⚠️

February 16, 2026 Deadline

All therapy practices must update their Notice of Privacy Practices (NPP) by Feb 16, 2026 under the new HIPAA Privacy Rule. Non-compliance = automatic violation.

HIPAA Compliance for Therapists & Mental Health Practices — 2026 Guide

The 2026 HIPAA updates introduced mandatory NPP revisions, stronger psychotherapy note protections, and new telehealth rules. Find your practice type and state to see your exact risks and the solution trusted by 225,000+ therapists.

⚡

Free HIPAA Risk Calculator

2-minute assessment · See your practice's estimated penalty exposure under 2026 tiers

📋

Therapist HIPAA Checklist

42-item checklist · The #1 document OCR auditors request · Updated for 2026

$43,000

Average HIPAA fine for therapists

1 in 6

Therapy practices audited in 2025

Missing BAA

Most common violation

REQUIRED

Feb 2026 NPP update deadline

Trusted by 225,000+ Therapists

SimplePractice — The #1 HIPAA-Compliant Platform for Therapists

Secure messaging, telehealth, billing, notes, and a signed BAA included.

30-day free trial

Start Free →

Solo Therapist

View all 8 locations →

Houston, Texas

Avg fine: $41,000

No BAA with SimplePractice or EHR

critical urgency

Austin, Texas

Avg fine: $41,000

No signed BAA with cloud storage provider

critical urgency

Los Angeles, California

Avg fine: $47,000

Missing updated NPP (required by Feb 2026)

critical urgency

San Francisco, California

Avg fine: $47,000

Telehealth platform without BAA

high urgency

Miami, Florida

Avg fine: $38,000

No HIPAA Security Risk Assessment on file

high urgency

Orlando, Florida

Avg fine: $38,000

Voicemail with PHI left without consent

high urgency +2more locationsView all →

Group Practice

View all 3 locations →

Dallas, Texas

Avg fine: $58,000

No designated HIPAA Privacy Officer

critical urgency

Los Angeles, California

Avg fine: $61,000

No Business Associate Agreements with all vendors

critical urgency

Atlanta, Georgia

Avg fine: $44,000

Intake forms collected on paper without secure disposal

high urgency

Telehealth Therapist

View all 3 locations →

New York City, New York

Avg fine: $52,000

Using Zoom standard (not Zoom for Healthcare)

critical urgency

Austin, Texas

Avg fine: $41,000

FaceTime used for therapy sessions

critical urgency

Seattle, Washington

Avg fine: $43,000

No informed consent for telehealth recording

high urgency

Marriage & Family Therapist

View all 2 locations →

Phoenix, Arizona

Avg fine: $36,000

Couples session notes stored without differentiation

high urgency

San Diego, California

Avg fine: $47,000

Joint vs individual records not properly separated

critical urgency

Licensed Counselor

View all 2 locations →

Denver, Colorado

Avg fine: $37,000

No separate storage for psychotherapy notes

high urgency

Nashville, Tennessee

Avg fine: $35,000

Client intake via unencrypted web form

high urgency

HIPAA Rules By State

Many states have stricter mental health privacy laws on top of HIPAA. Find your state:

Texas →California →Florida →New York →Illinois →

225,000+ Therapists Trust SimplePractice

Not sure where to start?

SimplePractice handles HIPAA compliance, secure messaging, telehealth, billing, and documentation in one platform — with a signed Business Associate Agreement included.

Start 30-Day Free Trial with SimplePractice →

No credit card required