HIPAA Compliance Requirements for Dialectical Behavior Therapy Clinics

DBT clinics often handle sensitive information about mental health, treatment, and personal circumstances. If your clinic is subject to HIPAA, you must protect that information through appropriate privacy, security, and breach-response practices. The requirements apply to the clinic’s protected health information (PHI), including electronic protected health information (ePHI), not just information created during therapy sessions.

Determine Whether Your Clinic Is a HIPAA Covered Entity

A clinic is generally a HIPAA covered entity if it is a health care provider that conducts certain standard health care transactions electronically, such as submitting electronic claims. This HIPAA covered entity definition can include clinics and individual providers, but offering DBT or another behavioral health service alone does not automatically make a clinic covered.

Consider how your clinic handles transactions such as claims, eligibility checks, and payment inquiries. If your clinic conducts a covered transaction electronically—or uses a billing service to conduct one on its behalf—it may be a covered entity. A clinic that does not qualify as a covered entity may still have obligations if it performs work involving PHI on behalf of a covered entity as a business associate.

Once you determine that HIPAA applies, identify the people, systems, and vendors that create, receive, maintain, or transmit PHI. State privacy laws and professional confidentiality rules may also apply, including when a clinic is not covered by HIPAA.

Conduct and Update an ePHI Risk Analysis

Covered clinics must conduct an electronic protected health information risk analysis to identify where ePHI is stored, received, created, or transmitted and to assess risks to its confidentiality, integrity, and availability. This includes ePHI in the electronic health record, billing systems, email, backups, telehealth platforms, and devices used for clinic work.

Document the analysis, the risks you identify, and the measures you choose to address them. Review the analysis when your clinic changes systems, adds services or locations, adopts new technologies, or identifies a security incident. Updating it regularly helps you account for changing threats and clinic operations.

A risk analysis is not a one-time checklist. Use its findings to guide risk management, assign responsibility for improvements, and track whether safeguards are working. Include vendors and remote access in your assessment when they involve your clinic’s ePHI.

Implement Administrative Physical and Technical Safeguards

The HIPAA Security Rule requires administrative, physical and technical safeguards to protect ePHI. Your clinic should select and document measures appropriate to its risks, size, and operations; no single technical measure alone establishes compliance.

• Administrative safeguards: Assign security responsibilities, train workforce members, establish access and incident-response procedures, and plan for emergencies such as system outages or data loss.
• Physical safeguards: Control access to rooms and devices containing ePHI, secure workstations, and protect equipment against theft, loss, or unauthorized viewing.
• Technical safeguards: Use individual access controls, authentication, audit logs, and appropriate protections for ePHI stored or transmitted electronically. Consider encryption as part of your security program.

Review access when staff roles change or people leave the clinic, and remove access that is no longer needed. Train staff to recognize risks such as misdirected messages, phishing, unattended screens, and inappropriate access to patient records.

Protect Psychotherapy Notes and Clinical Records

HIPAA distinguishes psychotherapy notes from the rest of a patient’s clinical record. Psychotherapy notes are a mental health professional’s separately maintained notes documenting or analyzing the contents of a counseling conversation. A diagnosis, treatment plan, medication information, symptoms, session times, and progress notes are generally not psychotherapy notes merely because they relate to therapy.

Most uses or disclosures of psychotherapy notes require a specific authorization under HIPAA, subject to limited exceptions. This HIPAA psychotherapy notes authorization requirement is generally stricter than the rules for ordinary clinical records, including in some situations involving treatment. Keep these notes separate from the general medical record and restrict access appropriately.

Apply the Privacy Rule to the clinic’s other clinical records as well. Use role-based permissions and staff training to help ensure that DBT clinicians and administrative personnel access only information appropriate to their responsibilities. Follow applicable requirements for patient access, record retention, and disclosure of the general record.

Establish Business Associate Agreements

A business associate is generally a person or organization outside your clinic’s workforce that performs a service involving PHI on the clinic’s behalf. Depending on the services and information involved, examples may include billing companies, certain IT providers, cloud storage vendors, or contractors who handle records.

