these tools continue to evolve.
Official HIPAA & Regulatory Resources
Looking for federal regulations, government guidance, or professional resources? Our compliance resource directory provides access to authoritative sources to help therapists research HIPAA requirements, privacy and security obligations, and other practice compliance questions.
Stay Informed About Changes Affecting Your Practice
Practical, therapist-focused guidance on HIPAA, state requirements, and digital privacy, centered on what actually matters for your practice.
Need Help Turning Compliance Requirements Into Practice Procedures?
Education is the first step. Implementation is where most therapists get stuck. Guardian Clinical Essentials offers structured compliance tools and guidance designed specifically for mental health practices.
Explore Guardian Clinical Essentials
Whether you’re looking for practical compliance resources, organizational training, or educational collaboration opportunities, Guardian Clinical Essentials offers multiple ways to support therapists and mental health organizations.
Training Programs
Bring compliance education directly to your staff, leadership team, organization, conference, or professional community.
Collaborations & Speaking
Invite Samantha to participate in podcasts, webinars, conferences, summits, CEU programs, and educational events.
Free Compliance Tools
Access practical checklists, planners, guides, and compliance resources designed specifically for therapists and mental health practices.