Mental Health Practice HIPAA Compliance Cost in 2026

Mental health is the segment where the EHR is most of the compliance stack, and happily it is also the segment where the EHR vendors actually publish their prices. What mental health adds beyond a typical ambulatory practice is not tooling but two legal structures: the psychotherapy-notes carve-out under 45 CFR 164.508(a)(2), the only PHI category where treatment, payment and operations need explicit authorization, and, for practices treating substance use disorder under federal funding, the 42 CFR Part 2 overlay. Both are configuration and workflow problems rather than purchases, which is why this page prices the EHR layer from the vendors' own cards and is explicit that the rest is quoted.

The good news for a solo practitioner is that the left-hand column is genuinely small and genuinely knowable. The failure modes on this page are almost all in the right-hand column, and most of them cost nothing to fix and a great deal to get wrong.

The psychotherapy-notes carve-out

Psychotherapy notes are a defined PHI category under 45 CFR 164.501. The definition is narrower than most clinicians assume: notes recorded by a mental health professional that document or analyze the contents of a counseling session, kept separate from the rest of the medical record. The carve-out specifically excludes medication prescription and monitoring, counseling session start and stop times, modalities and frequencies of treatment furnished, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress.

Translation: the things you must keep in the general medical record (so they are released with regular records requests) are the diagnosis, the treatment plan, the medications, the session-summary observations, and the prognosis. Psychotherapy notes are the more granular reflective notes the therapist keeps separately for their own treatment-planning use. The protection is meaningful only if the separation is real in the EHR.

Under 45 CFR 164.508(a)(2), use or disclosure of psychotherapy notes requires a separate written authorization, except for the originating therapist's own treatment, the practice's training of mental health professionals, defense in a legal proceeding brought by the patient, or as required by law. This is the only PHI category where treatment, payment, and operations require explicit authorization rather than the standard exception.

This is an informational cost reference, not legal or compliance advice. Consult a healthcare attorney or HIPAA-qualified compliance professional before making program decisions specific to your mental health practice structure.

EHR configuration cost (separation in practice)

The dominant EHRs in solo and small-group mental health practice are SimplePractice, TherapyNotes, TheraNest (now sold under Ensora Health), and ICANotes. Three of the four publish a full rate card and the fourth does not; the published rates are in the table below. Each supports a separate psychotherapy-notes section that is excluded from standard records exports by default, and configuration is a one-time setup with workforce training.

The cost is not the EHR feature; the cost is workflow discipline. Three failure modes drive most psychotherapy-notes incidents:

Mode 1: Mixing psychotherapy notes content into the general progress note. A clinician writes the patient's detailed internal conflict, transference observations, or reflective analysis directly in the progress note rather than in the separate psychotherapy notes section. When a routine records request arrives (insurance, court order, patient's new therapist), that content is released without the patient's separate 164.508(a)(2) authorization.

Mode 2: Default-export including psychotherapy notes. The EHR allows the export to include either the general chart or the general chart plus psychotherapy notes. The records-release coordinator selects the wrong option. The fix is to set the default export to exclude psychotherapy notes and to require explicit user action to include them.

Mode 3: Workforce role access not restricted. The receptionist and billing staff do not need access to psychotherapy notes for treatment, payment, or operations purposes. EHR role-based access should restrict psychotherapy notes to clinicians only. Reviewing this configuration during the annual risk assessment is the cost-free fix.

42 CFR Part 2 substance use disorder stacking

Mental health practices that include a federally-assisted SUD-treatment program have a second compliance overlay under 42 CFR Part 2. Part 2 is administered by SAMHSA and protects records of patients in federally-assisted SUD programs. The federal-assistance trigger is broad: Medicaid certification, Medicare certification, federal grant funding, federal license (DEA registration for opioid-treatment programs), or operation by a federal entity.

The SAMHSA-HHS final rule published February 2024 (effective 16 April 2024) aligned Part 2 with HIPAA in significant operational ways including permitting single patient consent for all future TPO uses, allowing redisclosure within HIPAA-compliant systems, and harmonizing breach-notification standards. Despite this alignment, the patient-consent baseline for redisclosure outside HIPAA-compliant TPO purposes remains stricter than HIPAA and the records protected under Part 2 retain their special status.

