HIPAA compliant email for therapists starts with a business associate agreement (BAA), the contract HIPAA requires with any vendor that handles a practice’s protected health information (PHI), plus required audit controls and a documented decision on encryption. Mental health practices also handle two categories with stricter rules: psychotherapy notes, which generally need the patient’s authorization before disclosure, and substance use disorder records covered by 42 CFR Part 2.
What counts as HIPAA compliant email for therapists?
For a therapy practice, HIPAA compliant email means email the practice has brought under the HIPAA Security Rule, the federal safeguards for electronic PHI, with a signed BAA from every vendor that handles PHI. That covers a risk analysis that includes email, unique user IDs, required audit controls and activity review, staff training, and a documented decision on encryption.
Encryption is addressable, which means the practice must assess it and either adopt it, adopt an equivalent, or document why neither is reasonable (45 CFR 164.306(d)(3)). The assessment matters, because properly encrypted PHI that is lost does not trigger breach notification.
A solo therapist carries the same requirements as a group practice, with the flexibility 164.306(b)(2) allows for “the size, complexity, and capabilities” of the practice and “the costs of security measures.” The solo clinician is usually also the security official that 164.308(a)(2) requires every practice to name.
The technical safeguards in the table are set out in 45 CFR 164.312.
Are psychotherapy notes treated differently under HIPAA?
Yes. Psychotherapy notes are notes a mental health professional records “documenting or analyzing the contents of a conversation during a private counseling session” and keeps separate from the rest of the record (45 CFR 164.501). A practice generally must obtain the patient’s authorization before disclosing them, even to another provider for treatment (164.508(a)(2)).
The definition excludes medication information, session times, treatment frequencies, clinical test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress, so those items follow the ordinary rules. HHS FAQ 2088 on mental health information and psychotherapy notes notes exceptions for disclosures the law requires, such as mandatory abuse reporting and duty-to-warn situations.
In practice, psychotherapy notes should not travel with routine correspondence. When a patient authorizes disclosure, the notes and the signed authorization can go to the receiving provider together in one encrypted message.
Who does a therapy practice exchange PHI with by email?
Most therapy practices exchange PHI with referring physicians and psychiatrists, other treating providers, insurers and other payers, billing services, and, with the patient’s authorization, attorneys or schools. Each exchange belongs in the risk analysis, and each vendor that stores or transmits PHI for the practice needs a BAA.
Clinical supervisors and group practice partners also trade case information. When those emails contain PHI, the same Security Rule safeguards apply.
Does a solo therapist need a BAA with an email provider?
Yes. Any vendor that creates, receives, maintains or transmits PHI for the practice is a business associate, whatever the size of the practice. HHS guidance on HIPAA and cloud computing says a cloud provider that stores electronic PHI is a business associate “even if it does not hold a decryption key and therefore cannot view the information.”
A BAA must require the vendor to comply with the Security Rule for electronic PHI, report breaches of unsecured PHI, and pass the same terms down to subcontractors (164.504(e)(2), 164.314(a)(2)(i)). PreVeil signs a BAA with healthcare practices, including behavioral health practices.
When does 42 CFR Part 2 apply to a counseling practice?
Part 2 applies when a counseling practice is a Part 2 program, defined in 42 CFR 2.11 as a federally assisted program that provides substance use disorder (SUD) diagnosis, treatment or referral for treatment, or when it receives Part 2 records as a lawful holder, meaning a person or organization that received the records through the patient’s consent or another disclosure Part 2 permits and is bound by Part 2’s limits on them. A general therapy practice is often outside Part 2 but should confirm with counsel.
Where Part 2 applies, each disclosure made with consent needs the notice in 42 CFR 2.32, and breaches of unsecured Part 2 records follow the HIPAA breach notification rules under 2.16(b). Part 2 names no encryption technology. PreVeil supports Part 2 confidentiality and signs a qualified service organization agreement (QSOA), the Part 2 counterpart to a BAA. The guide to 42 CFR Part 2 for email and file sharing covers what has to travel with the record.
What happens if a therapist’s mailbox is compromised?
If the mailbox held unsecured PHI, the practice must assess the breach under the four factors in 164.402 and, unless the assessment shows a low probability of compromise, notify affected patients within 60 calendar days of discovery (164.404(b)). If the PHI was encrypted consistent with HHS guidance, notification is not required.
The HHS guidance to render unsecured PHI unusable, unreadable, or indecipherable adds that decryption tools “should be stored on a device or at a location separate from the data they are used to encrypt or decrypt.” PreVeil works that way. PreVeil cannot access or decrypt customer data, because the encryption keys stay on users’ devices, so message contents and attachments stored on PreVeil’s servers stay encrypted if those servers are breached. The HIPAA encryption requirements guide explains the breach notification safe harbor, the rule that properly encrypted PHI that is lost does not require breach notification, in more detail.
How does PreVeil work for a therapy or counseling practice?
PreVeil encrypts message contents and attachments end to end inside Outlook, Gmail or Apple Mail, so the clinician keeps a familiar inbox. With PreVeil, referring providers, payers, billing services and patients read and reply for free from their browser after a one-time sign-up, and their replies stay encrypted. PreVeil signs a BAA, and PreVeil’s admin console and system logs support audit controls.
PreVeil Drive shares longer records, such as treatment summaries for a transfer of care, with the same end-to-end encryption. PreVeil lets a solo therapist start with a single Business license, and PreVeil deploys in hours rather than as an IT project.
3,000+ organizations use PreVeil to encrypt email and files end to end. For the email requirements in more depth, see what HIPAA requires of email.
Frequently asked questions
Can therapists email PHI under HIPAA?
Yes. The HHS FAQ on sending electronic PHI by email says the Security Rule does not expressly prohibit it. The practice must assess the risks, apply safeguards such as encryption and document the decision.
Can a therapist email psychotherapy notes to another provider?
A therapist may generally disclose psychotherapy notes only with the patient’s authorization under 45 CFR 164.508(a)(2), even for treatment. Limited exceptions apply, such as disclosures required by law.
Does a solo therapist need a BAA?
Yes. Any vendor that stores or transmits PHI for the practice is a business associate regardless of the practice’s size. PreVeil signs a BAA.
Is encryption required for a therapy practice’s email?
No. Encryption is addressable under 164.312(a)(2)(iv) and (e)(2)(ii), so the practice must assess it and document its decision. Properly encrypted PHI that is lost does not trigger breach notification.
Can PreVeil read a therapist’s email?
No. PreVeil cannot access or decrypt message contents, attachments or files, because the encryption keys stay on users’ devices.
How can a therapy practice check its email against the Security Rule?
A demo shows how PreVeil encrypts client email inside the inbox your practice already uses, with a BAA and audit logs in place. Request a demo
