HIPAA Compliance Checklist for Christian Counseling Practices

A Christian counseling practice can combine clinical care, spiritual support, and church-based services. HIPAA compliance depends on the practice’s activities and how it handles health information—not simply on whether it is faith-based.

Use this checklist to assess your obligations, protect client information, and create procedures suited to your practice. HIPAA is a federal baseline; state privacy, counseling, and records laws may impose additional requirements.

Determine HIPAA Applicability

• Assess whether your practice is a covered entity. A counseling practice may be a covered health care provider if it conducts certain standard health care transactions electronically, directly or through another organization. Electronic scheduling or storing records alone does not necessarily make a practice a covered entity.
• Make a covered entity determination for the organization. Consider who provides counseling, how services are billed, whether the practice sends claims or eligibility inquiries electronically, and whether a billing service conducts transactions on its behalf.
• Distinguish clinical care from pastoral support. A church or clergy member providing spiritual support is not automatically covered by HIPAA just because the conversations involve emotional or personal concerns. A separate clinical practice may have HIPAA obligations if it meets the covered-entity test.
• Map organizational boundaries. If a church operates both counseling and ministry programs, identify which people, services, systems, and records belong to the health care component. Where applicable, document any hybrid-entity structure and limit access between components.
• Check other applicable rules. State law, professional licensing rules, confidentiality duties, and special federal protections for certain records may apply even when HIPAA does not.

Document the determination and revisit it when you change billing practices, services, ownership, or how information is handled. Practices that are not covered entities may still choose to follow HIPAA-aligned safeguards and must comply with other applicable privacy laws.

Establish Privacy Policies and Client Rights

• Prepare a Notice of Privacy Practices. If HIPAA requires one, explain in plain language how your practice may use and disclose protected health information (PHI), your privacy duties, client rights, and how clients can contact you or submit a complaint. Include the effective date, make the notice available, and post it on the practice website if required.
• Explain client rights and procedures. Give staff clear steps for handling requests to access or amend records, obtain an accounting of certain disclosures, request restrictions, or receive communications by an alternative method.
• Record notice delivery appropriately. Ask clients to acknowledge receipt when required, but do not treat that acknowledgement as permission for every use or disclosure. Keep a record if a client declines to acknowledge receipt.
• Separate treatment consent from authorization. A general consent to counseling is not a substitute for a valid HIPAA authorization when an authorization is required, such as for many disclosures of psychotherapy notes.
• Set rules for family and church contacts. Do not assume that a spouse, parent, pastor, prayer group, or church administrator may receive information because of their relationship to the client. Follow applicable law and document the client’s permission or the legal basis for a disclosure.
• Review notices and policies when practices change. Update and distribute the Notice of Privacy Practices as required when material privacy practices change. If special rules apply to records such as substance-use-disorder records, address those requirements too.

Implement Administrative Physical and Technical Safeguards

• Complete an electronic protected health information risk analysis. Identify where electronic PHI is created, received, stored, and transmitted, including in counseling software, email, laptops, phones, backups, and vendor systems. Assess likely threats and vulnerabilities, their potential impact, and the safeguards needed to reduce risk.
• Document and act on risks. Keep the analysis and a corrective-action plan. Reassess when systems, services, locations, vendors, or threats change, and evaluate whether safeguards continue to work.
• Protect physical records and workspaces. Lock file cabinets and offices, secure devices, position screens away from public view, use private spaces for sessions, and prevent visitors or other clients from seeing records or overhearing conversations.
• Control electronic access. Give each user a unique account and only the access needed for their duties. Use strong authentication, promptly remove access when someone leaves or changes roles, and review access periodically.
• Secure devices and transmissions. Use appropriate encryption, secure connections, automatic screen locks, updates, malware protection, and audit logging. Protect phones and laptops used for work, and have a process for lost or stolen devices.
• Prepare for outages and emergencies. Maintain secure backups and written procedures to restore information and continue essential operations after a system failure, cyberattack, or physical emergency.
• Handle paper and electronic disposal securely. Shred paper records and securely dispose of or reuse electronic media so that PHI cannot be accessed by unauthorized people.

Train Staff and Assign Compliance Responsibilities

• Assign privacy and security responsibility. Name a person responsible for privacy procedures and a person responsible for security processes. In a small practice, one person may fill both roles, but responsibilities and escalation steps should be clear.
• Train everyone who handles client information. Include clinicians, administrative staff, interns, volunteers, contractors, and other workforce members as applicable. Cover confidentiality, secure record handling, access rules, client rights, and incident reporting.
• Make training practical for counseling settings. Use examples such as a family member asking for details, a pastor requesting an update, a client’s name appearing on a waiting-room sign-in sheet, or a confidential message left on a shared phone.
• Document training and policy acknowledgements. Keep records of who received training, when it occurred, and whether staff reviewed relevant policies. Provide additional training when procedures change or an incident reveals a gap.
• Set consequences and reporting expectations. Explain that inappropriate access or disclosure must be reported promptly and may result in corrective action under the practice’s policies.

