Compliance Resources for Therapy Practices
Federal confidentiality, state license rules, billing and coding, supervision records, and risk documentation in one place. Educational guides for licensed therapists, not legal advice.
START HERE
Use the right rule for the right job
Therapy compliance work fails when one guide pretends to cover every license, state, and payer. These resources separate federal confidentiality from state duties, psychologist compact rules from other license types, clinical documentation from legal advice, and CPT code selection from insurance operations.
Every guide is written for licensed mental-health clinicians: psychologists, counselors, clinical social workers, and marriage and family therapists. Product controls for Emosapien live on the security page and the HIPAA-compliant therapy notes page. Note formats live on the clinical documentation hub.
Educational content for therapists. Not legal advice, not a substitute for board rules, payer contracts, or counsel. Requirements vary by license, state, setting, and insurer.
Scope map
Five lanes, one clinical record
Federal
HIPAA, BAAs, breach response, and Part 2
State
Reporting, retention, licensure, and telehealth
Claims
CPT documentation and billing operations
Oversight
Supervision records and review systems
Safety
Risk assessment, planning, and escalation records
Start with the lane that owns the decision, then check the overlays that apply to the therapist, client, setting, and payer.
HIPAA AND FEDERAL CONFIDENTIALITY
Federal rules that shape the chart and your vendors
Practice-shaped HIPAA systems, breach triage, BAA review, whether Gmail is HIPAA compliant, and Part 2 workflows for substance use records. Draft the vendor contract from a Practice-shaped HIPAA systems, breach triage, BAA review, and Part 2 workflows for substance use records. The day-to-day safeguard pass lives on the HIPAA compliance checklist. Draft the vendor contract from a business associate agreement template, score a consumer login on is ChatGPT HIPAA compliant for client notes, compare HIPAA-compliant EHR BAA, encryption, and audit-log questions before you sign a chart vendor, and answer an employer request with a therapist work excuse letter instead of a progress note.
HIPAA for solo therapists
Day-to-day solo setup: role inventory, minimum necessary access, device workflow, BAAs, and a dated annual review checklist.
Open the guide →
HIPAA for group practices
Role and access controls for owners, clinicians, supervisors, admins, contractors, and vendors, plus hire, role-change, and exit steps with clear incident ownership.
Open the guide →
HIPAA breach notification for therapists
Educational triage path from suspected incident to risk assessment, counsel and insurer escalation, federal notice, state overlay, and closure.
Open the guide →
Business associate agreement for therapists
What to verify in a therapy-software BAA: parties, permitted uses, safeguards, subcontractors, incident notice, termination, and data return.
Open the guide →
42 CFR Part 2 for therapy practices
SUD-record confidentiality under the 2024 final rule and 2026 compliance date: consent, redisclosure, notices, breach handling, and mixed records.
Open the guide →
HIPAA-compliant email for therapists
Yes-or-no inbox card: current setup, a BAA, encryption, consent to unencrypted mail, minimum necessary content, and when to stop.
Open the guide →
HIPAA violation penalties
Civil tiers, criminal exposure, workforce snooping, and a dated sanction-policy workflow for employees and owners.
Open the guide →
HIPAA consent form sample
Optional TPO consent versus a 45 CFR 164.508 authorization, with a filled sample and a decision checklist.
Open the guide →
What is HIPAA authorization
Required elements, psychotherapy notes and marketing, and a filled authorization to review before you disclose PHI.
Open the guide →
PHI identifiers
The 18 HIPAA identifier categories in a therapy record, where they hide, and what de-identification does not promise.
Open the guide →
Notice of privacy practices
Required NPP elements, delivery and posting workflow, HHS model notices, and a printable review checklist.
Open the guide →
Therapist confidentiality statement
A filled client-facing statement covering privacy, limits, records, electronic communication, and state adaptations.
Open the guide →
STATE RULES AND CROSS-STATE PRACTICE
License and jurisdiction still decide the duty
Mandatory reporting, record retention, PSYPACT for psychologists, and interstate telehealth checks for other licenses.
Mandatory reporting laws by state
License-aware state lookup for child abuse, vulnerable-adult abuse, and imminent-risk duties, with dated primary sources per jurisdiction.
Open the guide →
RetentionTherapy records retention by state
State and credential matrix for adult and minor records, closure, transfer, destruction, and payer or federal overlays.
Open the guide →
PSYPACTPSYPACT for psychologists
E.Passport, TAP, home-state and receiving-state rules for eligible psychologists. Not a universal compact for every license type.
