Compliance Resources for Therapy Practices
Federal confidentiality, state license rules, billing and coding, supervision records, and risk documentation in one place. Educational guides for licensed therapists, not legal advice.
START HERE
Use the right rule for the right job
Therapy compliance work fails when one guide pretends to cover every license, state, and payer. These resources separate federal confidentiality from state duties, psychologist compact rules from other license types, clinical documentation from legal advice, and CPT code selection from insurance operations.
Every guide is written for licensed mental-health clinicians: psychologists, counselors, clinical social workers, and marriage and family therapists. Product controls for Emosapien live on the security page and the HIPAA-compliant therapy notes page. Note formats live on the clinical documentation hub.
Educational content for therapists. Not legal advice, not a substitute for board rules, payer contracts, or counsel. Requirements vary by license, state, setting, and insurer.
Scope map
Five lanes, one clinical record
Federal
HIPAA, BAAs, breach response, and Part 2
State
Reporting, retention, licensure, and telehealth
Claims
CPT documentation and billing operations
Oversight
Supervision records and review systems
Safety
Risk assessment, planning, and escalation records
Start with the lane that owns the decision, then check the overlays that apply to the therapist, client, setting, and payer.
HIPAA AND FEDERAL CONFIDENTIALITY
Federal rules that shape the chart and your vendors
Practice-shaped HIPAA systems, breach triage, BAA review, and Part 2 workflows for substance use records.
HIPAA for solo therapists
Day-to-day solo setup: role inventory, minimum necessary access, device workflow, BAAs, and a dated annual review checklist.
Open the guide →
HIPAA for group practices
Role and access controls for owners, clinicians, supervisors, admins, contractors, and vendors, plus hire, role-change, and exit steps with clear incident ownership.
Open the guide →
HIPAA breach notification for therapists
Educational triage path from suspected incident to risk assessment, counsel and insurer escalation, federal notice, state overlay, and closure.
Open the guide →
Business associate agreement for therapists
What to verify in a therapy-software BAA: parties, permitted uses, safeguards, subcontractors, incident notice, termination, and data return.
Open the guide →
42 CFR Part 2 for therapy practices
SUD-record confidentiality under the 2024 final rule and 2026 compliance date: consent, redisclosure, notices, breach handling, and mixed records.
Open the guide →
STATE RULES AND CROSS-STATE PRACTICE
License and jurisdiction still decide the duty
Mandatory reporting, record retention, PSYPACT for psychologists, and interstate telehealth checks for other licenses.
Mandatory reporting laws by state
License-aware state lookup for child abuse, vulnerable-adult abuse, and imminent-risk duties, with dated primary sources per jurisdiction.
Open the guide →
RetentionTherapy records retention by state
State and credential matrix for adult and minor records, closure, transfer, destruction, and payer or federal overlays.
Open the guide →
PSYPACTPSYPACT for psychologists
E.Passport, TAP, home-state and receiving-state rules for eligible psychologists. Not a universal compact for every license type.
Open the guide →
TelehealthInterstate telehealth rules for therapists
Pre-session checklist: clinician location, client location, license type, compact status, emergency plan, consent, and payer.
Open the guide →
Billing and coding
Code selection and claim operations stay separate
Start with the CPT guides for code-level documentation. Use the insurance workflow guide for eligibility through denied-claim follow-through, including testing and crisis codes.
CPT codes for therapists
Therapy-shaped CPT reference for intake, individual, family, group, and E/M codes. Use it for code-level documentation; payer policy still sits with your contracts.
Open the guide →
CPT 96130 psychological testing
Evaluation and interpretation services, unit logic, and documentation components for authorized psychological-testing clinicians.
Open the guide →
CPT 96136 psychological testing
Qualified-professional test administration and scoring, time capture, and distinction from evaluation codes and technician work.
Open the guide →
CPT 90839 crisis psychotherapy
Crisis-session boundaries, time, medical necessity, 90840 add-on logic, and note evidence that separates crisis work from a standard 90837.
Open the guide →
Insurance billing for therapists
Claim lifecycle for therapy practices: eligibility, authorization, clearinghouse, remittance, denials, and client communication. Pair with the CPT guides when you choose codes.
Open the guide →
SUPERVISION RECORDS
Meeting notes and the system around them
Use the template for a single supervision meeting. Use the documentation guide for agreements, logs, competence plans, and storage.
Clinical supervision notes template
Privacy-aware meeting record: anonymized case reference, discussion focus, ethical and risk issues, guidance, actions, follow-up, and signatures.
Open the guide →
Clinical supervision documentation
How to run repeated supervision well: agreement, attendance log, competence plan, escalation, evaluation, storage, and board overlays.
Open the guide →
RISK AND SAFETY DOCUMENTATION
Assess, document, plan, then escalate
Broad risk framework, suicide-risk template, and Stanley-Brown safety-plan implementation after assessment. For crisis session coding, open the CPT 90839 guide.
Mental health risk assessment guide
Framework for risk domains, formulation, tool selection, documentation, escalation, supervision, safety planning, and follow-up.
Open the guide →
Stanley-Brown safety plan template guide
How to implement and document collaborative safety planning after risk assessment, with a clinician companion rather than a rebranded form.
Open the guide →
Suicide risk assessment template
Structured suicide-risk documentation template for assessment work before safety planning and crisis coding decisions.
Open the guide →
HOW TO USE THESE GUIDES
Match the duty, then check the extra rules
Start with the HIPAA guide that matches your practice shape, then open the state guide that matches your license and client location. When a payer asks for a code, open the CPT guide. When a claim stalls, open the insurance workflow guide. When risk appears, move from assessment to safety plan without treating any guide as an emergency protocol.
Emosapien keeps documentation, access controls, and review workflows in one therapy console so clinicians can apply these guides without stacking five disconnected tools. The licensed clinician still owns the final record, the BAA decision, and the escalation call.
Keep compliance work next to the clinical workflow
Emosapien drafts therapy notes for clinician review, keeps access controls visible, and supports BAA-ready plans for practices that handle PHI.