HIPAA checklist for therapists (2027)
Short answer: A HIPAA checklist for therapists covers three areas. Documents: a yearly risk analysis, written policies, a Notice of Privacy Practices, business associate agreements and a breach plan. Safeguards: two-factor login, encryption, screen lock, updates and tested backups. Habits: share the minimum necessary, keep sessions private and train staff every year.
HIPAA does not require expensive software or a compliance department. It requires a handful of documents, sensible safeguards and habits you actually follow. Use the checklist below to see where you stand. For how notes are protected, see psychotherapy notes vs progress notes. For messaging risks, see texting clients: HIPAA rules and consent.
What documents do therapists need for HIPAA?
- A security risk analysis, updated at least yearly and when you change systems
- Written privacy and security policies that match how you work
- A Notice of Privacy Practices given to every client, with a record that you gave it
- Business associate agreements with your EHR, telehealth, email, billing and any other vendor that handles client information
- A breach response plan
What technical safeguards should be in place?
- Strong, unique passwords and two-factor authentication on every account with client data
- Full-disk encryption on laptops and phones
- Automatic screen lock
- Software and operating system updates turned on
- Secure, HIPAA-ready tools for video sessions, messaging and forms
- Backups you have tested
- A private space for sessions and phone calls
What habits keep a practice safer?
- Keep client details out of email subject lines and text previews.
- Share the minimum necessary information with others.
- Do not use personal email or consumer apps for client communication unless you have assessed the risk and have the client's informed agreement where required.
- Lock up or securely shred paper records.
- Train any staff when they start and once a year.
What is different for therapy practices?
- Psychotherapy notes kept separate from the rest of the record get extra protection under HIPAA.
- Clients have a right to access most of their record, with limited exceptions.
- If you treat substance use and are covered by 42 CFR Part 2, additional consent rules apply.
- Replying to online reviews can disclose that someone is your client. Keep replies general.
Copy-ready checklist
Use this as a working list. Mark each item done only when the document or safeguard is in place, not when you plan to do it.
Documents
- Yearly security risk analysis on file
- Privacy and security policies adopted
- Notice of Privacy Practices given and logged
- Business associate agreement for each vendor that handles client information
- Written breach response plan
Safeguards
- Multi-factor authentication on accounts with client data
- Full-disk encryption and automatic screen lock
- Automatic updates enabled
- Tested backups
- Private space for sessions and calls
Habits
- Staff trained at hire and yearly
- Minimum necessary sharing practiced
- No clinical details in regular text or personal email
- Paper records locked or shredded when retention ends
What is changing in the Security Rule?
HHS has proposed a major update to the HIPAA Security Rule that would make several safeguards, including multi-factor authentication and encryption, explicit requirements. As of mid-2026 it was still a proposed rule. The safeguards above put you in a good position either way.
What should you do if something goes wrong?
- Contain it: change passwords, lock or wipe devices.
- Investigate what information was involved and how many clients.
- Assess whether it is a reportable breach.
- Notify clients and HHS within the required timelines if it is.
- Fix the cause and document what you did.
Frequently asked questions
Do solo therapists need a risk analysis?
Yes. HIPAA applies regardless of practice size.
Is my EHR's BAA enough?
It covers that vendor only. You need one for each vendor that handles client information.
Can I text clients?
It is possible with safeguards and clear client agreement, but secure messaging is safer. Our guide to texting clients under HIPAA covers consent and what to keep out of texts.
How Sealed helps
Sealed gives therapists a HIPAA program built for behavioral health: a guided risk analysis, ready policies, short training and a vendor BAA tracker. Start your risk analysis.
Sources and check date
Checked October 11, 2026.
- HHS OCR: Security Rule guidance (opens in a new tab) and Breach Notification Rule (opens in a new tab) pages
- 45 CFR Parts 160 and 164 (opens in a new tab) (HIPAA Privacy and Security Rules)
- HHS proposed HIPAA Security Rule updates (opens in a new tab) (status: proposed as of mid-2026; re-check before relying on wording)
This is general information, not legal advice.