Last updated: October 2026
By Joel Blackstock, LICSW-S, MSW, PIP (Alabama license 4135C-S), Founder and Clinical Director, Taproot Therapy Collective, Hoover, Alabama

The bottom line for October 2026: the HIPAA Security Rule overhaul proposed in January 2025 is still not final, and HHS now lists July 2027 as its target, so multi-factor authentication and encryption are still not spelled out as federal mandates. Enforcement is what has changed. The 42 CFR Part 2 compliance date passed on February 16, 2026, OCR now enforces Part 2 directly, and OCR keeps settling with behavioral health and small providers that never completed a real risk analysis. For a solo or small group practice, the work that matters now is a documented risk analysis, signed business associate agreements, and written rules for AI tools and contractors.

This guide is written for therapists, counselors, clinical social workers, psychologists, and marriage and family therapists who own or are building a private practice anywhere in the United States. It separates what is in force from what is proposed, corrects some claims that have circulated in vendor marketing, and ends with a phased checklist. Alabama-specific rules appear in marked callouts and in a dedicated section near the end.

Key dates at a glance

Seven federal items matter most to private practice in late 2026. Two are fully in effect (Part 2 compliance and the 2026 penalty amounts), one was vacated (the reproductive health rule), and four are pending: the Security Rule overhaul, the long-delayed Privacy Rule changes, S. 3315 in Congress, and the Department of Labor contractor rule.

Is HIPAA changing in 2026?

Not in the way many compliance vendors predicted. The Security Rule overhaul is still a proposal, and HHS moved it to its Long-Term Actions list with a July 2027 target. The changes that took effect in 2026 were Part 2 compliance, OCR’s new Part 2 enforcement program, and higher civil money penalty amounts.

OCR issued the Security Rule proposal on December 27, 2024, and it was published in the Federal Register on January 6, 2025. Comments closed on March 7, 2025, and Tim Noonan, OCR’s Deputy Director for Health Information Privacy, told the National HIPAA Summit later that month that OCR had received 4,745 comments. The Unified Agenda released in September 2025 listed May 2026 for final action. That month passed with no final rule, and the 2026 Unified Agenda moved the rulemaking from the Final Rule Stage to Long-Term Actions with a July 2027 date. Placement on that list generally signals the agency does not expect to finish within twelve months. HHS has not explained the move. In a December 8, 2025 letter to HHS Secretary Robert F. Kennedy Jr., a coalition of more than 100 organizations led by the College of Healthcare Information Management Executives (CHIME) asked HHS to withdraw the rule “without further consideration.” A final rule could come out narrower than the proposal or not at all.

What would the proposed Security Rule require?

The proposal would remove the distinction between required and addressable specifications, make encryption and MFA mandatory with limited exceptions, and add written inventories, scanning, testing, audits, and tight notification clocks. None of it binds a practice until a final rule is published and its compliance date arrives.

One correction is worth making because it circulates widely. The proposal does not shorten breach notification to 72 hours. The 72-hour figure is the restoration target for certain systems and data. Breach notification to clients still runs on the Breach Notification Rule’s standard: without unreasonable delay and no later than 60 days after discovery. The proposal also would not change that.

On timing, the proposal set an effective date 60 days after publication and a compliance date 180 days after that, roughly 240 days in total, along with a transition provision for existing business associate agreements. If the final rule keeps that structure, a practice would have about eight months to comply.

What is Congress doing about health care cybersecurity?

S. 3315, the Health Care Cybersecurity and Resiliency Act, passed the Senate by unanimous consent on September 30, 2026, and is now in the House. If enacted, it would direct HHS to update the Security Rule to require MFA, encryption, and penetration testing, effective 36 months after enactment.

Senator Bill Cassidy introduced the bill on December 2, 2025, with Senators Maggie Hassan, John Cornyn, and Mark Warner as original cosponsors. The HELP Committee reported it with a substitute amendment on March 23, 2026. Section 8 of the Senate-passed text would require HHS to update the Security Rule so that covered entities and business associates adopt multi-factor authentication, encryption of protected health information, monitoring that includes penetration testing, and other minimum standards drawn from national frameworks. Those requirements would take effect 36 months after enactment, and HHS could use enforcement discretion for entities facing extraordinary circumstances. The bill would also require breach notices to state how many people were affected. A bill that has passed one chamber is not law, and the House may change it or never take it up.

