// breach.compliance / mental_health
For psychotherapy, counseling, and SUD-treating practices. Sixteen documents across three tiers: Quick-Start ($199) delivers the five universal HIPAA foundation docs. Complete Suite ($499) adds six MH-specific documents. Master Bundle ($999) adds five hands-on implementation tools.
// all.artifacts.by.tier
Sixteen artifacts across three tiers. Quick-Start ($199) delivers the five universal HIPAA foundation documents. Complete Suite ($499) adds six MH-specific documents covering the highest-risk regulatory zones. Master Bundle ($999) adds five implementation tools. Every artifact ships with a paired self-verification report mapping content to primary regulatory sources.
// quick start
Universal HIPAA §164.520 NPP updated for the 2024 Reproductive Health Privacy Rule. Covers all required notice elements, patient rights block, effective-date field, and distribution acknowledgment. Suitable for all covered healthcare entities without modification.
// quick start
HHS Model BAA adapted for small-practice use. Prominent attorney-signoff disclaimer. Covers all §164.504(e) required provisions: permitted uses, safeguard obligations, subcontractor flow-down, breach notification, termination, and return-or-destruction of PHI.
// quick start
HIPAA-compliant intake form with built-in PHQ-2/GAD-2 screening questions. Covers demographic, insurance, emergency contact, and care-coordination consent fields. PHQ-2/GAD-2 screening integration is particularly relevant for mental health and behavioral health practices.
// quick start
Workforce training acknowledgment satisfying §164.530(b) documentation requirement. References the sanctions policy, lists the seven training topic categories, and includes a sign-off block for training date, trainer, and employee signature for practice training records.
// quick start
§164.530(e) workforce sanctions framework. Defines violation severity tiers (inadvertent / negligent / willful), proportionate sanction responses for each tier, documentation and investigation procedures, and non-retaliation statement. Required to be in place before OCR audit.
// complete suite
For SUD-treating practices. Implements the SAMHSA 2024 Final Rule single-consent model that aligns Part 2 with HIPAA for TPO disclosures. All §2.22 Notice elements, §2.31 (2024 amended) consent elements, and §2.32 verbatim re-disclosure prohibition language.
// complete suite
Addresses the MH-distinct concerns: cross-state licensure during telehealth (PSYPACT for psychologists; LCSW / LPC / LMFT compact gap honestly acknowledged), emergency response when therapist cannot physically reach client, Tarasoff threats surfacing remotely, recording prohibition under state two-party-consent laws.
// complete suite
Three-element threshold matrix (credible threat / identifiable victim / patient communication), graduated response protocol from voluntary engagement to law-enforcement notification, 7-item documentation checklist that protects the clinician's good-faith statutory immunity.
// complete suite
Establishes §164.501 separation from general mental health record, §164.508(a)(2) separate-authorization requirement, §164.524(a)(1)(i) excluded-from-right-of-access handling, and the 6 explicit exceptions to separate authorization. Includes a Distinction Matrix giving clinicians at-a-glance content-placement rules.
// complete suite
The patient-facing §164.508(a)(2) heightened-protection authorization form. For when a patient consents to release of psychotherapy notes to an attorney, another clinician, employer fitness-for-duty evaluator, or other third party. Anti-combination notice, expiration controls, 42 CFR Part 2 dual-applicability cross-reference, patient rights block.
// complete suite
Three-table regulatory digest across 10 high-volume states: state Tarasoff duty statutes (mandatory vs permissive vs no-duty including TX and NC notable exceptions), SUD / 42 CFR Part 2 parallel state statutes, and psychotherapist-patient privilege strength. Each row presents citation, statute text excerpt, and last-verified date. Not legal advice; reference only.
// master bundle
Landscape flowchart walking the §§164.402-164.414 assessment in plain decision-tree form. Four-factor low-probability-of-compromise framework, individual / media / HHS notification thresholds, BA notification chain, law enforcement delay (written and oral). Companion narrative reference and fillable incident-documentation worksheet.
// master bundle
Fillable §164.308(a)(1)(ii)(A) annual self-assessment. ePHI inventory, 10-threat identification matrix, vulnerability assessment across all five safeguard categories, 3×3 likelihood-impact risk grid, mitigation plan tracker, sign-off block. Methodology aligned with NIST SP 800-30 Rev. 1.
// master bundle
Companion usage guide for the Vendor BAA Tracker spreadsheet. Step-by-step setup instructions, column definitions for all 20 fields, guidance on the BAA-required-vs-conduit-exception determination, risk tier definitions, and a quick-start checklist for initial population of the tracker.
// master bundle
Editable 26-slide PowerPoint for the §164.530(b)(1) annual training requirement. PHI definitions, TPO disclosures, Minimum Necessary, breach reporting, workstation and device security, social engineering, sanctions, OCR enforcement examples, knowledge check, sign-off slide for practice training records.
// master bundle
Four-sheet Excel template for §164.502(e) Business Associate Agreement administration. 20-column tracker with dropdown validation and five example vendor rows, BAA-required-vs-conduit-exception guidance, risk tier definitions, common vendor categories needing BAAs.
Sixteen artifacts total: 5 Quick Start (cyan) + 6 Complete Suite (green) + 5 Master Bundle (violet). See pricing tiers below.
// pick.your.tier
Quick-Start is the HIPAA + 42 CFR Part 2 foundation for any solo mental health practice. The Complete Suite layers on MH specialty documents and a state reference table (11 documents total). The Master Bundle adds five hands-on implementation tools for a complete 16-deliverable kit.
// mental_health.faq
My practice does not treat SUD. Do I need the 42 CFR Part 2 form?
No. If your practice does not provide substance use disorder diagnosis, treatment, or referral for treatment, you can omit the Part 2 Notice from your patient intake packet. The other eight documents fully cover a general psychotherapy / counseling practice.
I am a psychologist participating in PSYPACT. Does the Telehealth Consent address that?
Yes. The Telehealth Consent explicitly references PSYPACT for psychologists and honestly notes the LCSW / LPC / LMFT compact gap. The Advanced Suite tier includes a pre-filled section for the buyer's specific PSYPACT participating-state list and any state-specific notification requirements.
Texas significantly restricted Tarasoff after Thapar v. Zezulka. Does the Tarasoff Protocol still apply if I practice in Texas?
Honest answer: practices in Texas need the Advanced Suite tier or attorney review of the Quick-Start version before adoption. The Quick-Start Protocol uses the consensus Tarasoff framework that applies in most US states; Texas (and a few other states with restricted or rejected duties) need state-specific language modifications. This is flagged in the document's "items warranting attorney review" appendix.
How does the Psychotherapy Notes Policy differ from what I already have in my EHR?
Most general-medical EHRs do not have a separate psychotherapy-notes module that satisfies §164.501's physical-separation requirement; their "progress notes" section is part of the designated record set and gets disclosed under standard TPO authorizations. The Policy clarifies the §164.501 distinction, establishes physical / electronic separation requirements, and the Advanced Suite tier includes EHR-specific instructions for SimplePractice, TheraNest, and TherapyNotes which DO have proper psychotherapy-notes modules.
Real human responds within one business day. We're a templates vendor, not a clinical supervisor; we will not give you legal or ethical guidance, but we will absolutely answer questions about what is and is not in the kit.