Does HIPAA apply to therapists?

HIPAA applies to a therapist because of how they handle health information, not because of their job title. A therapist is bound by HIPAA if they are a covered entity, which usually means they, or a biller acting for them, send health information electronically for standard transactions such as insurance claims. A therapist is also bound if they work for an organization that is a covered entity. Therapists who fall outside HIPAA still owe clients confidentiality under state law and licensing rules, and mental health records often get stronger protection under state law than under HIPAA.

This page is general information, not legal advice. Confirm your situation with a healthcare attorney or your state licensing board. For related topics, see more guides on healthcare communication and HIPAA.

The short answer: HIPAA applies to therapists who are covered entities

HIPAA's rules apply to covered entities and their business associates. A health care provider becomes a covered entity when it transmits health information electronically in connection with a standard transaction. For therapy practices, the transactions that usually trigger coverage are:

• Submitting claims to a health plan
• Checking a client's eligibility or benefits
• Requesting claim status or receiving electronic remittance

The transaction counts even when a billing company or clearinghouse sends it for you.

Most therapists fit one of three situations:

1. You bill insurance electronically, directly or through a biller. You are a covered entity.
2. You work for a covered entity, such as a hospital, outpatient clinic, group practice or rehab center. You follow HIPAA as a member of that organization's workforce, regardless of how you personally get paid.
3. You are cash-only and never conduct standard transactions electronically. You may fall outside HIPAA. Handing a client a superbill to submit to their insurer themselves is a different situation from billing the insurer yourself. Falling outside HIPAA does not free you to share information. State confidentiality law, your licensing board's rules and your professional ethics code still apply.

Practical note: once a practice is a covered entity, HIPAA applies to all the protected health information (PHI) it holds, not only the insurance claims. A practice that bills insurance for some clients and takes cash from others protects the private-pay records under HIPAA too.

HIPAA by type of therapist

Mental health therapists (psychologists, LCSWs, LPCs, MFTs, psychiatrists). Most are covered entities because they bill insurance. Private-pay clinicians should apply the same test. A private-pay clinician inside a group practice that bills insurance follows HIPAA as part of that practice's workforce.

Physical and occupational therapists. These therapists are typically covered entities when they bill Medicare, Medicaid or commercial insurance. Medicare generally expects claims to be submitted electronically, with limited exceptions for small providers. Cash-based PT clinics should run the test before assuming they are exempt.

Massage therapists. Independent or spa-based massage therapists who take cash and never bill insurance are usually not covered entities. Coverage can still apply. A massage therapist is covered if they bill a health plan electronically. They also follow HIPAA as a workforce member when they work for a covered chiropractic, PT or medical clinic.

Therapist type	When HIPAA applies	What else applies
Psychologist, LCSW, LPC, MFT	Bills insurance electronically (directly or via biller), or works for a covered entity	State mental health confidentiality law, licensing board rules, ethics code, 42 CFR Part 2 for some SUD programs
Psychiatrist	Same test; nearly always applies in insurance-billing practices	State law, medical board rules, Part 2 where relevant
Physical / occupational therapist	Bills Medicare, Medicaid or commercial plans electronically, or works for a covered entity	State practice act, licensing board rules, APTA/AOTA ethics
Massage therapist	Bills a health plan electronically, or works as workforce in a covered clinic	State massage licensing rules, AMTA ethics, state privacy and consumer law
Cash-only clinician of any type	May not apply	State confidentiality law, licensing rules and ethics codes still apply

What HIPAA requires of a covered therapy practice

Privacy Rule. The Privacy Rule controls how PHI is used and disclosed. Treatment, payment and health care operations are generally permitted. Most other disclosures need the client's written authorization. The rule also requires:

• Sharing only the minimum necessary for most purposes
• Giving clients a Notice of Privacy Practices
• Honoring a client's right to access their records within the deadlines the rule sets

Security Rule. The Security Rule applies to electronic PHI. It starts with a documented risk analysis. The practice then puts safeguards in place in three groups:

• Administrative: policies, training and a sanctions policy
• Physical: a locked records room and front-desk screens that waiting clients can't see
• Technical: unique logins, access controls, automatic logoff and audit logs

Breach Notification Rule. After a breach of unsecured PHI, the practice notifies affected clients and HHS. Larger breaches can also require notifying the media.