What HIPAA and Part 2 rules are in effect right now?

The Privacy, Security, and Breach Notification Rules apply as currently written. The Part 2 rule revisions became mandatory on February 16, 2026, and OCR began accepting Part 2 complaints and breach reports that day. The reproductive health rule is vacated, and the 2021 Privacy Rule proposals had not been finalized by the most recent date we could confirm.

Is a typical therapist a Part 2 program?

Usually not. Part 2 applies to federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment, or referral for treatment. A generalist therapist who treats some clients with substance use concerns is usually not a Part 2 program, but receiving records from one brings Part 2 restrictions with it.

The 2024 final rule aligned much of Part 2 with HIPAA as the CARES Act required. A client can now sign a single consent for future uses and disclosures for treatment, payment, and health care operations. A HIPAA covered entity that receives Part 2 records under that consent may generally redisclose them as HIPAA permits. The strongest protection remains: Part 2 records, and testimony about them, cannot be used in civil, criminal, administrative, or legislative proceedings against the client without specific consent or a qualifying court order. The HHS Secretary delegated Part 2 enforcement to OCR on August 25, 2025. HHS announced a civil enforcement program on February 13, 2026, and the HIPAA penalty structure now applies to Part 2 violations.

For a solo or small group practice, the practical questions are whether you are a Part 2 program (a substance use disorder specialty practice that bills Medicare or Medicaid or holds a DEA registration may be one) and whether you receive Part 2 records from treatment programs. If you receive them, tag them in your EHR, honor the redisclosure notice that comes with them, and route any subpoena touching them to your attorney.

What did Purl v. HHS change in your Notice of Privacy Practices?

On June 18, 2025, the Northern District of Texas vacated the 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy nationwide, except for its changes to the Notice of Privacy Practices tied to Part 2. HHS did not appeal, and the Fifth Circuit dismissed the intervenors’ appeal on September 10, 2025.

In practice, the reproductive health attestation requirement for certain requests is gone, and practices that added reproductive health language to their notice can remove it. The surviving notice changes concern Part 2 records, such as the statement that those records will not be used in proceedings against the client without consent or a court order. Practices that create or receive Part 2 records needed that language by February 16, 2026. Practices that never touch Part 2 records have less to change, but many health lawyers recommend reviewing the notice anyway. Subpoena handling goes back to the pre-2024 rules: satisfactory assurances or a court order under 45 CFR 164.512(e), plus whatever your state privilege law requires.

Is the 2021 Privacy Rule proposal finally moving?

Yes. The coordinated care rule proposed in January 2021 (RIN 0945-AA00) went to OMB review in April 2026, and the 2026 Unified Agenda targeted August 2026. It had not been published as of late September 2026, so the current right of access rules still govern.

The proposal would let clients inspect records in person and photograph them, shorten the access response time from 30 days to 15, and remove the requirement to get written acknowledgment of the Notice of Privacy Practices. On September 27, 2026, the tracker HIPAA Simple reported that HHS now plans a separate proposed rule on access response times, expected in November 2026. Until a final rule appears, a practice has 30 calendar days to act on an access request, with one 30-day extension if the client gets written notice, and may charge only a reasonable, cost-based fee. Because the final rule may require a new notice, a practice planning to revise its notice may want to wait for publication so it does not revise twice.

What do solo practitioners need to get right?

A solo clinician who bills insurance electronically is a covered entity and carries the full set of obligations: a risk analysis, policies, BAAs, a notice, access rights, and breach response. No official HIPAA certification exists. Compliance is a set of documented decisions that has to hold up if OCR asks for it after an incident.

When does HIPAA apply to a cash-only practice?

A provider becomes a covered entity by transmitting health information electronically in connection with a standard transaction, such as a claim or eligibility check, directly or through a billing service. A strictly cash-pay practice that never does this may fall outside HIPAA, but state law and board rules still apply.

Two details catch people. First, once a practice is covered, HIPAA applies to all of its protected health information, including private-pay clients. Second, giving clients a superbill to file themselves is not a standard transaction by the provider, but hiring a billing service to submit claims is. Many out-of-network practices follow HIPAA anyway, because clients, insurers, and liability carriers expect it.

