// breach.compliance / mental_health
For psychotherapy, counseling, and SUD-treating practices. The Mental Health Complete Suite ($499) stacks five MH specialty documents, a 10-state regulatory reference, and four operational compliance tools onto the universal $199 Quick-Start. The Master Bundle ($999) adds hands-on implementation support.
// complete.suite.contents
Ten artifacts: five mental health specialty documents addressing the highest-risk regulatory zones (SUD confidentiality, telehealth cross-state, Tarasoff duty, psychotherapy notes protection, and patient-authorized psychotherapy notes disclosure), one state regulatory reference table, and four operational compliance tools. Every artifact ships with a paired self-verification report mapping content to primary regulatory sources with honest confidence labels.
// mental health specialty
For SUD-treating practices. Implements the SAMHSA 2024 Final Rule single-consent model that aligns Part 2 with HIPAA for TPO disclosures. All §2.22 Notice elements, §2.31 (2024 amended) consent elements, and §2.32 verbatim re-disclosure prohibition language.
// mental health specialty
Addresses the MH-distinct concerns: cross-state licensure during telehealth (PSYPACT for psychologists; LCSW / LPC / LMFT compact gap honestly acknowledged), emergency response when therapist cannot physically reach client, Tarasoff threats surfacing remotely, recording prohibition under state two-party-consent laws.
// mental health specialty
Three-element threshold matrix (credible threat / identifiable victim / patient communication), graduated response protocol from voluntary engagement to law-enforcement notification, 7-item documentation checklist that protects the clinician's good-faith statutory immunity.
// mental health specialty
Establishes §164.501 separation from general mental health record, §164.508(a)(2) separate-authorization requirement, §164.524(a)(1)(i) excluded-from-right-of-access handling, and the 6 explicit exceptions to separate authorization. Includes a Distinction Matrix giving clinicians at-a-glance content-placement rules.
// mental health specialty
The patient-facing §164.508(a)(2) heightened-protection authorization form. For when a patient consents to release of psychotherapy notes to an attorney, another clinician, employer fitness-for-duty evaluator, or other third party. Anti-combination notice, expiration controls, 42 CFR Part 2 dual-applicability cross-reference, patient rights block.
// reference
Three-table regulatory digest across 10 high-volume states: state Tarasoff duty statutes (mandatory vs permissive vs no-duty including TX and NC notable exceptions), SUD / 42 CFR Part 2 parallel state statutes, and psychotherapist-patient privilege strength. Each row presents citation, statute text excerpt, and last-verified date with per-cell fetch-status labels. Not legal advice; reference only.
// operational
Fillable §164.308(a)(1)(ii)(A) annual self-assessment. ePHI inventory, 10-threat identification matrix, vulnerability assessment across all five safeguard categories, 3×3 likelihood-impact risk grid, mitigation plan tracker, sign-off block. Methodology aligned with NIST SP 800-30 Rev. 1.
// operational
Editable 26-slide PowerPoint for the §164.530(b)(1) annual training requirement. PHI definitions, TPO disclosures, Minimum Necessary, breach reporting, workstation and device security, social engineering, sanctions, OCR enforcement examples, knowledge check, sign-off slide for the practice's training records.
// operational
Landscape flowchart walking the §§164.402-164.414 assessment in plain decision-tree form. Four-factor low-probability-of-compromise framework, individual / media / HHS notification thresholds, BA notification chain, law enforcement delay (written and oral). Companion narrative reference and fillable incident-documentation worksheet.
// operational
Four-sheet Excel template for §164.502(e) Business Associate Agreement administration. 20-column tracker with dropdown validation and five example vendor rows, BAA-required-vs-conduit-exception guidance, risk tier definitions, common vendor categories needing BAAs. Companion usage guide PDF.
Quick-Start tier ($199): HIPAA + 42 CFR Part 2 foundation for solo mental health practitioners — NPP, BAA, intake, Tarasoff overlay, basic training. Instant PDF download. See pricing tiers below.
// pick.your.tier
Quick-Start is the HIPAA + 42 CFR Part 2 foundation for any solo mental health practice. The Complete Suite layers on MH specialty documents, a state reference table, and operational compliance tools. The Master Bundle adds a risk assessment workbook, vendor BAA tracker, decision tree, and a 30-min onboarding call.
// mental_health.faq
My practice does not treat SUD. Do I need the 42 CFR Part 2 form?
No. If your practice does not provide substance use disorder diagnosis, treatment, or referral for treatment, you can omit the Part 2 Notice from your patient intake packet. The other eight documents fully cover a general psychotherapy / counseling practice.
I am a psychologist participating in PSYPACT. Does the Telehealth Consent address that?
Yes. The Telehealth Consent explicitly references PSYPACT for psychologists and honestly notes the LCSW / LPC / LMFT compact gap. The Advanced Suite tier includes a pre-filled section for the buyer's specific PSYPACT participating-state list and any state-specific notification requirements.
Texas significantly restricted Tarasoff after Thapar v. Zezulka. Does the Tarasoff Protocol still apply if I practice in Texas?
Honest answer: practices in Texas need the Advanced Suite tier or attorney review of the Quick-Start version before adoption. The Quick-Start Protocol uses the consensus Tarasoff framework that applies in most US states; Texas (and a few other states with restricted or rejected duties) need state-specific language modifications. This is flagged in the document's "items warranting attorney review" appendix.
How does the Psychotherapy Notes Policy differ from what I already have in my EHR?
Most general-medical EHRs do not have a separate psychotherapy-notes module that satisfies §164.501's physical-separation requirement; their "progress notes" section is part of the designated record set and gets disclosed under standard TPO authorizations. The Policy clarifies the §164.501 distinction, establishes physical / electronic separation requirements, and the Advanced Suite tier includes EHR-specific instructions for SimplePractice, TheraNest, and TherapyNotes which DO have proper psychotherapy-notes modules.
Real human responds within one business day. We're a templates vendor, not a clinical supervisor — we will not give you legal or ethical guidance, but we will absolutely answer questions about what is and is not in the kit.