Is TherapyNotes HIPAA‑Compliant for IOP/PHP? Compliance Checklist

Intensive Outpatient Program (IOP) and Partial Hospitalization Program (PHP) settings handle large volumes of sensitive ePHI across group sessions, medication management, and care coordination. Determining whether TherapyNotes supports HIPAA compliance for these programs requires evaluating the platform and your own processes against clear requirements.

Use this compliance checklist to confirm the safeguards, agreements, and workflows that make TherapyNotes an appropriate choice for HIPAA‑regulated IOP/PHP operations.

HIPAA Compliance Overview

HIPAA compliance in IOP/PHP rests on three pillars: Administrative, Physical Safeguards, and Technical Safeguards. TherapyNotes functions as a Business Associate, while your organization is the Covered Entity. Both parties share responsibility for protecting ePHI across intake, scheduling, documentation, billing, and telehealth.

What HIPAA requires for IOP/PHP

• Administrative safeguards: risk analysis, policies, workforce training, BA management, and incident response tailored to group-based and high-acuity services.
• Physical Safeguards: secure facilities, controlled workstation access, and device protections wherever staff document or access TherapyNotes.
• Technical Safeguards: unique user IDs, access controls, audit logs, encryption, and integrity controls spanning web, mobile, and integrated services.

Because IOP/PHP teams are multidisciplinary and fast‑paced, enforce least‑privileged access, timely deprovisioning, and tight monitoring to prevent unauthorized disclosure during handoffs and multi‑provider workflows.

Business Associate Agreement Requirements

A signed Business Associate Agreement (BAA) with TherapyNotes is mandatory before storing or transmitting ePHI. The BAA defines permitted uses and disclosures, required safeguards, breach responsibilities, and PHI return or destruction on termination.

BAA elements to verify

• Scope of services and permitted PHI uses, including IOP/PHP documentation, scheduling, billing, and telehealth features.
• Safeguards commitment covering Administrative, Physical Safeguards, and Technical Safeguards, plus subcontractor flow‑downs.
• Breach notification duties, timelines, cooperation, and evidence preservation.
• Minimum necessary standard, role‑based access expectations, and audit support.
• Data ownership, return/secure destruction procedures, and post‑termination access windows.

Store the fully executed BAA with your compliance documentation, and align your internal policies and workforce training to the BAA’s terms.

Data Encryption Protocols

Encryption protects ePHI across networks, storage, and backups. Validate TherapyNotes’ approach and document it in your risk analysis.

In transit

• SSL Encryption (TLS 1.2+ or TLS 1.3) for all browser, mobile, and API traffic, ideally with HSTS and perfect forward secrecy.
• Encrypted channels for telehealth sessions and file transfers; verify media encryption and signaling protections.

At rest

• Strong database and file storage encryption (e.g., AES‑256) for primary, replica, and backup stores.
• Key management safeguards: separation of duties, rotation, secure generation, and restricted access to key material.

Backups and portability

• Encrypted backups in transit and at rest, with tested restore procedures that maintain confidentiality and integrity.
• Secure export processes for designated record set fulfillment without exposing psychotherapy notes when not appropriate.

System Security Measures

Technical controls in TherapyNotes help enforce least privilege, prevent unauthorized access, and support investigations.

Access control and authentication

• Unique user IDs, strong password policies, and multi‑factor authentication (MFA) for all staff, especially remote or on‑call clinicians.
• Role‑based access control tuned for IOP/PHP roles (therapist, nurse, psychiatrist, biller, scheduler) with periodic access reviews.
• Automatic session timeouts, device lock requirements, and safeguards for downloads, printing, and exports.

Monitoring and resilience

• Comprehensive audit logs for logins, access, edits, and disclosures, with retention to support investigations and regulatory inquiries.
• Vulnerability management, patching cadence, web application firewalling, and DDoS protections.
• Business continuity and disaster recovery, with defined RTO/RPO and regular testing.

