Mental Health Provider Services · MH-08
HIPAA Compliance Audit
Mental Health Private Practice
HIPAA-aware · Vendor-neutral · Montana-based
$1,200 – $1,800
Solo practitioner · more tiers below
2–3 weeks
Estimated, from kickoff to delivery
HIPAA risk assessment report
10–15 pages with categorized findings, gap analysis, and a prioritized remediation roadmap
Overview
A HIPAA Compliance Audit is a focused, audit-only engagement built for the realities of solo and small mental health practices—where the practitioner is often the HIPAA Security Officer, the IT department, and the front desk all at once. PRACTICE|EDGE conducts a structured review of every place client information touches technology: your practice management platform, telehealth sessions, email and text communications, cloud storage, devices, and physical workspace. The result is a clear, documented picture of exactly where you stand today and what to fix—with no obligation to have PRACTICE|EDGE, or anyone, implement the fixes.
Best Fit For
Solo and small-group mental health practitioners (therapists, counselors, psychologists, LCSWs, LPCs, LMFTs, PMHNPs) who have never had a formal HIPAA Security Rule risk assessment, who want an independent audit of their current technology and workflow before committing to remediation, or who need a documented risk assessment on file for licensing, payer, or liability purposes.
Why It Matters
10–15 pages
Written risk assessment report with findings and a prioritized roadmap
4 levels
Findings ranked critical, high, medium, or low risk
Audit-only
No obligation to have anyone implement the fixes
Most solo and small mental health practices have never conducted a formal HIPAA Security Rule risk assessment—and many are unknowingly out of compliance through consumer-grade email, unencrypted client texting, or a telehealth platform without a signed BAA. A single reportable violation can trigger fines, licensing board scrutiny, and reputational damage that a small practice cannot absorb. A documented risk assessment is also increasingly requested by malpractice insurers, licensing boards, and insurance panels during credentialing, making this audit both a protective measure and a professional due-diligence document.
Investment
| Solo practitioner | $1,200 – $1,800 |
| Group practice (2–5 providers) | $1,800 – $2,800 |
All pricing is inclusive of the complete service scope described above. A signed service agreement and 50% deposit are required to begin. The balance is due upon completion.
What’s Included
✓
Pre-engagement questionnaire and structured discovery interview covering practice setup, workflow, and current technology stack
✓
HIPAA Security Rule risk assessment: identification of all ePHI touchpoints, threats, and vulnerabilities specific to a solo or small mental health practice workflow
✓
Technology vendor inventory and BAA status review: practice management platform, telehealth platform, email provider, cloud storage, scheduling, and communication tools
✓
Encrypted communications audit: email, client texting, and telehealth platform compliance review against current BAA and encryption status
Show all the included items
✓
Cloud storage and client record storage compliance review
✓
Access control and device management audit: multi-factor authentication status, unique login practices, personal device (BYOD) exposure, and offboarding procedures
✓
Physical and administrative safeguards review calibrated for private-practice and home-office settings: session note storage, screen visibility, paper record handling, and workspace security
✓
Workforce and contractor HIPAA training status review (for group and associate-supported practices)
✓
Breach and incident history review
✓
Documented findings report: executive summary, categorized gap list (critical / high / medium / low risk), and a prioritized remediation roadmap
✓
30–45 minute debrief call to walk through findings and answer questions
Not Included in this Service
—
Remediation or implementation of any identified gaps (planned as a separate future engagement)
—
Execution of Business Associate Agreements or vendor changes
—
Drafting of HIPAA policies and procedures documentation
—
Delivery of staff HIPAA training
—
Legal representation in the event of a breach or HHS investigation
Ready to Get Started?
Not sure whether your practice has a compliance gap? Ask about our HIPAA Snapshot Call to identify your most likely areas of exposure.