Before allowing a business associate to use or disclose PHI, put a business associate agreement (BAA) in place. The agreement should describe permitted uses and disclosures, require appropriate safeguards, address incident and breach reporting, and set expectations for subcontractors and the return or destruction of PHI when the relationship ends.

Review vendor arrangements when services change, and confirm that a vendor’s actual role matches the agreement. A contract alone does not replace your clinic’s responsibility to assess risks and safeguard the PHI it maintains or shares.

Limit Uses and Disclosures of Patient Information

Use or disclose PHI only when permitted or required by HIPAA, or when the patient has provided a valid authorization where one is needed. Check that the recipient is authorized and that the information is being shared for an appropriate purpose. Apply extra care to psychotherapy notes because they generally have separate authorization requirements.

The minimum necessary standard generally requires covered entities to take reasonable steps to limit PHI used, disclosed, or requested to what is needed for the purpose. It generally does not apply to disclosures to or requests by a health care provider for treatment, or to uses and disclosures made under a valid authorization, among other exceptions.

Set policies for common clinic activities, including staff access, billing, referrals, communications, and responding to requests for records. Train staff to verify recipients and use secure channels when sharing information. When an authorization is required, confirm that it is valid and covers the specific information and disclosure.

Follow HIPAA Breach Notification Requirements

When your clinic discovers an impermissible use or disclosure of unsecured PHI, promptly contain the incident, preserve relevant information, and begin a documented assessment. An impermissible use or disclosure is generally presumed to be a breach unless an exception applies or the clinic documents a risk assessment demonstrating a low probability that the PHI was compromised.

Assess the nature and extent of the information, who received or used it, whether it was actually acquired or viewed, and what steps were taken to reduce the risk. Document the decision and the reasons for notifying—or not notifying—affected people and authorities.

If notification is required, notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. For a breach affecting 500 or more people, notify the Secretary of Health and Human Services without unreasonable delay and within that same 60-day limit; media notice may also be required for breaches affecting more than 500 residents of a state or jurisdiction. For breaches affecting fewer than 500 people, the clinic may report to the Secretary annually, no later than 60 days after the end of the calendar year in which the breach was discovered. A business associate must notify the covered clinic under the applicable rule and the BAA.

In short, a DBT clinic’s HIPAA program should establish whether the rules apply, identify and manage ePHI risks, protect records with appropriate safeguards, control access and disclosures, formalize vendor relationships, and maintain a practiced response to potential breaches.

FAQs

Does HIPAA apply to every dialectical behavior therapy clinic?

No. A DBT clinic is generally covered if it is a health care provider that conducts covered standard transactions electronically, such as electronic claims. A clinic may also have HIPAA obligations as a business associate if it handles PHI on behalf of a covered entity. Other federal, state, or professional confidentiality requirements may still apply even if HIPAA does not.

How are psychotherapy notes defined and protected under HIPAA?

Psychotherapy notes are a mental health professional’s separately maintained notes documenting or analyzing the contents of counseling conversations. They do not include ordinary clinical record information such as diagnoses, treatment plans, medication details, symptoms, or progress summaries. Most uses or disclosures require a specific patient authorization, subject to limited exceptions.

When does a DBT clinic need a business associate agreement?

A covered DBT clinic generally needs a BAA before a vendor or other outside party performs a service on its behalf that involves PHI. The agreement should define permitted uses and disclosures, require safeguards, and address reporting and other required protections. Whether a particular vendor qualifies depends on the service and its access to PHI.

What must a clinic do after discovering a breach of protected health information?

The clinic should promptly contain the incident, investigate what happened, assess whether the event is a breach of unsecured PHI, and document its decision. If notification is required, affected individuals must generally be notified without unreasonable delay and within 60 calendar days of discovery. The clinic must also notify the HHS Secretary and, when applicable, the media, following the rules for the breach’s size and circumstances.