Short answer: Yes. Therapists, psychologists, and other mental health providers are covered entities under HIPAA when they transmit health information electronically for billing or other standard transactions, just like any other health care provider. But mental health practices have one important wrinkle the rest of medicine doesn't: HIPAA gives psychotherapy notes a distinct, higher level of protection than the rest of a patient's medical record.
The baseline: therapists are covered like any other provider
If you bill insurance electronically, use practice management or EHR software, or communicate with clients or other providers electronically, you meet the standard definition of a covered entity. This applies to solo practitioners and group practices alike, regardless of licensure type — psychologists, licensed clinical social workers, licensed professional counselors, and psychiatrists are all subject to the same Security Rule requirements as any medical provider: risk assessment, policies, training, business associate agreements, and audit-ready documentation.
The part that's genuinely different: psychotherapy notes
HIPAA defines "psychotherapy notes" narrowly and specifically — they're the personal notes a mental health provider keeps documenting or analyzing the content of a counseling session, kept separate from the rest of the medical record. This is distinct from things like medication logs, treatment plans, diagnoses, symptoms, or session start and stop times, which are treated as regular parts of the medical record, not psychotherapy notes.
These notes get extra protection under HIPAA specifically because of their sensitivity:
- They generally require a separate, specific patient authorization to be disclosed, even for purposes that would otherwise be permitted for the rest of the record (like routine treatment coordination in some circumstances).
- They must be kept physically or logically separate from the rest of the patient's medical record.
- Even insurers generally can't require disclosure of them as a condition of payment, unlike much of the rest of a medical record.
Why this distinction matters practically
A lot of therapists conflate "my session notes" broadly with "psychotherapy notes" in the specific HIPAA sense, when in practice, much of what a therapist documents (diagnosis, treatment plan, medications, session dates) doesn't meet the narrow legal definition and is treated as regular PHI, not the special category. Getting this distinction right matters for how you store, separate, and disclose different parts of a client's record — treating everything as equally protected psychotherapy notes can create unnecessary friction, while treating genuinely protected notes as ordinary PHI is a real compliance risk.
What this means for your compliance program
Beyond the standard risk assessment, policies, training, and BAA requirements every practice needs, a mental health practice specifically needs a clear, written understanding of what does and doesn't count as psychotherapy notes under HIPAA, and a documented process for keeping those notes appropriately separated and protected.
Getting this right for your practice
If you're a therapist, psychologist, or other mental health provider trying to sort out where your practice actually stands — including the psychotherapy notes distinction — Truvidence's free risk assessment is built for independent practices navigating exactly this kind of nuance.