HIPAA Compliance by City & Practice Type — 2026
HIPAA requirements vary significantly based on your state — and your practice type changes your specific obligations. These guides cover what therapists in each city actually need to do, based on their practice structure and their state's enforcement environment.
Find your practice type below, then select your city for a complete guide covering state law requirements, the most common violations, step-by-step fixes, and a practice-specific compliance checklist.
Solo Therapists
Houston, Texas
Avg fine: $41,000
Solo therapists are covered entities responsible for all HIPAA compliance personally — no employer to shield liability.
Austin, Texas
Avg fine: $41,000
Solo therapists are fully liable for their own HIPAA compliance with no institutional backup.
Los Angeles, California
Avg fine: $47,000
California therapists face both HIPAA and the California Confidentiality of Medical Information Act simultaneously.
San Francisco, California
Avg fine: $47,000
Bay Area solo therapists frequently use tech tools that require careful BAA management.
Miami, Florida
Avg fine: $38,000
Florida is the #3 state for HIPAA complaints filed with OCR.
Orlando, Florida
Avg fine: $38,000
Solo therapists in Florida face mandatory state reporting requirements on top of HIPAA.
New York City, New York
Avg fine: $52,000
New York therapists face the NY SHIELD Act in addition to HIPAA, with stricter breach notification rules.
Chicago, Illinois
Avg fine: $39,000
Illinois Mental Health and Developmental Disabilities Confidentiality Act adds state-level protection requirements.
Group Practices
Dallas, Texas
Avg fine: $58,000
Group practices must designate a HIPAA Privacy Officer and document all workforce training — most don't.
Los Angeles, California
Avg fine: $61,000
Large group practices in CA face dual liability under HIPAA and California CMIA with each staff member.
Atlanta, Georgia
Avg fine: $44,000
Group practices using external billing services must have BAAs — most billing services require the practice to initiate.
Telehealth Therapists
New York City, New York
Avg fine: $52,000
Telehealth therapists who cross state lines face the HIPAA laws of both states simultaneously.
Austin, Texas
Avg fine: $41,000
Texas-based telehealth therapists serving clients in other states must comply with multiple state mental health privacy laws.
Seattle, Washington
Avg fine: $43,000
Washington state's My Health MY Data Act (2023) creates additional obligations for telehealth therapists.