HIPAA Compliance Checklist for Psychedelic-Assisted Therapy Clinics

A practical HIPAA compliance checklist for psychedelic-assisted therapy clinics starts with a clear question: does the clinic meet HIPAA’s definition of a covered entity, or does it act as a business associate? If HIPAA applies, protect patient information throughout care—from intake and therapy sessions to electronic records, staff access, and disclosures to facilitators.

Which HIPAA rules apply to psychedelic-assisted therapy clinics?

HIPAA does not apply to a clinic solely because it provides therapy. A health care provider is generally a covered entity if it transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as certain electronic billing transactions. Clinics that meet the definition must follow the HIPAA Privacy, Security, and Breach Notification Rules. See HHS guidance on who must comply with HIPAA.

The HIPAA Privacy Rule governs how covered entities may use and disclose protected health information (PHI), while the HIPAA Security Rule requires safeguards for electronic protected health information (ePHI). HIPAA also applies to business associates—outside parties that handle PHI for a covered entity in specified functions or services. A covered clinic generally needs a written business associate agreement (BAA) with such vendors. See HHS guidance on covered entities and business associates.

Use this checklist as a starting point, not as a substitute for assessing the clinic’s specific operations, applicable state law, and any other rules that may govern its services. Confirm which entity is responsible for each patient record and each vendor relationship.

How should clinics protect patient privacy during therapy sessions?

HIPAA requires covered entities to apply appropriate safeguards to protect PHI, but it does not prescribe a special room design for psychedelic-assisted therapy. As practical safeguards, hold sessions where conversations cannot readily be overheard, restrict entry to people involved in care, and prevent visitors or other patients from seeing charts, screens, or session materials.

Set a clear policy for recording, photography, and personal devices. Do not record or share session content without a valid basis under HIPAA and applicable law; when required, obtain a valid written authorization before disclosure. Limit paper notes and session materials to authorized staff, and secure or dispose of them appropriately.

Keep ordinary clinical documentation distinct from psychotherapy notes where applicable. Under HIPAA, psychotherapy notes have a narrower definition: they are a mental health professional’s notes analyzing the contents of a counseling conversation and kept separate from the medical record. They generally receive special protection and usually require the patient’s authorization for disclosure, subject to exceptions. See HHS guidance on mental health information and psychotherapy notes.

What safeguards are needed for electronic protected health information?

Start with a documented risk analysis: identify where ePHI is created, received, maintained, or transmitted; assess threats and vulnerabilities; and determine how to reduce risks to a reasonable and appropriate level. The HIPAA Security Rule requires an accurate and thorough assessment, and the clinic should revisit its analysis as systems, vendors, or risks change. See HHS guidance on Security Rule risk analysis.

Use the analysis to guide administrative, physical, and technical safeguards. For example, consider unique user accounts, strong authentication, role-based access, audit logs, secure transmission, device protections, backups, and procedures for handling security incidents. HIPAA requires appropriate safeguards, but does not prescribe one universal technology setup for every clinic. See HHS’s summary of the HIPAA Security Rule.

Review the safeguards when introducing a new electronic health record, messaging platform, cloud service, or other vendor that handles ePHI. If the vendor is a business associate, put a BAA in place and understand what it does—and does not—do: the clinic remains responsible for its own HIPAA obligations. See HHS guidance on business associates and BAAs.

How should staff training and access controls be managed?

Provide training for new workforce members on the clinic’s PHI policies and procedures as needed for their roles. HIPAA requires training for new workforce members within a reasonable period after they join and for affected staff within a reasonable period after a material policy change; it does not set a universal annual training or certificate-renewal requirement. Document required training and reinforce clinic-specific practices for therapy-session privacy, records, devices, and incident reporting. See HHS’s HIPAA audit protocol for workforce training requirements.

