HIPAA Risk Analysis for a Mental Health Practice

Mental health practices carry extra Privacy Rule obligations, but the Security Rule applies the same

A behavioral health practice is a covered entity under HIPAA whenever it transmits health information in electronic form for a HIPAA standard transaction (eligibility, claims, authorization). The Security Rule at 45 CFR Part 164 Subpart C then requires a written, dated risk analysis under 164.308(a)(1)(ii)(A)(1)(ii)(A)).

Therapists, psychologists, and psychiatry practices often assume the rule applies less strictly to them. It does not. The Security Rule's safeguard requirements are identical to those for primary care, and OCR's Resolution Agreements include behavioral health entities cited for absent or inadequate risk analyses.

Psychotherapy notes are a Privacy Rule concept, not a Security Rule exemption

A common confusion: psychotherapy notes have heightened protection under the Privacy Rule. The definition at 45 CFR 164.501 limits them to notes recorded by a mental health professional documenting a private counseling session that are kept separate from the rest of the medical record. Authorization for disclosure follows 164.508(a)(2)(2)).

That regime governs use and disclosure. It does not waive the Security Rule. Electronic psychotherapy notes are still ePHI and must be protected by the same administrative, physical, and technical safeguards as any other ePHI. The risk analysis must address them explicitly: where they live, who has access, how they are encrypted, how access is logged.

ePHI inventory for a typical behavioral health practice

Behavioral health practices tend to carry a different system mix than primary care:

• An EHR built for behavioral health (TherapyNotes, SimplePractice, TheraNest, ICANotes, Valant)
• A general EHR for psychiatry that supports e-prescribing controlled substances (EPCS) via Surescripts
• Telehealth video sessions (Doxy.me, SimplePractice video, Zoom for Healthcare)
• Secure intake and screening forms (PHQ-9, GAD-7, intake questionnaires)
• Outcomes measurement platforms
• Group therapy management tools
• Billing clearinghouse and superbill workflows for out-of-network patients
• Personal phone and voicemail used for client contact
• Files containing release-of-information requests, court orders, custody documents

Each item is a row in the inventory with a clear ePHI flow and a Business Associate Agreement reference under 45 CFR 164.504(e)).

Threat scenarios that hit behavioral health hardest

Some risks are over-represented in this specialty:

• A solo practitioner working from home, with the same laptop used for personal browsing
• Intake forms filled out on tablets in the lobby with the screen visible from adjacent seats
• Telehealth conducted from spaces with imperfect acoustic privacy
• Group therapy participant lists shared via email
• Family members accessing a shared computer used for practice notes
• Lost or stolen phones containing voicemail and text messages from clients
• Personal text messages used for appointment reminders that contain identifying details
• Cloud document services (Google Drive, Dropbox, iCloud) used without a BAA
• Voicemail transcription services that route content through third parties
• AI scribing or session-summary tools that send audio to vendors with no BAA

For each scenario the analysis records the threat, likelihood, impact, current safeguard, and residual risk. The methodology comes from NIST SP 800-30, applied as described in NIST SP 800-66 r2.

Telehealth deserves its own subsection

The HHS Telehealth and HIPAA page confirms that the COVID-era enforcement discretion ended August 9, 2023. Behavioral health practices that adopted consumer video tools during the public health emergency need to revisit whether each platform offers a Business Associate Agreement and meets the Security Rule's transmission security and access control standards at 164.312(c) and (e).

State law often layers on top of HIPAA

State mental health confidentiality statutes frequently impose stricter standards. The risk analysis remains a federal HIPAA artifact, but the practice should note where state law triggers additional safeguards or disclosure restrictions. 45 CFR 160.203 controls preemption analysis.

Special-category data: substance use disorder records

If the practice provides substance use disorder treatment that meets the definition of a Part 2 program, 42 CFR Part 2 applies in addition to HIPAA. The HHS 2024 final rule aligned several Part 2 requirements with HIPAA but kept higher consent protections. The SRA should note Part 2 applicability and the additional controls that flow from it.

Building a defensible record

A behavioral health SRA binder typically includes:

• An ePHI inventory with psychotherapy-note location called out separately
• A threat and vulnerability list with likelihood and impact ratings
• A safeguard inventory tied to each Security Rule standard at 164.308, 164.310, and 164.312
• A risk register with residual risk and remediation plan
• Documented decisions on addressable specifications
• A telehealth and BAA review record
• Sign-off by the Security Official
• A re-evaluation schedule per 164.308(a)(8)(8))

How D3rx supports this

D3rx SRA Binder Studio is a documentation aid for behavioral health practices doing this themselves. It walks each Security Rule specification in plain English, prompts for psychotherapy-note handling, surfaces telehealth and Part 2 considerations when relevant, and assembles a binder linked back to the underlying HHS, OCR, eCFR, and NIST sources. It is a point-in-time assessment aid; the practice remains responsible for the substance of every answer.

Next steps

See where your practice currently stands with the free 5-question readiness check, or review the full workflow and pricing on the main SRA page.