Data Center Security

• Hardened facilities with access controls, surveillance, environmental controls, and redundant power/network paths.
• Third‑party attestations such as SOC 2 Type II; some vendors still reference SAS 70 Type II Certification—confirm current equivalents and scope.

User Responsibilities for Compliance

Software alone does not make you compliant. Your policies and daily practices complete the protection of ePHI.

• Conduct and document a HIPAA risk analysis that includes TherapyNotes, telehealth, e‑prescribing, and integrated tools.
• Train staff on Privacy Rule, Security Rule, minimum necessary, sanctioned uses, and the nuances of group‑based IOP/PHP documentation.
• Harden endpoints: full‑disk encryption, automatic screen lock, mobile device management, no ePHI on personal email or unauthorized drives.
• Configure roles, sharing, and portal settings to avoid exposing psychotherapy notes or sensitive group details.
• Implement change control, access reviews, workforce sanctions, and incident response playbooks.
• Limit data exports, control printing, and maintain a release‑of‑information process for designated record set requests.

Psychotherapy Notes Handling

HIPAA’s Psychotherapy Notes Exemption gives these notes special protection. They are kept separate from the rest of the medical record and generally require patient authorization for use or disclosure beyond narrow exceptions.

Operational safeguards

• Maintain psychotherapy notes in a segregated area or dedicated note type with restricted access and audit logging.
• Avoid including diagnosis, medications, treatment plans, start/stop times, or session summaries in psychotherapy notes; place those in progress notes.
• Exclude psychotherapy notes from routine patient portal sharing and designated record set exports unless specifically authorized.
• For IOP/PHP group therapy, prevent cross‑patient disclosures by using templates that omit other participants’ identifiers.

Compliance Verification Processes

Verification turns assumptions into evidence and keeps your program inspection‑ready.

Due diligence checklist

• Obtain TherapyNotes’ security whitepaper, SOC 2 Type II or equivalent attestation (where available), and Data Center Security details.
• Execute the Business Associate Agreement and archive the final copy with your policies.
• Document encryption practices (SSL Encryption/TLS in transit, strong at‑rest encryption, key management) in your risk analysis.
• Review audit log capabilities, retention periods, and export options for investigations.
• Validate backup encryption, restore testing cadence, and disaster recovery objectives.
• Test role‑based access, MFA enforcement, session timeouts, and portal visibility settings using realistic IOP/PHP scenarios.
• Schedule annual reassessments, tabletop breach drills, and workforce re‑training; record outcomes and corrective actions.

Conclusion

TherapyNotes can support HIPAA compliance for IOP/PHP when paired with a signed BAA, robust encryption, strong access controls, and disciplined operational practices. Align platform settings to your policies, segregate psychotherapy notes, and keep verifiable evidence of safeguards to remain compliance‑ready.

FAQs.

What makes TherapyNotes HIPAA-compliant?

Compliance is a shared responsibility. With a signed Business Associate Agreement, properly configured role‑based access and MFA, audit logging, encryption, and documented policies and training on your side, TherapyNotes provides the Technical Safeguards and administrative support necessary to operate within HIPAA for IOP/PHP.

How does TherapyNotes secure psychotherapy notes?

Use segregated note types or storage areas with restricted access, and exclude psychotherapy notes from routine portal sharing and exports. Keep these notes separate from progress notes, apply least‑privileged access, and rely on audit logs to monitor viewing. This approach upholds the Psychotherapy Notes Exemption and reduces inappropriate disclosure risk.

Is a Business Associate Agreement needed for TherapyNotes?

Yes. Because TherapyNotes creates, receives, maintains, or transmits ePHI on your behalf, a Business Associate Agreement is required. Do not onboard live patients until the BAA is fully executed and archived with your compliance records.

How is data encryption handled in TherapyNotes?

Confirm SSL Encryption (TLS 1.2+ or TLS 1.3) for all connections and strong at‑rest encryption (such as AES‑256) across databases, files, and backups, with strict key management and tested restore procedures. Document these controls in your risk analysis to complete your compliance evidence.