Manage Vendors and Secure Client Communications

• Identify vendors that handle PHI on your behalf. Review electronic health record, telehealth, cloud storage, billing, transcription, and IT support arrangements. A vendor may be a business associate when it performs services involving PHI for a covered practice.
• Execute a business associate agreement when required. The agreement should define permitted uses and disclosures, require appropriate safeguards, address incident reporting and subcontractors, and specify what happens to PHI when the relationship ends.
• Do not assume every vendor is a business associate. Assess what the vendor actually does and what information it can access. Document the decision and ask for appropriate privacy and security protections even when a business associate agreement is not required.
• Use secure communication practices. Verify the recipient before sending information, limit sensitive details in subject lines and voicemail, and use secure messaging or portals when appropriate. Avoid discussing identifiable client information in public or through personal accounts and devices.
• Respect client communication preferences. Ask clients how they can safely be contacted, document reasonable requests for confidential communications, and explain any limits of the communication method they choose.
• Check telehealth privacy. Use a platform and setup appropriate to the information involved, confirm who is present at each end of a session, and ask clients to choose a private location when possible.

Apply Minimum Necessary Disclosure and Protect Spiritual Care Records

• Apply the minimum necessary standard where it applies. For many uses, disclosures, and requests involving PHI, limit information to what is reasonably needed for the purpose. Create role-based access rules and check the recipient’s need before sharing.
• Know the exceptions. The standard generally does not apply to disclosures to or requests by a health care provider for treatment, disclosures to the client, or disclosures made under a valid authorization, among other exceptions. Do not treat these exceptions as a reason to share information casually.
• Protect psychotherapy notes separately. HIPAA gives special protection to a narrow category of notes documenting or analyzing counseling conversations that are kept separate from the rest of the clinical record. Many uses or disclosures require a specific psychotherapy notes authorization, subject to limited exceptions.
• Do not label ordinary clinical documentation as psychotherapy notes. Diagnoses, treatment plans, symptoms, progress summaries, medication information, and other information maintained in the medical record generally are not psychotherapy notes under HIPAA’s definition.
• Keep clinical and pastoral records clearly managed. Establish who may create, view, and disclose clinical records versus ministry or pastoral-care notes. If identifiable health information is maintained by a covered practice, assess whether it is PHI rather than assuming a religious label removes HIPAA protections.
• Share with clergy only on a proper basis. Before disclosing client information to a pastor or church staff member, confirm that the disclosure is permitted and limited to what is needed. Obtain a valid authorization when required, including for psychotherapy notes.

Prepare Breach Response and Maintain Compliance Documentation

• Report and contain suspected incidents promptly. Tell staff how to contact the privacy or security lead. Preserve relevant messages, logs, and devices; stop ongoing unauthorized access where possible; and document what happened without destroying evidence.
• Assess whether a breach occurred. Investigate the nature and extent of the information, who received or accessed it, whether it was actually acquired or viewed, and what mitigation is possible. Document the assessment and decision.
• Meet HIPAA breach notification deadlines when required. For a breach of unsecured PHI, affected individuals generally must be notified without unreasonable delay and no later than 60 days after discovery. Reporting to the Department of Health and Human Services, and in some cases the media, depends on the number of people affected and other requirements.
• Coordinate with business associates. Require vendors to alert the practice promptly about incidents so the practice has time to assess the event and meet any notification duties.
• Keep compliance records. Maintain current policies, training records, risk analyses, vendor agreements, authorizations, incident assessments, and notices. Retain HIPAA-required documentation for at least six years, subject to longer state or professional retention rules.
• Review and improve after incidents. Identify the cause, make corrective changes, update training or safeguards, and record the steps taken.

Summary: Start with a documented covered entity determination, then build clear privacy procedures, safeguards, staff responsibilities, vendor agreements, and breach-response steps. Protect clinical and spiritual care information with careful access and disclosure practices, and review the program regularly as your services and systems evolve.

FAQs

Does HIPAA apply to a faith-based counseling practice?

It can. A practice’s religious affiliation does not by itself determine HIPAA status. A counseling practice may be a covered entity if it provides health care and conducts specified standard transactions electronically, directly or through another organization. A church or clergy member offering pastoral support is not automatically covered solely because the conversations involve personal or emotional concerns. Assess the practice’s actual services, transactions, and structure, and check other applicable privacy laws.

What should a Notice of Privacy Practices include for counseling clients?

When HIPAA requires a notice, it should explain in plain language how the practice may use and disclose PHI, its privacy duties, clients’ rights and how to exercise them, and how clients can contact the practice or make a complaint. It should have an effective date and be made available as required. Counseling practices should also explain applicable protections for psychotherapy notes and avoid suggesting that an acknowledgement of receipt is a blanket authorization.

When does a counseling practice need a business associate agreement?

A covered practice generally needs a business associate agreement when an outside person or organization performs services on its behalf that involve creating, receiving, maintaining, or transmitting PHI. Common examples may include billing, electronic record hosting, cloud storage, or certain technology support. Determine the vendor’s actual role and access; not every service provider is a business associate.

How should a practice respond to a suspected breach of client information?

Promptly report and contain the incident, preserve relevant evidence, and notify the practice’s privacy or security lead. Investigate what information was involved, who may have accessed it, whether it was acquired or viewed, and what mitigation is possible. Document the assessment and determine whether HIPAA notifications are required. If notification is required, follow the applicable deadlines, including the general 60-day outer limit for notifying affected individuals about a breach of unsecured PHI.