Therapists in New York hold some of the most sensitive data there is. Diagnoses, session notes, family history, insurance details. When you hand parts of your practice to an outside company, the real question is not “are they HIPAA compliant” (everyone says yes). It is “what happens to my data when their business changes.” Here is how a clinician-owned company answers that differently.
The three risks nobody puts in the brochure
1. The acquisition risk
Equity-backed companies are built to be sold. When they are, your data goes with them, to a buyer you did not choose, under terms you did not read. In 2023 and 2024 several large mental health platforms were investigated or fined for sharing client information with advertisers. The pattern is the same each time: growth pressure, then shortcuts.
2. The “de-identified data” clause
Read the terms of service of any large platform and you will find a clause allowing them to use de-identified or aggregated data. That is a revenue line. A clinician-owned company has no reason to monetize your clients.
3. The offshore support risk
Low-cost platforms often route support and billing through overseas contractors without a proper Business Associate Agreement. That is a HIPAA violation waiting to happen, and it lands on you, the covered entity.
How MBBCS handles your data
- Business Associate Agreement signed before we touch anything.
- Your systems, your accounts. We work inside your EHR and billing software with role-limited logins you control and can revoke.
- Minimum necessary. A biller sees claims data. A marketer never sees clinical notes.
- No data resale, ever. We are not valued on data. We are paid by the hour by you.
- New York based team. People you can call, who know New York insurers and the New York Office of Professions.
Questions to ask any vendor
Who owns my data if you are acquired? Do you use de-identified data for any purpose? Where are your support staff located and are they under a BAA? Can I export everything and leave in 30 days? If a vendor cannot answer all four in plain English, keep looking.
Quick answers
Does MBBCS sign a Business Associate Agreement?
Yes, before any work starts. It is standard for every client.
Can MBBCS staff see my session notes?
Only the specific people who need access to a specific system, and never for marketing or growth work. Access is role-limited and you control the logins.
What happens to my data if I stop working with MBBCS?
Nothing moves. Everything already lives in your own accounts. We remove our logins and you continue as before.
Ready to talk? MBBCS is a clinician-owned practice management team in Brooklyn serving therapists across New York. Book a free 20-minute consult or get a ballpark estimate in 30 seconds.
