Example Engagement: Securing Therapy Records and Telehealth at a Behavioral Health Practice

The practice is a group behavioral health practice in Pasadena, California. Eight licensed therapists — psychologists, clinical social workers, and marriage and family therapists — see a combined 180 to 200 patients per week for individual therapy, couples counseling, family therapy, adolescent treatment, and psychiatric medication management. It employs 14 people including the therapists, a psychiatric nurse practitioner, a practice manager, intake coordinators, and a billing specialist.

Sixty percent of the practice's sessions are conducted via telehealth. The shift started during the pandemic and stuck — patients prefer the convenience, therapists appreciate the schedule flexibility, and the practice can serve clients across a wider geographic area. Telehealth isn't a supplement to in-person care at the practice. It's the majority of the business.

The problem: the entire telehealth operation ran on infrastructure that wouldn't survive basic scrutiny — and the data it carried was the most sensitive category of health information that exists.

Therapy Records Carry the Highest Legal Protections

Psychotherapy notes receive heightened protection under HIPAA §164.508. They cannot be released without specific patient authorization — not even to other healthcare providers, insurance companies, or family members. They're separated from the general medical record by law. A breach of therapy notes doesn't just trigger HIPAA fines — it can destroy the therapeutic relationship, expose deeply personal information, and cause lasting harm to patients who sought help for depression, anxiety, trauma, addiction, and relationship crises.

The practice stored therapy notes, session recordings, intake assessments, psychological evaluations, medication records, and treatment plans in an EHR system running on a local server. The server had no encryption at rest. No access logging beyond basic EHR audit trails. No network segmentation between the therapy records and the rest of the office systems. It manager and billing specialist had the same level of access as the therapists — they could read any patient's therapy notes, even though they had no clinical reason to do so.

Three therapists kept supplementary session notes in personal Google Docs — observations, treatment reflections, and case conceptualizations that contained PHI. Two of them shared these docs with their clinical supervisors through personal Gmail accounts. None of these documents were encrypted, access-controlled, or covered by a BAA with Google.

Telehealth Was Running on Consumer Tools

The practice conducted 110 to 120 telehealth sessions per week using standard Zoom accounts. No BAA with Zoom. No end-to-end encryption configured for healthcare. No EHR integration — therapists manually entered session notes after each video call. Session recordings, when saved for supervision purposes, sat in Zoom's cloud storage with no access controls and no retention policy.

Two therapists used FaceTime for sessions with patients who had trouble with Zoom. FaceTime offers no BAA, no audit logging, no recording capability, and no integration with any healthcare system. Using it for therapy sessions was a HIPAA violation for every single call.

The Wi-Fi network at the office was a single consumer network shared between therapy rooms, the waiting area, administrative workstations, and the practice manager's personal devices. A patient sitting in the waiting room was on the same network as the servers storing therapy records and the workstations conducting telehealth sessions.

HIPAA Compliance Was a Fiction

The practice had no security risk assessment. No written policies addressing the heightened protections required for psychotherapy notes. No Business Associate Agreements with any vendor — not Zoom, not Google, not the EHR company, not the billing clearinghouse, not the e-prescribing service for the NP's psychiatric medications. No staff training. No breach response plan.

For a practice where 60% of patient encounters happen over video and the records contain the most legally protected category of health information, the compliance gap was alarming — and each therapist carried individual professional liability exposure for using non-compliant tools.

Intake No-Shows Were Killing Growth

Behavioral health practices face a unique scheduling challenge: the intake appointment. A new patient's first therapy session requires a 60 to 90-minute evaluation — intake history, symptom assessment, treatment planning, and informed consent. These sessions can't be double-booked. When a patient no-shows an intake, the therapist loses an hour-plus of billable time that can't be backfilled on short notice.

The practice's intake no-show rate was 38%. More than one in three new patients who scheduled an initial session didn't show up. The reasons were predictable: the stigma and anxiety of starting therapy, long wait times between scheduling and the actual appointment, and no follow-up or support between booking and showing up.

At an average intake session value of $225, the no-show rate cost the practice $4,500 to $5,400 per month — over $55,000 per year in lost revenue from empty intake slots alone. And each no-show represented a patient who needed help and didn't get it.