Which vendors need a business associate agreement?

Any vendor that creates, receives, maintains, or transmits protected health information for the practice is a business associate and needs a signed BAA before it touches client data. HHS treats cloud services as business associates even when they store only encrypted data they cannot read.

What does “HIPAA compliant” on a vendor website mean?

Nothing official. HHS does not certify products or practices as HIPAA compliant. A vendor can support compliance by signing a BAA and offering safeguards, but your practice is still responsible for configuring the tool, controlling access, and documenting how it fits your risk analysis.

How should group practice owners handle W-2 and 1099 clinicians?

HIPAA workforce status turns on direct control, not tax status. W-2 clinicians are workforce members. A 1099 clinician may be treated as workforce or as a business associate, depending on how the practice directs their work. The practice should choose one approach for each arrangement, document it, and have a healthcare attorney review it.

What does HIPAA say about workforce members?

The definition at 45 CFR 160.103 covers employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity, is under its direct control, “whether or not they are paid by the covered entity.” In the 2000 Privacy Rule preamble, HHS wrote that “independent contractors may or may not be workforce members,” and that when contracted persons work on the covered entity’s premises for a substantial part of their activities, the covered entity “may choose to treat them either as business associates or as part of the workforce.” It added that if no business associate contract exists, HHS will assume the person is a workforce member. The 2013 Omnibus Rule preamble repeats that an onsite contractor with more than incidental access may be treated either way, and that a covered entity must train workforce members and must have a BAA with a business associate it does not treat as workforce.

These passages use examples like IT vendors and contracted staff, not therapists, so applying them to clinicians is an interpretation. Three points follow. A missing BAA is not automatically a violation, because the contractor may properly be workforce. If a BAA is required and missing, that is a violation, but HIPAA does not require you to self-report it to OCR. And disclosures from one provider to another about a client’s treatment fall outside the business associate definition, so a clinician who is a separate practice receiving a referral is not your business associate.

Which model fits your contractors?

When a contractor keeps client information in a personal Dropbox or runs sessions through an AI scribe the practice did not choose, the business associate route with subcontractor BAAs is usually the safer one, because the practice cannot directly control those systems. Either way, the records belong to the practice under your contract, departing clinicians do not run mass exports, and access to the EHR, email, telehealth, and AI tools ends on the last day.

Does more HIPAA control make a contractor look like an employee?

It can. HIPAA’s direct-control test and labor law’s control test use similar language, so requiring practice systems, schedules, and supervision for privacy reasons can move a 1099 relationship closer to employment for IRS and Department of Labor purposes. That tension is a reason to have both questions reviewed together.

The IRS applies a common-law test that weighs behavioral control, financial control, and the relationship of the parties. At the Department of Labor, the 2024 independent contractor rule is still on the books, but DOL stopped applying it in its own enforcement in May 2025 and published a proposal on February 27, 2026, to replace it with an economic reality test built on two core factors: control over the work and opportunity for profit or loss. Comments closed April 28, 2026. We found no final rule as of late October 2026. Courts and state agencies apply their own tests regardless. Setting technical privacy safeguards, such as requiring MFA and a practice-managed record system, is different from controlling clinical methods, schedules, and fees, and your contract should keep the two apart.

How are psychotherapy notes protected under HIPAA?

Psychotherapy notes are a clinician’s notes documenting or analyzing the contents of a counseling session, kept separate from the rest of the record. They get stronger protection than the rest of the record: most disclosures require a specific authorization, and clients have no HIPAA right of access to them. Content commingled with progress notes loses that protection.

The definition at 45 CFR 164.501 covers notes recorded by a mental health professional documenting or analyzing conversation during a private, group, joint, or family session, separated from the rest of the medical record. It excludes medication prescription and monitoring, session start and stop times, modalities and frequency of treatment, clinical test results, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, or progress to date. Those items belong in the progress note.