Give each person access appropriate to their duties, review permissions when roles change, and promptly end access when a person leaves the workforce or no longer needs it. Apply the minimum necessary standard when it applies: generally, use, disclose, or request only the PHI reasonably needed for the purpose. The standard has exceptions, including disclosures to or requests by a health care provider for treatment. See HHS guidance on the minimum necessary standard.

Assign responsibility for privacy and security oversight, and make sure staff know how to raise concerns without delaying escalation. Training completion is evidence of training; it is not, by itself, proof that the clinic or its practices comply with HIPAA.

What documentation and breach response procedures should clinics maintain?

Maintain written policies and procedures for privacy, security, access, vendor relationships, and incident response. Keep records of required assessments, actions, training, and breach decisions. HIPAA generally requires documentation to be retained for six years from its creation or the date it was last in effect, whichever is later; that rule is not a general medical-record retention period. See HHS guidance on Security Rule documentation and retention.

When staff suspect a security incident or impermissible use or disclosure, have them promptly report it to the person responsible for response. The clinic should secure affected systems, investigate what information and people may be involved, mitigate harm where possible, and document its analysis and actions. An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the clinic establishes a low probability that the PHI was compromised through the required risk assessment or an exception applies.

If notification is required, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering the breach. Notice to HHS and, in some cases, the media is also required; reporting timelines depend in part on the number of people affected. A business associate that discovers a breach must notify the covered entity without unreasonable delay and no later than 60 days after discovery. See HHS’s Breach Notification Rule guidance.

How should clinics handle disclosures to facilitators and other third parties?

Do not assume that a facilitator’s presence in a session automatically permits access to the patient’s entire record. First establish the person’s role: a clinic workforce member, a business associate, an independent health care provider, or another third party. Set permissions and safeguards accordingly, and share only what is allowed for the purpose.

If an outside facilitator performs a service for the clinic that involves PHI, the facilitator may be a business associate, in which case the clinic generally needs a BAA. If the facilitator is a health care provider and the disclosure is for treatment, HIPAA may permit the disclosure without patient authorization; not every facilitator necessarily qualifies as a health care provider, so assess the actual role and purpose. See HHS guidance on business associate relationships and HHS guidance on treatment disclosures.

For disclosures that are not otherwise permitted or required by HIPAA, obtain a valid written authorization before sharing PHI. Make the authorization specific about the information, recipient, purpose, and other required elements. Apply the minimum necessary standard when it applies, while remembering that disclosures pursuant to a valid authorization are an exception to that standard. See HHS’s summary of the HIPAA Privacy Rule.

In short, clinics should confirm whether HIPAA applies, protect PHI in both session spaces and electronic systems, train staff for their roles, document safeguards and incident handling, and assess each facilitator or vendor relationship before sharing information.

FAQs

Does HIPAA apply to psychedelic-assisted therapy clinics?

It depends on the clinic’s status and activities, not simply on the type of therapy it provides. A health care provider is generally subject to HIPAA if it conducts certain standard health care transactions electronically, and business associates that handle PHI for a covered entity may also have HIPAA obligations. See HHS’s explanation of who must comply.

Can facilitators access a patient’s protected health information?

Sometimes, but not automatically. Access or disclosure must have a permitted basis under HIPAA and be appropriate to the facilitator’s role. An outside service provider handling PHI for the clinic may need a BAA; a disclosure to a third party that is not otherwise permitted may require the patient’s valid written authorization.

What should a clinic do after a suspected data breach?

Promptly report and investigate the incident, secure affected systems, determine what PHI may have been involved, mitigate harm where possible, and document the clinic’s assessment and response. If the incident is a breach of unsecured PHI, follow the Breach Notification Rule’s applicable notification requirements and deadlines. See HHS breach response guidance.

Do psychedelic-assisted therapy clinics need a HIPAA risk analysis?

A clinic subject to the HIPAA Security Rule must conduct an accurate and thorough risk analysis of potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI. The clinic should document the analysis and use it to guide safeguards and updates; HIPAA does not prescribe a single method or a fixed schedule for repeating it. See HHS guidance on HIPAA risk analysis.