Business associate agreements (BAAs). A covered practice needs a BAA with every vendor that creates, receives, stores or transmits PHI for it. Typical vendors include:

• EHR and practice management systems
• Billing services and clearinghouses
• Email, phone and voicemail providers
• Telehealth video tools and texting platforms
• Staff chat tools
• Cloud storage
• The IT provider who supports your computers

When evaluating vendors, see HIPAA compliance software compared and AI in healthcare: uses for clinic teams.

Psychotherapy notes and mental health confidentiality laws

Psychotherapy notes are a mental health professional's notes documenting or analyzing the contents of a counseling session. To qualify, they must be kept separate from the rest of the client's record. They do not include:

• Medication and prescription information
• Session start and stop times
• Treatment modalities
• Test results
• Diagnosis, treatment plan, symptoms, prognosis or progress summaries

Those items belong to the regular clinical record. Disclosing psychotherapy notes generally requires a specific authorization, with narrow exceptions. They are also generally excluded from the client's right of access. One practical point: notes typed into the same progress-note field as the rest of the record may not qualify for this extra protection.

Substance use disorder records. Records from certain federally assisted SUD treatment programs fall under 42 CFR Part 2, which has its own consent and redisclosure rules.

State law. HIPAA sets a federal floor. It does not preempt state laws that are more protective of privacy. Many states protect mental health records more strictly than HIPAA does. For example, a state may require separate client consent before sharing records with another provider.

Duty to warn or protect, and mandatory reporting. After the Tarasoff case in California, states took different approaches. Some require therapists to warn or protect when a client threatens an identifiable person, some permit it, and some have no statute. HIPAA permits certain disclosures to prevent a serious and imminent threat. Child and elder abuse reporting duties are set by state law.

Minors. The age at which a minor can consent to therapy, and whether parents can see the records, vary by state. HIPAA generally follows state law on who counts as a minor's personal representative.

Ethics codes. The APA, ACA, NASW, AMTA and APTA codes each impose confidentiality duties that apply whether or not HIPAA does. A licensing board can discipline a cash-only therapist for a breach of confidentiality even if HIPAA never applied.

Is BetterHelp HIPAA compliant?

BetterHelp's answer to this question is whatever it states publicly, including whether it describes the platform or its therapists as covered entities or business associates. Check its current privacy policy and HIPAA page rather than relying on secondhand summaries.

In 2023, the Federal Trade Commission announced an action against BetterHelp. The action concerned the company's sharing of consumers' health information with third parties for advertising. The resulting order included restrictions on how the company may share health data and money for consumer refunds; the FTC's published order sets out the exact terms. That record is a matter of the FTC's findings and the settlement terms. It is separate from the question of HIPAA status.

The platform and the individual therapist are different parties. A licensed therapist working through any online platform remains bound by state confidentiality law and licensing board rules. Whether HIPAA also applies depends on the same covered-entity and business-associate analysis described above. For more on that analysis, see how HIPAA applies to telehealth platforms.

Questions to ask any online therapy platform:

• Does the platform describe itself as a covered entity or a business associate? Will it sign a BAA (relevant if you are a practice contracting with it)?
• Is any information about me used or shared for marketing or advertising, and with whom? Can I opt out?
• Where is my data stored, and how long is it kept after I cancel?
• Who at the platform, beyond my therapist, can read my messages?
• How do I request a copy of my records, and how long does it take?

A practical HIPAA starting point for small therapy practices

1. Confirm covered-entity status. Look at how claims and eligibility checks actually leave your office, including anything your biller sends. Write down your conclusion and the reasoning behind it.