The practice had no automated reminder system. Intake coordinators manually called each new patient the day before their appointment. With 25 to 30 intake sessions per week, the coordinators spent hours on calls — and reached voicemail more often than patients. Many patients found it awkward to confirm a therapy appointment over the phone at work. They let it go to voicemail and never called back.

The Phones Didn't Match the Sensitivity of the Practice

The practice received 50 to 60 calls per day. The call mix was sensitive: prospective patients calling about therapy (often nervously, sometimes in crisis), existing patients scheduling or rescheduling, insurance inquiries, referral requests from physicians, and medication refill requests for the NP's patients.

Two intake coordinators managed the phones while handling scheduling, insurance verification, and new patient paperwork. During busy periods, calls went to a generic voicemail. For someone working up the courage to call a therapist for the first time, reaching voicemail is often the end of the conversation. They don't call back.

After hours, every call went to voicemail. Mental health crises don't follow business hours. While the practice didn't operate a crisis line, they regularly received calls from patients in distress after 5 PM — patients who needed to hear a helpful voice and be connected to appropriate resources, not a recording.

We assessed the practice over three days — every device, every network path, every telehealth workflow, every data storage system, every vendor relationship, and every compliance document. The findings: therapy records with no encryption or access controls, 120 weekly telehealth sessions on non-compliant platforms, session notes in personal Google Docs, zero HIPAA compliance, a 38% intake no-show rate, and phones that turned away the patients who needed help most.

We designed a 45-day plan addressing cybersecurity, HIPAA compliance, managed IT, and patient communications. For a behavioral health practice, privacy isn't just a legal requirement — it's the foundation of the therapeutic relationship.

Cybersecurity: Protecting the Most Sensitive Records in Healthcare

• Therapy record encryption — enabled encryption at rest on the EHR database and all backup systems. Psychotherapy notes are now stored in an encrypted environment that requires authentication to access — even if the physical server were stolen, the data would be unreadable.
• Role-based access controls — reconfigured the EHR so that only treating therapists can access their own patients' psychotherapy notes. The practice manager and billing specialist can access demographic, insurance, and billing information but cannot view session notes or clinical documentation. Access attempts are logged and auditable.
• Personal document remediation — identified therapy notes in 3 therapists' personal Google Docs and 2 personal Gmail accounts. All documents were migrated to the encrypted EHR system and securely deleted from personal accounts. Therapists now use the EHR's built-in notes module for all clinical documentation.
• Endpoint detection and response (EDR) on every workstation — active threat monitoring across all devices. Our cybersecurity stack provides the protection that therapy records demand.
• Network segmentation — split the single Wi-Fi into four isolated segments: clinical (EHR, telehealth workstations), administrative, therapist devices, and waiting room/guest Wi-Fi. A patient in the waiting room can no longer reach the systems storing therapy records.
• Email security gateway — encrypted email for any communication containing PHI. Blocks phishing and malicious attachments.
• Multi-factor authentication on every account. Shared logins eliminated.
• Quarterly security awareness training with behavioral health-specific phishing simulations — fake insurance verification requests, spoofed patient portal messages, and counterfeit EHR login pages.

HIPAA Compliance: Psychotherapy Note Protections Built In

• Full security risk assessment — documented every system, every data flow, and every vendor. Special attention to psychotherapy note storage, telehealth session recording, and the legal distinction between therapy notes and general medical records under §164.508.
• 17 written policies and procedures — including behavioral health-specific policies for psychotherapy note access, telehealth session documentation, session recording retention and destruction, client consent for electronic communications, and the practice's obligations under both HIPAA and applicable state mental health privacy laws.
• Business Associate Agreements — identified 8 vendors who handle PHI (EHR vendor, telehealth platform, e-prescribing service, billing clearinghouse, cloud backup, email provider, intake form software, and IT suppliers) and executed signed BAAs with each. Consumer Zoom and FaceTime — which cannot provide BAAs — were replaced.
• Staff HIPAA training — all 14 employees completed training with documented sign-off. Training covered the heightened protections for psychotherapy notes, proper telehealth documentation, session recording rules, and the specific risks of using personal tools for clinical work.
• Breach response plan — playbook with specific procedures for therapy record incidents, including the unique notification considerations when psychotherapy notes are involved.