Under 45 CFR 164.508(a)(2), most uses and disclosures of psychotherapy notes need an authorization that cannot be combined with other authorizations. Exceptions include the originator’s own use for treatment, use in supervised training programs where students or practitioners learn to improve their counseling skills, defense in a legal action or proceeding brought by the client, uses required by law, health oversight of the originator, HHS compliance investigations, and disclosures to prevent a serious and imminent threat. Psychotherapy notes are also excluded from the right of access and from electronic health information under the information blocking rules.

Most therapy EHRs offer a separate psychotherapy notes field that stays out of standard exports and client portal releases. HIPAA does not literally say that only the authoring clinician may see these notes, but restricting access to the author is the sensible practice, given the authorization requirement and the narrow exceptions. Our guide to correcting clinical notes and what happens when you delete a psychotherapy note covers audit trails and amendments in more depth.

Can therapists use AI scribes and tools like ChatGPT?

Yes, with conditions. An AI scribe that processes session audio or notes is a business associate and needs a BAA. Consumer AI accounts come without a BAA, so client information should not go into them regardless of training settings. Several states also now require consent or limit what AI may do in therapy.

Which general AI assistants offer a BAA?

Vendor default settings vary, and some consumer plans let users opt out of model training. That does not fix the problem, because without a BAA no contract binds the vendor to HIPAA safeguards, breach notice, or limits on use. Removing names is also not de-identification under HIPAA’s standards. With purpose-built AI scribes, ask four questions before signing: Is session audio deleted after transcription, and when? Is any client data used to train models? Where is data stored, and which subcontractors process it? Does the BAA say all of this in writing?

Which states regulate AI in therapy?

Illinois, Nevada, and Utah passed laws in 2025, and Maine followed in April 2026. In 2026, Tennessee’s SB 1580 (effective July 1, 2026) barred representing an AI system as a qualified mental health professional, and Rhode Island Governor Dan McKee signed AI mental health laws on June 22, 2026. Illinois is the one most relevant to documentation: AI that records or transcribes a session requires the client’s written, informed, revocable consent.

The Illinois Wellness and Oversight for Psychological Resources Act (HB 1806, Public Act 104-0054), signed August 4, 2025, bars AI from making independent therapeutic decisions, directly interacting with clients in therapeutic communication, or generating treatment plans without a licensed professional’s review. Nevada’s AB 406, signed June 5, 2025, and effective July 1, 2025, limits providers to administrative uses of AI, with penalties up to $15,000 per violation. Utah’s HB 452, effective May 7, 2025, regulates mental health chatbots through disclosure and data rules. Maine’s LD 2082 was signed April 13, 2026. California’s 2025 laws focus on companion chatbots and on AI implying it holds a license. We did not find an enacted Alabama statute on AI in psychotherapy as of October 2026. For telehealth, the law of the state where the client sits matters, so an Alabama clinician seeing a client in Illinois under a compact privilege or license would need Illinois-compliant consent.

The ethics codes of APA, ACA, NASW, and AAMFT already require informed consent, competence, and confidentiality, and each association has published or is developing guidance on AI in clinical work. A practice that bills Medicare or Medicaid should also know about 45 CFR 92.210 under Section 1557, which since May 1, 2025 has required covered entities to make reasonable efforts to identify and reduce discrimination risks in patient care decision support tools.

Is Alabama a one-party consent state for recording sessions?

Yes. Alabama Code section 13A-11-30 defines eavesdropping as recording a private communication without the consent of at least one participant, and section 13A-11-31 makes criminal eavesdropping a Class A misdemeanor. A clinician who is a party to the session can legally record it under Alabama law.

That does not settle the clinical or interstate question. California, Florida, Maryland, Massachusetts, Pennsylvania, and Washington are among the states that generally require every party to consent, and a telehealth client may be sitting in one of them. Licensing boards and ethics codes also expect informed consent before recording. Get documented, written consent from every client before any recording or AI transcription, with a plain description of the tool, what it does, how long audio is kept, and how to withdraw consent.

Can I use tracking pixels and online booking on a therapy website?

On public marketing pages, the legal risk dropped after a court vacated part of OCR’s tracking guidance in 2024. On patient portals, intake forms, booking flows, and any page behind a login, tracking tools that send client information to a vendor without a BAA create HIPAA exposure. Keep analytics pixels off those pages.

