HIPAA for Private Practice Therapists: What a Solo Practice Needs
By the Open My Practice team · Updated November 8, 2026 · 6 min read
When you worked for an agency, someone else handled privacy compliance. In private practice, that someone is you. HIPAA is less about any single form and more about having the right policies, agreements, and safeguards in place, and being able to show it.
Does HIPAA apply to me?
HIPAA formally applies to health care providers who conduct certain transactions electronically, such as billing insurance. Some cash-only practices fall outside that definition. But Texas has its own medical privacy law with a broader definition of who it covers, and clients, insurers, and licensing boards all expect HIPAA-level protection. Most practices treat client information as fully protected either way.
The core pieces
- Privacy policies: who can see client information, when you can share it, and how clients access their records.
- Security policies and a risk analysis: an honest look at where client information lives (your EHR, email, phone, laptop) and how it's protected.
- Business associate agreements (BAAs): signed agreements with vendors that handle client information, such as your EHR, telehealth platform, email, and cloud storage.
- A Notice of Privacy Practices: the document that tells clients how their information is used and what rights they have.
- A breach response plan: what you'll do, and who you must notify, if client information is exposed.
It isn't one-and-done
Your risk analysis and policies should be revisited regularly and whenever something changes, such as a new EHR, a new device, or a new employee. Documenting those reviews is part of compliance.
How we handle this for you
- Generates privacy and security policies and a Notice of Privacy Practices for your practice
- Keeps a list of the vendors that need business associate agreements
- Reminds you when your yearly privacy review is due
- Keeps client records out of Open My Practice entirely, so it never becomes another privacy risk
Frequently asked questions
Does a cash-only therapist need to follow HIPAA?
HIPAA's formal requirements apply to providers who conduct certain transactions electronically, like billing insurance. Texas privacy law covers a broader group, and professional ethics and client expectations call for the same protections, so most cash-pay practices follow HIPAA standards anyway.
What is a business associate agreement?
A BAA is a contract with a vendor that handles client information on your behalf, such as an EHR, telehealth, or email provider. It commits the vendor to protect that information.
Do I need a Notice of Privacy Practices?
Practices covered by HIPAA must give clients a Notice of Privacy Practices explaining how their information is used and their rights. It's standard for therapy practices to provide one at intake.
This guide is general information, not legal, tax, or financial advice. Rules change, so confirm requirements with the relevant agency or a qualified professional before acting.