Managed IT: Telehealth Infrastructure That Actually Works

• HIPAA-compliant telehealth platform — replaced consumer Zoom and FaceTime with a healthcare-grade video platform. End-to-end encryption. BAA signed. EHR integration for automatic session documentation. Secure screen sharing for treatment planning exercises. No session recordings stored in consumer cloud accounts.
• Cloud migration — moved the EHR from the local server to a HIPAA-compliant cloud environment with encryption at rest and in transit. Automatic failover. No single point of failure.
• 24/7 remote monitoring and management across all workstations and network equipment. Automated patch management.
• Cloud backup with immutable storage — therapy records, session documentation, and billing data replicate hourly to a geographically separate data center. Monthly verified restore tests.
• Dedicated help desk — therapists get immediate support for telehealth technical issues during sessions. A frozen video call during a therapy session isn't just an inconvenience — it disrupts the therapeutic process.

AI Receptionist: Sensitive Intake, No Stigma, No Voicemail

We deployed an AI-powered phone receptionist configured specifically for the sensitivity and stigma considerations of a behavioral health practice.

• Compassionate first contact — the AI is configured with warm, non-clinical language appropriate for callers who may be anxious, in distress, or making the hardest phone call of their lives. It doesn't sound like a medical office. It sounds like a helpful, patient person who understands that calling a therapist takes courage.
• Intake scheduling with smart matching — the AI collects the caller's general concern (without requiring clinical details over the phone), insurance information, scheduling preferences, and whether they prefer in-person or telehealth. It matches them with an available therapist based on specialty, insurance panels, and modality preference. It books the intake appointment and sends a confirmation text with pre-appointment paperwork links.
• Automated intake reminders — multi-touch reminder sequence at 72 hours, 24 hours, and 2 hours before the intake. Messages are carefully worded to avoid revealing treatment details — "Reminder: you have an appointment at the practice Counseling tomorrow at 2 PM" — without mentioning therapy, mental health, or clinical details. Patients confirm via text reply.
• After-hours coverage — callers after 5 PM who want to schedule an appointment can do so immediately. Callers in distress receive the national crisis line number (988) and are offered the option to leave a confidential message for a callback the next business day. The AI does not attempt to provide clinical support — it connects people to the right resource immediately.
• Privacy by design — the AI never discusses clinical details, diagnosis, or treatment over the phone. It doesn't confirm whether someone is a current patient to unauthorized callers. It handles scheduling and logistics while protecting the confidentiality that behavioral health patients require.

The full deployment was completed in 45 days. Every step followed our healthcare IT framework with additional safeguards for behavioral health data. Small practices can see exact monthly rates on our pricing page.

Cybersecurity: Therapy Records Locked Down

Few record types carry more potential for harm than psychotherapy notes. They move behind encryption, access control and audit logging, with endpoint protection, email filtering and MFA across the practice — so the answer to who can open a session note is specific rather than "everyone with a login".

HIPAA: Psychotherapy Notes Treated as the Special Case They Are

Psychotherapy notes have protections above the standard HIPAA baseline, and most compliance templates do not reflect that. Policies, BAAs, risk assessment and training address the distinction directly, alongside the 42 CFR Part 2 considerations that apply where substance use treatment is involved.

Managed IT: Telehealth That Works Every Session

When most sessions are remote, connectivity is clinical infrastructure. Network and endpoint work makes sessions reliable, because a dropped call in the middle of trauma work is not a technical inconvenience.

AI Receptionist: Intake Actually Converts

People reaching out for mental health support often do it once, quietly, and do not try again if nothing answers. The AI receptionist responds immediately, books intake, and sends reminders ahead of the first appointment — the point where behavioural health practices lose the most people.

Running a behavioral health practice with therapy records on unprotected systems and intake patients disappearing before their first session? Book a free consultation and we'll assess your telehealth security, compliance, IT infrastructure, and patient intake workflow.