Part 2 adds four pieces of work on top of the HIPAA baseline. None of them has a published price, so what follows is the scope to take to your vendor and your counsel rather than a budget:

• EHR configuration to flag Part 2 records and require Part 2-compliant consent before release. Often included with SUD-specific EHRs, so ask your vendor before you assume this is a purchase.
• Counsel review of Part 2 consent forms and redisclosure-prohibition notices. A one-time engagement, and the one piece here that genuinely needs a lawyer.
• Workforce training on Part 2-specific procedures, incremental over standard HIPAA training.
• Extending the annual risk assessment to cover the Part 2 scope.

What drives the total is consent-tracking volume rather than practice size as such, which is why larger SUD programmes (intensive outpatient, residential, opioid-treatment) trend higher: more consents, more redisclosure decisions, more places for one to go wrong. If you want to size this before calling anyone, count the release-of-records requests you handle in a month and ask how many of them would touch a Part 2 record.

The EHR layer, as published

Behavioral health is unusual in healthcare software: its EHR vendors publish real rate cards, where Epic, Oracle Health and MEDITECH publish nothing at all. Three of the four below do. Every figure is read off the vendor's own surface and checked July 2026.

Sources: simplepractice.com/pricing and icanotes.com/pricing, both checked July 2026. The TherapyNotes figures come from TherapyNotes' own pricing and subscription article rather than from its pricing page, because that page renders its figures client-side and serves an empty shell to anything that is not a browser. Two notes on the units. SimplePractice publishes its solo plans billed monthly only, with no annual-billing option, which is the reverse of most compliance software and means there is no annual discount to model. ICANotes prices by user type rather than by feature tier, so the question that sets your bill is how many of your clinicians prescribe: its prescribing rate is close to four times its full-time Notes Only rate. Part-time rates are published on both cards with monthly note caps attached.

What those rates work out to

None of this is the expensive part of a mental-health HIPAA programme. The risk analysis, the state-law counsel and the psychotherapy-notes configuration audit are, and none of them publishes a rate.

Telehealth: the post-discretion reality

The HHS OCR Notification of Enforcement Discretion for Telehealth was wound down effective 11 August 2023. Mental health practices that adopted FaceTime, Skype consumer, Google Hangouts consumer, or similar consumer-grade platforms during the pandemic and continued past the wind-down are technically operating non-compliant videoconferencing. The fix is migration to a BAA-eligible platform, which most solo-practitioner EHRs include at no incremental cost.

The BAA-eligible platforms commonly used in mental-health telehealth are Doxy.me, Zoom's healthcare offering, Microsoft Teams with the Microsoft 365 BAA executed, Google Workspace with the BAA executed, and the embedded video in SimplePractice, TherapyNotes and ICANotes. The dedicated telehealth market is harder to price than that list suggests, and both of the names usually quoted with figures attached turn out not to publish one. Zoom's healthcare pricing page, checked July 2026, publishes no price at all: it offers Contact Sales and a demo. Any per-host figure you see quoted for “Zoom for Healthcare” is a general Zoom Workplace rate wearing the healthcare product's name, and the two are not the same purchase. Doxy.me publishes one named paid tier, Premium, on the unit “per user / month, billed annually”, and it renders the figure itself client-side, so the page is citable for the dimension and not for the amount. Note the unit is per user rather than per provider, and that its free tier makes no BAA claim: the “BAA included” line sits inside the Premium feature list.

The practical consequence for a mental-health practice is that the telehealth question is usually already answered by the EHR you bought. ICANotes publishes its telehealth add-on at $20 per month per user, and SimplePractice and TherapyNotes both include or offer video within their subscriptions, all checked July 2026. A practice buying a standalone platform on top of an EHR that already includes one is paying twice for the same control.

Multi-state telehealth practice adds state licensure cost as a separate matter. State Medical Board fees, professional-licensure-compact memberships (Psychology Interjurisdictional Compact PSYPACT, Counseling Compact, Social Work Licensure Compact), and CME requirements vary by state. While not strictly a HIPAA cost, multi-state practices typically engage state-specific counsel for HIPAA records-release procedure variance. No firm publishes a rate for that work, so this page prints no figure; what you can plan around is that it scales with your state count rather than with your patient volume, so each additional state of licensure is a fresh counsel engagement rather than a marginal one.

Mental health HIPAA cost FAQ

Related cost guides