OCR’s bulletin on online tracking technologies, issued in December 2022 and updated in March 2024, said that IP addresses and other identifiers collected on certain pages can be protected health information. In AHA v. Becerra, decided June 20, 2024, the Northern District of Texas vacated the part of the guidance covering unauthenticated public pages visited by someone looking for information about a condition. The court did not touch the guidance on authenticated pages. A Meta Pixel or Google Analytics tag on a booking confirmation page or an intake form can still send identifiable information about a person seeking mental health care.

The Federal Trade Commission has acted against mental health companies that shared health data for advertising. BetterHelp paid $7.8 million in 2023, Cerebral agreed in 2024 to pay more than $7 million, and Monument received a 2024 order that included a suspended $2.5 million penalty. The FTC’s Health Breach Notification Rule, updated in 2024, covers health apps and services not covered by HIPAA, which matters for practices that sell digital products or run wellness apps outside their clinical work. For a private practice site: use a booking widget and contact form from a vendor that signs a BAA, keep pixels off intake and booking pages, ask only for minimal information on contact forms, and check what your tag manager actually fires.

Is texting and emailing clients HIPAA compliant?

It can be. HIPAA permits unencrypted email and text when a client prefers it after being told the risk, and HHS guidance says providers may honor that preference. Document the warning and the client’s choice, keep message content minimal, and move clinical conversations into a secure portal covered by a BAA.

Clients also have a right to request confidential communications under 45 CFR 164.522(b), such as messages only to a work email or no voicemail at home, and providers must accommodate reasonable requests. Since OCR’s telehealth enforcement discretion ended on May 11, 2023 (with a transition period through August 9, 2023), telehealth must run on a platform that signs a BAA. Consumer video apps used during the pandemic no longer have that cover.

How do I complete a HIPAA risk analysis with free tools?

Start with the free HHS Security Risk Assessment Tool, which was built for small practices, and use NIST SP 800-66 Revision 2 as the reference framework. Document every system that holds client data, the threats to each, current safeguards, and a dated plan to fix the gaps. Repeat it whenever systems change.

A risk analysis is not a one-time form. It should cover every place client information lives: EHR, email, phones, laptops, home offices, contractors’ personal devices, AI tools, backups, and paper. The risk management plan that follows should state who fixes what and by when. OCR has said its Risk Analysis Initiative now includes risk management, so identifying a gap without acting on it is no longer enough.

• HHS and ONC Security Risk Assessment Tool: a free, guided questionnaire for small and medium practices.
• HHS 405(d) Health Industry Cybersecurity Practices (HICP): practical safeguards scaled for small organizations.
• HHS Healthcare and Public Health Cybersecurity Performance Goals: a short list of essential and enhanced controls.
• NIST SP 800-66 Revision 2 (February 2024): the federal guide to implementing the Security Rule.

Public Law 116-321, signed January 5, 2021, requires OCR to consider whether a regulated entity had recognized security practices in place for the previous 12 months when deciding penalties and audit outcomes. Documented use of the 405(d) practices or NIST frameworks can therefore reduce exposure after an incident. Cyber insurers now commonly ask about MFA, tested offline or immutable backups, and endpoint detection and response before they will write or renew a policy. Those questions are a reasonable minimum standard even before the Security Rule changes.

What do recent OCR enforcement cases show?

The same finding keeps appearing: no accurate and thorough risk analysis. OCR’s Risk Analysis Initiative reached its 14th enforcement action in June 2026, and behavioral health and substance use providers are among those settling. Most cases begin with a breach report, often ransomware or phishing, followed by an investigation that finds missing foundational safeguards.

OCR also continues its Right of Access Initiative, which had produced more than 50 enforcement actions by January 2026, with 2026 settlements including Azul Vision for $50,000. For a therapy practice, that means answering access requests in writing and on time, and charging only permitted fees. OCR Director Paula M. Stannard has said both initiatives will continue in 2026 and that risk analysis enforcement now extends to risk management.

What are the current HIPAA penalty amounts?

These amounts apply to penalties assessed on or after January 28, 2026. Under a 2019 notice of enforcement discretion, OCR applies lower annual caps for the first three tiers, adjusted for inflation. State attorneys general can also bring HIPAA actions, with separate statutory damages.

