State-Specific HIPAA Compliance Supplement for Therapists
Built for Mental Health Providers Who Want Legal Protection - Not Guesswork
Think you’re HIPAA compliant?
Not without this.
Every state adds its own privacy laws, documentation rules, licensing board mandates, and telehealth requirements, many of which go beyond federal HIPAA. This Supplement bridges the gap, giving you exactly what you need for your specific state.
Start complying with confidence
Why Federal HIPAA Isn’t Enough
Title | Description |
State-Specific Rules | Covers laws your state requires beyond HIPAA including: record retention, minor consent, and court-ordered disclosures |
Built for Therapists | No generic medical templates here. This is structured for mental health, behavioral health, and solo/group practice use |
Fully Editable & Audit-Ready | Comes in Word format with editable body, compliance checklists, and a quick-view Mega Chart for reference |
Digital & Professional Safeguards | Covers cybersecurity, social media, telehealth, and licensing board oversight |
Works Seamlessly with the Federal HIPAA Manual | Designed as a plug-and-play addition, not a duplicate or standalone template |
What’s Inside Your State Supplement
17 Structured Sections
Custom-written for your state’s legal landscape, including citations, procedures, and licensing board mandates.
Mega Chart: Federal vs. State Comparison
Side-by-side reference tool showing how your state differs from federal HIPAA.
Consent & Confidentiality Laws
Covers minor consent, psychotherapy notes, substance use records, and court disclosures.
Record Retention Requirements
Includes adult, minor, and Medicaid-specific retention timelines by license type.
Telehealth Compliance
Covers platforms, informed consent, client location, and emergency protocols.
Cybersecurity & Social Media Safeguards
Guidelines for encryption, MFA, digital disclosures, social media limitations, and CPRA/CPA-style state privacy laws.
Business Associate Agreement (BAA) Requirements
What your vendors must follow to meet both HIPAA and state law, plus an optional BAA checklist and template.
Licensing Board & Medicaid Oversight Tools
Supervision logs, audit prep protocols, and Medicaid documentation tools.
Editable Word File + Licensing Protection
Customized with your business name, fully editable body, watermarked, and secured headers/footers.
State Addendum Section
State-specific templates or procedures that expand your Federal Manual with no redundancy, just what’s different.
Built Specifically for Mental Health Providers
If you hired a HIPAA consultant or attorney to create this level of customized documentation, expect to pay $3,500+ and that often doesn’t include editable forms, audit guides, or templates built for mental health.
Value: $3,200
Regular Price: $1,997
Limited-Time Price: $1,497
One-time payment – no subscription required
17 State-Specific Categories
Mega Chart Comparing your State’s to the
Federal Laws
State Policy Addendum
✅ Product Format & Customization
Microsoft Word File (.docx)
Editable Body
Locked Headers & Footers
Watermarked with Your Business Name
Delivery: 3–5 Business Days
License: One Business Name, One State
Build a Fully Protected, HIPAA-Compliant Therapy Practice
A professional will is only one part of a fully protected, HIPAA-compliant therapy practice.
Most providers also need documented HIPAA policies, risk assessments, and clear compliance systems in place to ensure their practice is secure, audit-ready, and legally protected.
These resources help you build a complete compliance foundation, not just a contingency plan.
Most therapy practices require a complete HIPAA compliance system, not just individual documents.
Are you missing your State HIPAA laws?
This guide is a quick snapshot of the compliance gaps most therapists miss.
Our full State-Specific HIPAA Compliance Supplements expand each of these areas into detailed, editable policies, procedures, and audit-ready tools.
Bundle Options for Complete Compliance
This Supplement is designed to work hand-in-hand with the Federal HIPAA Compliance Manual. Together, they create a complete, audit-ready policy system for your therapy practice.
Bundle Options:
Legacy Protection Pack
Guardian Core Compliance Essentials™
Guardian Gold Compliance Essentials™
Guardian Diamond Compliance Essentials™
Why Bundle?
✔️ Save hundreds
✔️ Get complete federal + state coverage
✔️ Only pay once – no subscriptions
Need More Than One State?
Add-on states available at discounted bundle pricing.
