What Does HIPAA Require of a Small Behavioral Health Practice?

A small behavioral health practice must protect patient information, do a written security risk analysis, train staff, have policies and report breaches on time. Therapy notes and substance use records have extra rules. HHS offers a free risk assessment tool built for small practices.

Start with a risk analysis

HHS calls the risk analysis the first step in following the HIPAA Security Rule. It must cover all electronic patient information you create, receive, keep or send. That includes laptops, phones, your EHR and vendors.

HHS says the analysis must be written down and kept current. It does not set one schedule. Some practices review yearly or when things change, such as a new system, new owner or a security incident.

The free SRA Tool from HealthIT.gov was made to help small and medium practices do this.

Have policies, training and sanctions

HHS's breach page says covered entities must have written privacy policies, train staff and apply sanctions when staff break the rules. Keep a record of who was trained and when.

Know the breach notice clock

If unsecured patient information is breached, HHS says you must notify each affected person without unreasonable delay and no later than 60 days after you discover it.

You must also tell HHS:

• 500 or more people affected: within 60 days.
• Fewer than 500: within 60 days after the end of the calendar year.

If more than 500 residents of one state are affected, you must also notify the media. Business associates must tell you about a breach no later than 60 days after they find it. Information that was encrypted to HHS standards is generally not "unsecured." That is one reason encryption matters.

Psychotherapy notes

HIPAA gives psychotherapy notes extra protection. These are a therapist's separate notes about what was said in a session. HHS says most disclosures of them, even for treatment, need the patient's written authorization. There are some exceptions, such as reports required by law.

Substance use records and Part 2

If you run a federally assisted substance use program, 42 CFR Part 2 applies too. HHS says the final rule had a compliance date of February 16, 2026. Some changes:

• One consent can now cover treatment, payment and health care operations.
• Breach notice and penalties now line up with HIPAA.
• SUD counseling notes need their own consent.
• Records still can't be used against patients in legal cases without consent or a court order.

Ask a lawyer whether Part 2 applies to you.

Telehealth and vendors

Georgia's DCH telehealth guidance says telehealth must be HIPAA compliant and encrypted. Make sure your video, phone and texting tools fit HIPAA. Get a business associate agreement with vendors that handle patient data.

Rules may change

HHS proposed changes to the HIPAA Security Rule in January 2025. Check HHS to see if they have become final before you plan big changes.

Use the free risk assessment tool

HHS points small and medium practices to the Security Risk Assessment (SRA) Tool. It is free from the Office of the National Coordinator for Health IT (ONC). It walks you through questions about your devices, people and vendors. It does not make you compliant by itself, but it helps you find and write down your risks.

A simple yearly HIPAA routine

Small practices do best with a short routine they actually keep:

1. Update your risk analysis, especially after a new system, move or vendor.
2. Review your policies and fix what no longer fits.
3. Retrain staff and keep sign-in sheets.
4. Check that every vendor with patient data has a business associate agreement.
5. Review who has access to your EHR, and remove people who left.

Put these on your compliance calendar so they don't slip.

Key takeaways

• Do a written risk analysis covering all electronic patient data, and keep it current.
• Have written policies, train staff and apply sanctions.
• Breach notices to patients are due no later than 60 days after discovery.
• Psychotherapy notes and Part 2 SUD records have extra rules.
• Use encrypted, HIPAA-ready tools and sign agreements with vendors.

How DIG helps

Ducere Investment Group (DIG) has consulted mental and behavioral health agencies for 14 years. We help small Georgia practices organize privacy policies, training logs and compliance calendars, and we review workflows without touching patient records. We are a business consultant, not a law firm, and we cannot promise any compliance result.

See our services or contact us. Call 404-565-0181.

Sources

• HHS: Guidance on Risk Analysis
• HealthIT.gov: Security Risk Assessment (SRA) Tool
• HHS: HIPAA Breach Notification Rule
• HHS FAQ: Does HIPAA provide extra protections for mental health information?
• HHS: Fact Sheet – 42 CFR Part 2 Final Rule
• Georgia DCH Telehealth Guidance, Part II (version Oct. 1, 2026)
• Federal Register: HIPAA Security Rule proposed rule (Jan. 6, 2025)

Written by Korey Akinbami, Founder & Principal. Published by Ducere Investment Group, Inc.

This article is general information, not legal, medical or billing advice.