Alabama-specific requirements for private practice

Alabama adds a breach notification statute, one-party recording consent, licensing board rules that shape who can practice independently, and no AI-in-therapy statute as of October 2026. HIPAA-covered practices that follow the federal breach rule are exempt from most of the state act, but must still copy the Attorney General on large breaches.

Phased HIPAA checklist for private practice

The sequence below puts current legal requirements first, then the controls insurers and OCR already expect, then preparation for a final Security Rule. A solo practice can usually finish Phase 1 in a few working sessions. Group practices need more time for contractor decisions and offboarding procedures.

Phase 1: Now (current legal requirements)

• Complete or update a written risk analysis covering every system, device, contractor, and AI tool that touches client data.
• Write a risk management plan with owners and dates for each gap.
• Inventory vendors and collect a signed BAA from each business associate, including AI scribes, e-fax, answering services, and IT support.
• Confirm unique logins for every user, with no shared accounts, and turn on automatic logoff.
• Separate psychotherapy notes from progress notes in the EHR and limit access to the author.
• Review the Notice of Privacy Practices for Part 2 language if you receive Part 2 records, remove vacated reproductive health language, and confirm the notice is posted prominently on your website.
• Group practices: decide, in writing, whether each 1099 clinician is treated as workforce or as a business associate.

Phase 2: Next six months

• Turn on MFA for EHR, email, telehealth, billing, and remote access, including any contractor devices.
• Confirm encryption on laptops, phones, and backups, and test restoring from backup.
• Adopt a written AI policy: approved tools only, BAA required, written client consent before recording or transcription.
• Remove tracking pixels from booking, intake, and portal pages.
• Document client preferences for unencrypted text or email after giving the risk warning.
• Group practices: write an offboarding checklist that ends all access on the last day and documents device wipes and personal-device purge confirmations.
• Train every workforce member and keep a signed record.

Phase 3: Before a final Security Rule

• Build a technology asset inventory and simple network map.
• Write an incident response plan and a contingency plan that names which systems must come back first.
• Arrange periodic vulnerability scanning through your IT provider.
• Ask business associates for written confirmation of their safeguards and update BAAs to include contingency plan notice terms.
• Set a calendar reminder to review the rule when it is published, since the compliance window may be about eight months.

Frequently asked questions

Sources

• Federal Register: HIPAA Security Rule proposed rule, 90 FR 898 (January 6, 2025)
• HHS fact sheet on the Security Rule proposed rule
• Clark Hill analysis of the move to Long-Term Actions and the July 2027 target
• Congress.gov: S. 3315, Health Care Cybersecurity and Resiliency Act
• GovInfo: Senate-passed text of S. 3315
• HHS: Confidentiality of Substance Use Disorder Patient Records (Part 2)
• Haynes Boone on Purl v. HHS and the dismissed appeal
• Reginfo.gov: Privacy Rule coordinated care final rule under OMB review (RIN 0945-AA00)
• Federal Register: 2026 Unified Agenda introduction
• Federal Register: 2000 Privacy Rule preamble on workforce and independent contractors
• HHS FAQ on treating onsite contractor staff as workforce
• HHS press release: Top of the World Ranch Treatment Center settlement
• HHS press release: MMG Fusion settlement
• Saul Ewing on the Deer Oaks settlement
• HIPAA Journal on the Green Ridge Behavioral Health settlement
• Nixon Peabody on the 14th Risk Analysis Initiative action
• Mercer summary of the January 28, 2026 penalty adjustment
• eCFR: 45 CFR 164.501 definitions, including psychotherapy notes
• Illinois General Assembly: HB 1806 bill status
• Alabama Code 8-38-11, federal exemption to the breach notification act
• Alabama Code 13A-11-30, eavesdropping definitions
• NIST SP 800-66 Revision 2
• HHS and ONC Security Risk Assessment Tool
• HHS 405(d) program and HICP resources
• HHS OCR guidance on online tracking technologies
• HHS Breach Notification Rule overview
• Nixon Peabody on the DOL proposed independent contractor rule

This article is educational commentary from a clinician and practice owner. It is not legal advice and does not create an attorney-client relationship. HIPAA, Part 2, state privacy law, and employment classification depend on facts specific to each practice. Consult a healthcare attorney licensed in your state before changing contracts, policies, or contractor arrangements.