Most New York therapists think of HIPAA as a consent form and a locked file cabinet. The actual risk in a modern practice is different: text messages, a laptop on a train, a VA with your EHR password, a Gmail account used for scheduling. Here is a practical self-audit you can do in an hour, written for a solo or small group practice, not a hospital.
Communication
- Do you text clients? If so, is it through a HIPAA-compliant platform or your personal phone? Appointment reminders through your EHR are fine. Clinical content by SMS is not.
- Is your email a free consumer account? Google Workspace or Microsoft 365 with a signed BAA is the minimum for anything involving client names.
- Do you have a documented policy on what clients can and cannot send you by email or text?
Devices
- Full-disk encryption on every laptop and phone that touches client data (FileVault on Mac, BitLocker on Windows).
- Automatic lock after a few minutes. Unique passwords and two-factor authentication on the EHR, email and billing software.
- A plan for a lost or stolen device: remote wipe enabled, and you know whom to call.
People
- Every person who touches client data, including VAs, billers, bookkeepers and practice management companies, has a signed Business Associate Agreement.
- Each person has their own login with only the access they need. Shared passwords are the most common finding we see.
- When someone leaves, their access is removed the same day.
Paper and policies
- Notice of Privacy Practices given to every client and posted on your website.
- A written risk assessment, even a short one, updated annually. HIPAA requires it and most small practices do not have it.
- A breach response plan: who you notify, within what timeframe, and how.
Telehealth
- Video platform with a BAA (not a consumer video app).
- Telehealth consent that covers location, privacy on the client’s end and emergency procedures.
What to do with the results
Most practices find three to six gaps. Fix the shared passwords and the missing BAAs first; they are the fastest and most serious. Then write the risk assessment and breach plan. MBBCS does this audit and the fixes as part of operations work for New York practices, and we sign a BAA before we start.
Quick answers
Can therapists text clients under HIPAA?
Appointment reminders through a compliant platform are generally fine. Clinical content over standard SMS is not secure and should be avoided or covered by a specific written client consent and policy.
Does my practice need a HIPAA risk assessment?
Yes. HIPAA requires covered entities, including solo practices, to conduct and document a security risk assessment and update it periodically.
Who needs a Business Associate Agreement?
Anyone outside your practice who creates, receives, stores or transmits protected health information on your behalf: EHR vendor, email provider, billers, VAs, bookkeepers and practice management companies.
Ready to talk? MBBCS is a clinician-owned practice management team in Brooklyn serving therapists across New York. Book a free 20-minute consult or get a ballpark estimate in 30 seconds.
