Group Practice HIPAA Compliance — Complete 2026 Requirements Guide
Group therapy practices face stricter HIPAA compliance requirements than solo practitioners. More clinicians means more people with access to Protected Health Information — and HIPAA holds the practice responsible for all of them. This guide covers every requirement specific to multi-provider practices.
Updated July 2026 · Applies to practices with 2 or more clinicians
Quick Answer
Group practices have 4 HIPAA requirements that solo practices do not: (1) written policies and procedures, (2) documented HIPAA training for all staff, (3) role-based access controls in your EHR, and (4) a formally designated Privacy Officer. You also need BAAs with contractors — not just vendors. The biggest compliance gap in group practices is failing to revoke EHR access when a clinician leaves.
Solo practice vs. group practice: where the requirements diverge
Solo practitioners have significant flexibility in how they implement HIPAA — written policies and workforce training are best practices but rarely audited. Group practices are held to a stricter standard: the moment you have employees or contractors handling PHI, written policies and training documentation become mandatory, not optional.
Business Associate Agreements for Every Vendor
REQUIREDA group practice must have signed BAAs with every vendor that handles Protected Health Information on its behalf — EHR, billing clearinghouse, email, telehealth, scheduling software, and any cloud storage. Solo practice BAAs are not transferable: when you add a second clinician, your vendor BAAs must cover the full group, not just one provider.
Role-Based Access Controls
REQUIREDHIPAA requires that each workforce member has access only to the PHI they need for their job. In a group practice, a front desk coordinator should not have access to clinical notes. A clinician should not have access to another clinician's clients' records without a clinical reason. Your EHR must support role-based permissions — this is a hard requirement at the group level.
Workforce Training Documentation
REQUIREDEvery employee and contractor in a group practice must complete HIPAA training and that training must be documented. Solo therapists can informally self-train, but group practices must maintain records: who trained, when, and what was covered. Annual retraining is best practice. If you have employees, training logs are required — not optional.
Written Policies and Procedures
REQUIREDGroup practices are held to a higher documentation standard than solo practices. You need written policies covering: how PHI is accessed and by whom, breach notification procedures, employee onboarding and offboarding (especially system access), physical security of any location where records are stored or accessed, and how client records are disposed of.
Designated Privacy and Security Officer
HIPAA requires covered entities to designate a Privacy Officer and a Security Officer (these can be the same person). In a group practice, the practice owner or office manager typically holds these roles. The Privacy/Security Officer is responsible for developing policies, handling complaints, and managing breaches. Document this designation in writing.
Notice of Privacy Practices
Group practices must provide a Notice of Privacy Practices (NPP) to every client at first service. The NPP describes how PHI is used and disclosed. For group practices, the NPP should cover all providers in the practice under one document. Update your NPP if your privacy practices change and re-distribute to existing clients.
EHR Software for Group Practices
Your EHR must support role-based access controls to meet HIPAA requirements for group practices. Here are the top options.
SimplePractice
From $138/mo (2 clinicians on Plus)Best for: Small groups (2–10 clinicians) who want a modern interface
- ✓Role-based permissions
- ✓Clinician-level calendar privacy
- ✓Group billing included
- ✓Each clinician gets own client list
TherapyNotes
From $49/mo + $30/additional clinicianBest for: Groups that need supervisor co-signing or Wiley Planners
- ✓Detailed audit logs
- ✓Clinician access controls
- ✓Wiley Planners per clinician
- ✓Supervisor note co-signing
TheraNest
From $55/mo (up to 30 clients)Best for: Large groups who want flat-rate pricing
- ✓Unlimited clinicians on higher plans
- ✓Role-based access
- ✓Group notes support
- ✓Billing by clinician
Group Practice HIPAA Compliance Checklist
BAAs signed with all vendors handling PHI (EHR, email, billing, fax)
Role-based access controls configured in EHR
HIPAA training completed and documented for all staff
Written Privacy and Security policies created
Privacy Officer and Security Officer formally designated
Notice of Privacy Practices distributed to all clients
Breach notification procedure written and tested
Employee offboarding checklist includes revoking system access
Physical security policy for any office locations
Annual HIPAA risk assessment (Security Risk Analysis) completed
Trusted by 225,000+ Therapists
50% Off Your First 4 Months of SimplePractice
SimplePractice is the #1 HIPAA-compliant practice management platform for therapists. Includes a signed BAA, encrypted messaging, telehealth, and full insurance billing.
Limited-time summer offer · No credit card required for trial
Need HIPAA-compliant email only? See Hushmail for Healthcare →
FAQ — Group Practice HIPAA Compliance
Does each clinician in a group practice need their own HIPAA BAA?
No — clinicians who are employees or members of the same covered entity (your practice) are part of your workforce, not business associates. They do not need individual BAAs. BAAs are for external vendors (your EHR, billing clearinghouse, email provider) that handle PHI on your behalf.
Do independent contractors in a group practice need a BAA?
Yes — independent contractors who handle PHI are business associates and require a BAA. This is a common compliance gap in group practices that use contracted clinicians. The BAA between the practice and the contractor should specify what PHI the contractor can access and how it must be protected.
Is HIPAA training required for non-clinical staff in a group practice?
Yes. HIPAA training is required for all workforce members who have access to PHI — including front desk staff, billing staff, and administrative assistants. Non-clinical staff often have more access to demographic and billing PHI than clinicians do, making their training equally important.
What happens if a clinician in a group practice causes a HIPAA breach?
The practice (as the covered entity) is legally responsible for HIPAA breaches by workforce members, including contractors. This is why access controls and training documentation are mandatory — they demonstrate the practice took reasonable steps to prevent the breach and can affect OCR enforcement decisions.
Does a group practice need a separate HIPAA policy from a solo practice?
Yes. Group practices need written policies that solo practitioners can informally maintain. Required documents include: a workforce training policy, an access control policy (who can see what PHI), a breach notification policy, an employee offboarding procedure (revoking system access), and a physical security policy for each office location.
What is the biggest HIPAA mistake group practices make?
Failing to revoke EHR and email access when a clinician or staff member leaves. When someone exits the practice, their login credentials must be disabled immediately. This is the most commonly cited cause of internal HIPAA breaches in group practices — former employees who can still access client records.
Can a group practice use one EHR account for all clinicians?
Yes, but the EHR must support role-based access so each clinician only sees their own clients by default. SimplePractice Plus and TherapyNotes both support this. Using a single login shared among clinicians is a HIPAA violation — each user must have their own credentials with an individual audit trail.
How often should a group practice conduct a HIPAA risk assessment?
At minimum annually, and whenever there is a significant operational change — adding a new clinician, switching EHR software, opening a new office location, or moving to telehealth. The HIPAA Security Rule requires covered entities to conduct periodic technical and non-technical evaluations of their security safeguards.