Compliance
HIPAA Compliance Checklist for Therapy Practices
Technical and administrative HIPAA checklist for US outpatient psychologists — BAA, encryption, staff access, audit logs, and common solo-practice mistakes.
Updated June 12, 2026 · 7 min read
HIPAA compliance is a shared responsibility: your software vendor provides technical safeguards; your therapy practice owns policies, training, and day-to-day PHI handling. This checklist helps US outpatient psychologists evaluate software and their own clinic readiness before go-live.
Vendor technical safeguards (ask before storing PHI)
- Signed Business Associate Agreement (BAA) before production PHI
- Encryption in transit (TLS) for all connections
- Clinic tenant isolation — your data separated from other practices
- Role-based access control for clinicians, admins, and billers
- Audit logging for access to sensitive records
- Documented subprocessors (hosting, email, video, backups)
- Data export path if you leave the platform
PsycSuit provides a BAA overview and full Trust center for US practices.
Practice policies you must maintain
Workforce
Individual staff logins — no shared passwords. Terminate access promptly when someone leaves. Train staff on phishing, device security, and minimum necessary access.
Devices
Screen locks, disk encryption on laptops, and no PHI in personal text messages or unauthorized apps.
Client communication
Use the practice portal or approved channels — not personal email for clinical content.
Software features that support HIPAA workflows
- Automatic session timeout on staff accounts
- Optional multi-factor authentication for staff
- Portal authentication separate from staff credentials
- Soft-delete and audit trail on clinical records (not silent hard deletes)
- Consent tracking for telehealth and sensitive workflows
Common mistakes solo practices make
- Storing real client data before the BAA is executed
- Letting interns use a supervisor’s login instead of their own account
- Downloading client lists to unencrypted personal spreadsheets
- Assuming HIPAA is “handled” entirely by the vendor
- Skipping a risk assessment because the practice is small
Outside the United States
EU and UK clinics typically need a Data Processing Agreement (DPA) under GDPR rather than a HIPAA BAA. Asia-Pacific practices should align with local frameworks (APPs, PDPA, etc.). PsycSuit signs region-appropriate agreements at activation — your counsel confirms local rules.
FAQ
- Is signing a BAA enough for HIPAA compliance?
- No. The BAA covers vendor obligations; your practice still needs policies, training, individual logins, and secure device habits.
Try PsycSuit in your practice
Scheduling, clinical notes, PHQ-9 & GAD-7, billing, client portal, and telehealth in one Practice OS. Free trial after approval — no card required to apply.