HIPAA for Behavioral Health: Practical Checklist

What does HIPAA compliance mean for behavioral health?

HIPAA work is broader than cybersecurity. Depending on the organization’s role and activities, it can include controlling uses and disclosures of PHI, operating individual-rights and complaint processes, maintaining required notices and documentation, training and sanctioning workforce members, safeguarding ePHI, managing business-associate relationships, and responding to potential breaches. The Privacy Rule, Security Rule, and Breach Notification Rule supply different parts of that work; not every duty applies identically to every organization.

Some SUD patient records are also governed by 42 CFR Part 2. Part 2 status does not follow from a behavioral-health label alone: document the program or activity involved, the records, the recipient, and the contemplated use or disclosure. Keep that applicability analysis distinct from the HIPAA role analysis.

A maintained HIPAA work-plan checklist

Use the areas below as a working register, first recording which items apply to the organization’s role and activities. Give each applicable item an owner, supporting evidence, review trigger, open findings, and remediation status.

Privacy governance, notices, and records

For a covered entity, identify the privacy official and the contact responsible for complaints, keep applicable policies and procedures current, and maintain the required notice workflow. 45 CFR 164.520 sets the Notice of Privacy Practices requirements, while 45 CFR 164.530 addresses administrative requirements including complaints, sanctions, mitigation, policies, and documentation. Its documentation provision generally requires covered records to be retained for six years from creation or from when the document was last in effect, whichever is later. An operational register should therefore name each required record, its custodian, retention start point, storage location, and retrieval method.

Uses, disclosures, and individual requests

Build a disclosure matrix around actual workflows: referrals, care coordination, billing, family communications, legal requests, health-information exchange, and patient-authorized disclosures. For each, record the purpose, sender, recipient, PHI involved, authority or authorization, conditions, and whether the minimum-necessary standard applies; HIPAA’s general use-and-disclosure rule and minimum-necessary provisions appear in 45 CFR 164.502 and 164.514. Covered entities should also operate tracked intake and response processes for applicable requests involving restrictions or confidential communications under 164.522, access under 164.524, amendment under 164.526, and accountings under 164.528.

Business associate agreements (BAAs)

A business associate generally performs specified functions or services for a covered entity involving PHI, but the result depends on the function, relationship, and regulatory exclusions. Inventory vendors and partners that create, receive, maintain, or transmit PHI for covered functions; record the analysis for each relationship; and use the written assurances described in HHS business-associate contract guidance when required. Track agreement execution, required amendments, termination handling, and any subcontractor follow-up as separate work items.

Workforce training

Create a training matrix that maps workforce roles to the privacy policies, security practices, systems, and disclosure workflows they use. The Privacy Rule requires training as necessary and when material policy changes affect workforce functions, while the Security Rule requires a security-awareness and training program with periodic security updates; see 45 CFR 164.530(b) and 164.308(a)(5). Define triggers rather than assuming one curriculum fits every role. A material policy, role, system, threat, or incident-driven change should prompt review of affected training, and completion should be documented.

Security risk management, safeguards, and resilience

Map where ePHI is created, received, maintained, or transmitted, including the EHR, billing services, email, backups, endpoints, telehealth tools, and interfaces. Use that inventory in the organization’s Security Rule risk analysis, then record risk-treatment decisions, owners, implementation status, and closure evidence.

Risk analysis does not replace review of the Security Rule’s individual standards. For operations subject to the rule, work through the administrative safeguards in 45 CFR 164.308, physical safeguards in 164.310, and technical safeguards in 164.312. Under 45 CFR 164.306(d), a required implementation specification must be implemented. For an addressable specification, assess whether it is reasonable and appropriate in the organization’s environment; implement it when it is, or document why it is not and implement an equivalent alternative measure when reasonable and appropriate.

Turn those decisions into reviewable work. Connect account provisioning, modification, and removal to workforce changes; review audit information; document integrity, authentication, and transmission-control decisions; inspect facility, workstation, device, and media controls; and exercise the applicable backup, restoration, emergency-operation, and security-incident handoffs. Record the scope and result of each test so that a successful test supports the specified control without being treated as a conclusion about the entire compliance program.

Breach notification procedures

Use one intake path for suspected compromises of PHI, with steps to contain the event, preserve relevant information, identify affected systems and recipients, and assign follow-up. Create linked but distinct records for security-incident handling and breach assessment. For a suspected security incident involving ePHI, document the identification, response, mitigation, and outcome required by 45 CFR 164.308(a)(6). When PHI may have been compromised, apply the definitions, exceptions, assessment, recipients, and timing described in the HHS Breach Notification Rule summary; duties differ for covered entities and business associates, and the notification rule applies to breaches of unsecured PHI. Preserve the facts considered, determination, approvals, and any notifications. Exercise the handoffs with a plausible scenario, such as client information sent to the wrong recipient, and convert observed failures into owned remediation items.

How HIPAA and 42 CFR Part 2 intersect

A provider may have obligations under both HIPAA and Part 2, but Part 2 coverage depends on the program or activity, federal involvement, records, and contemplated use or disclosure. HHS explains that the 2024 final rule aligned selected Part 2 provisions with HIPAA and set February 16, 2026 as the compliance date for persons subject to its applicable requirements. Use the current HHS Part 2 fact sheet for the distinctions below, then document how they apply to the specific workflow.

Do not infer Part 2 status from a mental-health, behavioral-health, or SUD service label. For each SUD-related workflow, keep a decision record identifying the program or activity, the records, the proposed recipient and purpose, the consent or other authority relied upon, and any restriction that must follow the records. Translate that decision into release-of-information instructions, role permissions, templates, and staff training, then test the configured workflow with a non-production example.

Where the EMR fits

Your EMR is one part of your privacy and security program. our EMR includes configurable templates, treatment plans, progress notes, and a client portal with secure messaging. Work with our team and your privacy lead to review who can view or change records, how access changes are administered, which activity can be reviewed, how exports support individual requests, how release restrictions are handled, and which integrations receive data. Document the controls and operating responsibilities your organization must maintain.