2. Appoint a privacy officer and a security officer. In a solo practice, both can be the owner.

3. Run and document a risk analysis. List every tool that touches client information:

   • EHR and scheduling
   • Billing
   • Email, phone and voicemail
   • Texting
   • Telehealth
   • Staff chat
   • Cloud storage
   • Personal phones used for work

   Confirm a signed BAA for each vendor that handles PHI. The HIPAA compliance checklist for clinics walks through the full inventory.

4. Set rules for texting and emailing clients and for staff messaging. A text that says "Move J.M.'s 3 pm anxiety follow-up to Thursday" is PHI. It doesn't belong in a personal group text. Decide which channels are approved for which content, and keep PHI out of personal messaging apps. See HIPAA rules for texting clients and staff.

5. Train everyone and document it. This includes front desk staff, billers, part-time massage therapists and temps. Train at onboarding and periodically after that, and record dates and attendees. See HIPAA training for staff.

6. Plan for devices and offboarding.

   • Require screen locks and the ability to wipe lost phones remotely.
   • Give everyone an individual login on shared front-desk computers, with automatic logoff.
   • Remove a departing clinician's access to every system on their last day, including chat groups.

Where staff communication fits

In therapy and rehab practices, PHI shows up in internal messages all day. Common examples:

• A front desk note that a client canceled and wants a later slot
• A biller asking which clinician saw a client on a disputed date
• An intake coordinator flagging missing insurance paperwork
• A therapist asking a colleague to cover a session while they're out

When these messages run through personal text threads or consumer group chats, the practice usually has no BAA with the vendor. For a covered practice, that is a gap in its safeguards.

One option is a staff chat with a BAA. HIPAA-compliant chat for practice staff like Chanty is internal team chat for practice staff. It brings chats, calls, announcements, shared files and assigned tasks into one workspace. HIPAA compliance with a signed BAA is available on the Business and Enterprise plans. The Free plan has no BAA and should not be used for PHI.

Chanty runs alongside your EHR and telehealth tools. It is not a client messaging tool, a telehealth platform, an EHR, or a place for psychotherapy notes or clinical documentation. Third-party integrations fall outside Chanty's BAA, so review each one before connecting it. See Chanty security, HIPAA and BAA details.

A BAA-backed tool supports compliance. It does not make a practice compliant on its own. Configuring roles and permissions, managing access, offboarding staff, securing devices and training staff remain the practice's responsibility.

FAQ

Are therapists bound by HIPAA if they only take cash?

They may not be, as long as they never conduct standard transactions electronically, directly or through a biller. Working for a covered entity changes that. State confidentiality law, licensing rules and ethics codes apply regardless.

Does HIPAA apply to massage therapists?

Usually not for independent, cash-only massage therapists. It does apply when a massage therapist bills a health plan electronically or works as part of the workforce of a covered clinic, such as a chiropractic or PT practice.

Does HIPAA apply to physical therapists?

Typically yes, because most PT practices bill Medicare, Medicaid or commercial insurance electronically. Cash-based PT clinics should apply the covered-entity test to their own situation.

Can a therapist share information with a client's family under HIPAA?

HIPAA permits some sharing with family members involved in a client's care. Typically this happens when the client agrees, or doesn't object when given the chance. State mental health laws are often stricter, and psychotherapy notes need specific authorization. Check your state's rules before sharing.

Are psychotherapy notes part of the medical record a client can request?

Generally no, if they meet HIPAA's definition and are kept separate from the clinical record. Diagnosis, treatment plan, session times and progress summaries are part of the record the client can access. State law may grant broader access.

Is BetterHelp HIPAA compliant?

Rely on BetterHelp's own current statement and the public record of the FTC's 2023 action. Individual therapists on any platform remain bound by state law and licensing rules.

Do state mental health confidentiality laws override HIPAA?

When a state law is more protective of privacy, it generally stands, and HIPAA does not preempt it. HIPAA preempts contrary state laws that are less protective. Practices follow whichever rule protects the client more.

Can therapists text clients under HIPAA?

HIPAA does not ban texting clients, but covered practices need reasonable safeguards. A practice may text a client who has been warned of the risks and still prefers unencrypted texts. Keep texts to logistics where possible, and use a vendor that will sign a BAA when PHI is involved.