Open the guide →
TelehealthInterstate telehealth rules for therapists
Pre-session checklist: clinician location, client location, license type, compact status, emergency plan, consent, and payer.
Open the guide →
DutyDuty to warn vs duty to protect
How warning a named person differs from other protective steps, with Tarasoff, California Civil Code 43.92, and the HIPAA serious-threat path. Not a 50-state statute table.
Open the guide →
Billing and coding
Code selection and claim operations stay separate
Start with the CPT guides for code-level documentation. Use the insurance workflow guide for eligibility through denied-claim follow-through, including testing and crisis codes.
CPT codes for therapists
Therapy-shaped CPT reference for intake, individual, family, group, and E/M codes. Use it for code-level documentation; payer policy still sits with your contracts.
Open the guide →
CPT 96130 psychological testing
Evaluation and interpretation services, unit logic, and documentation components for authorized psychological-testing clinicians.
Open the guide →
CPT 96136 psychological testing
Qualified-professional test administration and scoring, time capture, and distinction from evaluation codes and technician work.
Open the guide →
CPT 90839 crisis psychotherapy
Crisis-session boundaries, time, medical necessity, 90840 add-on logic, and note evidence that separates crisis work from a standard 90837.
Open the guide →
Insurance billing for therapists
Claim lifecycle for therapy practices: eligibility, authorization, clearinghouse, remittance, denials, and client communication. Pair with the CPT guides when you choose codes.
Open the guide →
SUPERVISION RECORDS
Meeting notes and the system around them
Use the template for a single supervision meeting. Use the documentation guide for agreements, logs, competence plans, and storage.
Clinical supervision notes template
Privacy-aware meeting record: anonymized case reference, discussion focus, ethical and risk issues, guidance, actions, follow-up, and signatures.
Open the guide →
Clinical supervision documentation
How to run repeated supervision well: agreement, attendance log, competence plan, escalation, evaluation, storage, and board overlays.
Open the guide →
Dual relationships in therapy
Three worked cases and a blank for a second relationship that is prohibited, avoidable, or managed under the counseling ethics codes.
Open the guide →
Ethical decision making process
A one-page worksheet: facts, code, principles in tension, options, consultation, chosen action, and a review point.
Open the guide →
Multicultural counseling theory
Match MSJCC, Sue tripartite model, and identity models to one examination and one session move.
Open the guide →
Multicultural competence
Awareness, knowledge, skills, and action mapped to a session picture and one supervision prompt each.
Open the guide →
RISK AND SAFETY DOCUMENTATION
Assess, document, plan, then escalate
Broad risk framework, suicide-risk template, and Stanley-Brown safety-plan implementation after assessment. For crisis session coding, open the CPT 90839 guide.
Mental health risk assessment guide
Framework for risk domains, formulation, tool selection, documentation, escalation, supervision, safety planning, and follow-up.
Open the guide →
Stanley-Brown safety plan template guide
How to implement and document collaborative safety planning after risk assessment, with a clinician companion rather than a rebranded form.
Open the guide →
Suicide risk assessment template
Structured suicide-risk documentation template for assessment work before safety planning and crisis coding decisions.
Open the guide →
HOW TO USE THESE GUIDES
Match the duty, then check the extra rules
Start with the HIPAA guide that matches your practice shape, then open the state guide that matches your license and client location. When a payer asks for a code, open the CPT guide. When a claim stalls, open the insurance workflow guide. When risk appears, move from assessment to safety plan without treating any guide as an emergency protocol. When a new private-practice client needs a form to review and sign, open the informed consent form for counseling. When the session may be remote, the form is the telehealth consent form. When a record leaves by post, use the HIPAA certified mail guide. When a laptop or message holds PHI, the addressable decision is HIPAA encryption. When principles conflict and you need a blank before you act, use the ethical decision-making model for counseling. Before you tell a client something about your own life, run the stop rule on therapist self-disclosure. When the question is how you hold power in the room, use the cultural humility definition. When the client is naming their own people, define ethnic identity before you write the label into the note. When the conflict is a worked case rather than a blank model, open ethical issues in counseling. When the license is marriage and family therapy, open the marriage and family therapist code of ethics. When the license is social work, open the NASW code of ethics checklist. When the license is professional counseling, open the ACA ethical codes checklist.
Emosapien keeps documentation, access controls, and review workflows in one therapy console so clinicians can apply these guides without stacking five disconnected tools. The licensed clinician still owns the final record, the BAA decision, and the escalation call.
Keep compliance work next to the clinical workflow
Emosapien drafts therapy notes for clinician review, keeps access controls visible, and supports BAA-ready plans for practices that handle PHI.