HIPAA compliance kit for therapy practices
Downloadable Word and Excel templates, fillable patient PDFs and a step-by-step guide for a small therapy practice. Start with what you already have and do the rest yourselves. Buying it doesn't make a practice compliant — doing the work does.
When you've worked through it
- You've worked through which HIPAA requirements apply to your practice
- You've checked the risks to patient information on your computers, phones and online services — not only your EHR
- Your vendors are listed, with their role, whether they need a business associate agreement (BAA), and whether it's in place
- Your policies, staff training and decisions are written down, with the records to keep
Therapy Practice Edition
$299 one time
$249 launch price for the first 30 days after sales open
14-day refund · licence for one legal entity · 12 months of updates · Terms
- Every mapped requirement cited to 45 CFR or HHS guidance
- Required vs recommended labeled in every policy and guide
- Filled-in example: 9 key files completed for a fictional practice
- Our errors fixed free for every buyer, always
At a glance
The hipaa.systems Therapy Practice Edition is a set of HIPAA policies, patient forms, registers and a master workbook for small therapy practices. Every requirement mapped for this edition is linked to the document that implements it and to the evidence to show if OCR asks, and the policies and staff guides separate what HIPAA requires from what we recommend. $299 one time with 12 months of updates.
See inside
Real pages from the kit. Tap a page to open it full size in a new tab.
How it fits together. In the filled-in example practice (fictional):
- Their EHR, SimplePractice, has one row in the vendor list, with its BAA status and where the copy is filed.
- Their laptops hold synced client files, so they're in the risk analysis, with the risk and the plan for it.
- When someone new starts, the training log records who was trained, on what and when.
Already have some of this?
Good — start there. Keep what fits your practice and is up to date. Your EHR may already include patient forms, and HHS offers a model notice, free training materials and a free risk assessment tool. The kit helps you connect what you have and do the rest.
| What you can use already | How the kit helps you continue | |
|---|---|---|
| Notice of Privacy Practices | A template in your EHR, or the HHS model notice | An editable notice with a staff guide: adapting it, giving it to patients, keeping proof |
| Your HIPAA policies | Policies you've already written | Policies to adapt, with what HIPAA requires marked apart from what we recommend |
| Risk analysis | The free HHS Security Risk Assessment Tool | A guided workbook: list your systems and devices, rate the risks, record your decisions |
| Vendors and BAAs | Your EHR's own BAA | A list for all your vendors — their role, whether they need a BAA, whether it's in place — with BAA facts for common products |
| Staff training | Free general HIPAA training | A session built on your own policies, a short quiz and a training log |
What your EHR includes varies by vendor and plan. Client consent-to-treatment forms are not part of this kit — keep the ones you use.
How it works
- Day one. Confirm what applies, then put in place what can't wait: business associate agreements, your Notice of Privacy Practices, a way to report incidents.
- The first weeks. Adapt the policies and forms, run the risk analysis, record your decisions, train your staff. The workbook shows what's left.
- Every year. Follow the calendar of reviews and training; get updated files when the rules change during your update period.
Is this kit for my practice?
Good fit
- Solo or small therapy practice
- You want to do HIPAA yourselves, properly
- You need policies, a risk analysis and records of decisions
Not a fit
- Federally assisted substance use disorder program (42 CFR Part 2)
- Under investigation now — talk to an attorney first
- You want someone to do the work — compare every route
Every file in the kit
Start here 3
- Master Implementation Workbook Excel
- Implementation Guide
- Emergency Playbooks
Policies 17
- HIPAA Program Index and Document Control
- Access Control Policy
- Authentication, Passwords and MFA Policy
- Audit Logging and Activity Review Policy
- Encryption and Transmission Security Policy
- Workstations, Devices and Media Policy
- Facility and Physical Safeguards Policy
- Backup, Disaster Recovery and Emergency Operations Policy
- Security Incident and Breach Response Policy
- Workforce Security and Sanctions Policy
- Security Awareness and Privacy Training Policy
- Business Associates and Vendors Policy
- Privacy Policy
- Psychotherapy Notes and Test Materials Policy
- Minors, Parents and Personal Representatives Policy
- Telehealth Policy
- Website, Analytics and Tracking Policy
Risk analysis 2
- Risk Analysis and Risk Management Methodology
- Risk Analysis and Risk Management Workbook Excel
Patient forms and letters 11
- Patient Authorization Form
- Authorization for Psychotherapy Notes
- Authorization for Marketing
- Notice of Privacy Practices
- Acknowledgment of Receipt of the Notice of Privacy Practices
- Request for Access to Records
- Request to Amend Health Records
- Request for Restrictions or Confidential Communications
- Email and Text Message Preferences
- Privacy Complaint Form
- Patient Rights Response Letters
Staff and training 8
- Minimum Necessary Role Matrix Excel
- New Workforce Member Checklist
- Departing Workforce Member Checklist
- Workforce Confidentiality Agreement
- Policy Acknowledgment
- Workforce Training Session
- Workforce Training Quiz
- Security Reminders
Vendors and breaches 3
- Business Associate Agreement
- Vendor & BAA Register Excel
- Breach Response Kit
Registers and logs 10
- User Access Register Excel
- Hardware and Media Inventory Excel
- Security Incident and Breach Log Excel
- Reviews, Tests and Evaluations Log Excel
- Patient Records Request Log Excel
- Disclosure Log (Accounting of Disclosures) Excel
- Privacy Complaint Log Excel
- State Law Decisions Register Excel
- Training Log Excel
- Sanctions Log Excel
Also included 4
- HIPAA Requirements Reference
- A staff guide for each patient form
- 9 patient forms also as fillable PDFs, to fill in on screen
- 9 key files filled in for a fictional practice
From the current release candidate. The final list is published here before sales open; anything not in it is not part of the purchase. Not included: a consent form for recording sessions or AI note-taking tools.
Frequently asked questions
Is my practice compliant once I buy the kit?
No. Compliance comes from what your practice does — adapting the documents, running the risk analysis, putting safeguards in place and training staff. The kit guides that work. It is not a certification (HHS does not certify organizations or products), and not legal advice; for a breach, a subpoena or an investigation, talk to a lawyer.
My EHR already gives me templates. Do I need this?
Maybe not. If you already have your HIPAA policies, a risk analysis and records of your work, you may not need it. EHR templates are a good start. The kit adds the rest — a plan to follow, a risk-analysis workbook, a vendor list, staff training and logs. Keep what already works and adjust it, instead of replacing it.
Who made this kit? Are you lawyers?
The kit is published by hipaa.systems. We're not a law firm, and the kit has not been reviewed by an attorney. It gives you templates and step-by-step guidance, with references to the federal rules behind them. We don't review your practice or give legal answers for your situation. For state-law questions, unusual requests for records or contract terms, talk to an attorney. See how we check our sources on the methodology page.
Does it cover my state's law?
It covers federal HIPAA and flags where state law often differs — minors, record retention, duty to warn, breach notification. It is not a review of your state's laws.
How are updates handled?
12 months of updates are included; each release has a "law checked as of" date and a changelog. After that, updates are optional at $79 a year. Fixes of our own errors are free for every buyer of the affected version.
Can I edit it in Word, Excel, Google Docs and Sheets?
Yes. The files are Word and Excel; they also open in Google Docs and Sheets, where a few layout details look different.
Who does one licence cover?
One legal entity — its trade names, all its locations and all its staff — for internal use. A separate legal entity needs its own licence.
What are the refund and support terms?
A full refund on request within 14 days, once per organization; a free swap if you picked the wrong edition. 30 days of email support on how the kit works — never send patient information.