Therapist Reviews & Testimonials
“This is an absolute lifesaver for HIPAA compliance! Everything you need is organized in one place—a task that would be overwhelming to recreate from scratch. After reviewing, completing, and saving the HIPAA manual along with the policies and procedures, I feel far more confident and organized. I’m truly grateful for these well-crafted forms and documents because they save me time, protect my business, and offer me real peace of mind. The quality is excellent, the content is thorough, and the value is unmatched. There’s nothing else like this on the market. It far exceeds the time, effort, and research it would take to create on your own. Highly recommended!”
-Melissa, LPC
“If you’re in private practice and want to make sure your foundation is solid — federally and ethically — this is the resource you didn’t know you were missing. I cannot recommend it enough.”
– California, LMFT
Frequently Asked Questions About HIPAA and State Laws for Therapists
Do HIPAA laws vary by state?
HIPAA itself is a federal law and does not change from state to state. However, therapists must also comply with applicable state privacy, confidentiality, licensing, recordkeeping, consent, and other laws that may impose additional or stricter requirements.
This is why being compliant with federal HIPAA requirements does not necessarily mean a therapy practice is fully compliant with the laws governing it at the state level.
Do therapists have to follow state privacy laws in addition to HIPAA?
Yes.
Therapists who are subject to HIPAA must follow federal HIPAA requirements as well as applicable state laws governing privacy, confidentiality, mental health records, disclosures, consent, and other areas of practice.
State requirements can provide additional protections or obligations beyond HIPAA, making it important for therapists to understand both federal and state requirements.
Which law applies if state privacy law is stricter than HIPAA?
When an applicable state law provides greater privacy protection than HIPAA, the more protective state requirement may apply. HIPAA generally establishes a federal baseline rather than automatically overriding stronger state privacy protections.
Determining which requirement applies can depend on the specific law and situation, which is why therapists should evaluate state requirements alongside federal HIPAA rules rather than relying on HIPAA alone.
What state laws do therapists need to follow in private practice?
Therapists may be subject to state laws and regulations covering confidentiality, consent, mental health records, record retention, disclosures, minors, telehealth, breach notification, professional licensing, and other areas of clinical practice.
The specific requirements vary by state, license type, practice structure, services provided, and other circumstances.
Does HIPAA determine how long therapists have to keep client records?
Not by itself.
HIPAA requires certain HIPAA-related documentation to be retained for six years, but it does not establish one universal retention period for all clinical records.
Therapists may also have record retention requirements established by state law, licensing boards, Medicaid programs, payer contracts, or other authorities. Your practice’s retention policy should account for all requirements that apply to your records.
Are therapist record retention requirements different in every state?
They can be.
States and professional licensing boards may establish different record retention requirements for therapists and other mental health professionals.
Requirements may also vary based on license type, the client’s age, the type of record, payer requirements, and other factors. A retention policy based only on federal HIPAA requirements may therefore miss requirements applicable to your practice.
Do state laws have different rules for minors and consent to therapy?
Yes.
State laws can establish specific rules governing when minors may consent to mental health treatment, when a parent or guardian must consent, who may access a minor’s records, and when information may be disclosed.
These requirements vary considerably by state and can interact with HIPAA’s rules regarding personal representatives and access to protected health information.
Are telehealth laws different in every state for therapists?
Telehealth requirements can vary significantly by state. Therapists may need to consider state licensing rules, client location, informed consent requirements, documentation standards, privacy requirements, prescribing rules when applicable, and other state-specific telehealth regulations.
Therapists providing telehealth across state lines may need to evaluate the requirements of more than one state.
Do therapists practicing in multiple states have to follow each state's laws?
Potentially, yes.
When a therapist provides services to clients located in multiple states, the therapist may be subject to licensing, telehealth, privacy, consent, documentation, and other requirements in the states where services are provided.
Multi-state practice therefore requires more than applying the laws of the therapist’s home state to every client.
Are mental health records protected differently under state law?
They can be.
Some states provide additional protections for mental health records, psychotherapy information, substance use information, communications between therapists and clients, or particular categories of sensitive information.
These protections may affect when information can be disclosed, who can authorize a disclosure, how records must be handled, and what documentation a therapist should maintain.
How can therapists determine which state HIPAA and privacy laws apply to their practice?
Therapists should evaluate federal HIPAA requirements together with applicable state statutes, regulations, licensing board rules, and other requirements affecting their practice.
Guardian Clinical Essentials State-Specific HIPAA Compliance Supplements organize these requirements for mental health providers and compare key state requirements with the federal HIPAA framework, helping therapists identify where state-specific compliance obligations may apply.