HIPAA Compliance Kit for Therapists (2026)

A HIPAA and 42 CFR Part 2 compliance kit for therapists: an updated notice of privacy practices, a business associate agreement template, a risk analysis and a breach protocol.

What is in the kit

• The 2026 compliance environment explained: the Part 2 Final Rule as current law and immediate obligation, and the Security Rule proposal as forward-looking with a compliance window after finalization
• Who qualifies as a Part 2 program, and the safest assumption for mental health practices doing dual-diagnosis work
• Late-start remediation guidance for practices that missed the February 2026 deadline
• An updated notice of privacy practices template with Part 2 language already integrated, ready to brand to your practice, plus sample patient acknowledgment wording and retention requirements
• Distribution and documentation requirements covering waiting area, website, current patient distribution and six-year retention
• A business associate agreement template aligned to current rules, including Part 2 redisclosure restrictions and the criminal-proceedings prohibition
• A vendor list covering who needs an agreement and who does not, plus a vendor inventory spreadsheet template with a sample entry
• An annual risk analysis workbook with nine NIST-aligned elements, an asset inventory worksheet, a risk register with sample entries, and a remediation plan template with owner and due date columns
• A breach notification decision tree covering the HIPAA and Part 2 differences, the four-factor breach risk assessment, and an hour-by-hour and day-by-day response timeline from containment through the 60-day notification deadline
• A notification letter content checklist, a worked small-breach scenario with full four-factor analysis, and a ransomware-specific response protocol
• Administrative, physical and technical safeguards checklists keyed to the relevant sections, with current versus proposed Security Rule status flagged
• The new requirements under the proposed Security Rule, including multi-factor authentication for all workforce, encryption at rest and in transit, network segmentation, annual penetration testing, regular vulnerability scanning, a 15-day patch window for critical vulnerabilities, and a written asset inventory
• Telehealth-specific safeguards covering platform agreements, private location, identity verification, recording consent and transport security
• A workforce training content outline for 2026 and a four-tier sanctions policy with violation examples, sample policy language, an attestation form and non-retaliation protection language
• A 60-day implementation timeline week by week, plus the recurring cadence afterwards for audit logs, backup restores, phishing simulations, training, risk analysis, agreement review and penetration testing
• 2026 penalty exposure figures, an OCR audit response protocol, and what-to-do-when callouts at the end of every chapter

Who it is for

• Mental health, behavioral health and substance use treatment practices that create or receive substance use records
• Primary care and integrated behavioral health practices that hold those records even incidentally
• Practice owners and compliance officers verifying that an existing program covers the Part 2 changes
• Solo private-practice clinicians who serve as their own privacy and security officer
• Group practices and clinical directors building or refreshing the compliance program
• Business associates that handle substance use records on behalf of Part 2 programs
• Medication-assisted treatment clinics and opioid treatment programs
• Practices that missed the February 2026 deadline and need a structured catch-up

Why it exists

February 16, 2026 was the compliance deadline for the 42 CFR Part 2 Final Rule, and OCR began accepting Part 2 complaints under the new Civil Enforcement Program on the same date. If your practice creates or receives any substance use disorder records, including dual-diagnosis work where substance use shows up in the chart, your Notice of Privacy Practices needs Part 2 language, your business associate agreements need updated provisions, and your breach notification procedures need to account for Part 2 protections. Most small practices have not done this work and most do not realize their existing program is out of compliance.

This is the practice-side compliance kit I built when I went through the same review for my own practice. An updated notice of privacy practices with Part 2 language already integrated, a current business associate agreement template, an annual risk analysis workbook with the nine NIST elements, a breach notification decision tree that handles the HIPAA and Part 2 differences, administrative and technical safeguards checklists keyed to both current law and the proposed Security Rule update, a workforce training outline with a four-tier sanctions policy, and a 60-day implementation timeline that gets a late-starting practice to substantial compliance.

36 pages. Fillable PDF plus editable Word. Aligned with the 42 CFR Part 2 Final Rule, the HHS notice of proposed rulemaking on the HIPAA Security Rule, 45 CFR Parts 160 and 164, NIST SP 800-66 Rev 2, and HHS OCR enforcement and audit guidance. 2026 penalty figures throughout.

Why this is different

Most HIPAA compliance products on the market predate 2024 and do not include the Part 2 Final Rule changes that became enforceable in February 2026. This kit is built around the 2026 compliance state, with the Part 2 update integrated through every document and the proposed Security Rule clearly labeled as forward-looking, so you can tell what is required now from what you should prepare to do.

The notice template matters because the 2024 Part 2 update added required language about the single-consent model and the prohibition on use in criminal proceedings, and most notices in circulation predate it.

The agreement template matters because the same update extended business associate obligations to vendors handling substance use records, and most existing agreements include neither the redisclosure restrictions nor the criminal-proceedings prohibition.

The risk analysis workbook matters because the most common Security Rule violation OCR audits find is the absence of a written, dated, signed risk analysis. Running through the workbook once produces an audit-defensible document.

The breach decision tree matters because the federal clock starts at discovery and the four-factor analysis must be documented in writing.

The 60-day timeline matters because late compliance is far better than ongoing non-compliance, and OCR audits look favorably on documented good-faith remediation.

Format

• Editable, fillable PDF (36 pages)
• Editable Microsoft Word (.docx, 36 pages)
• Notice, agreement, sanction policy, attestation and risk analysis worksheets copy directly into practice templates and shared-drive folders
• US Letter and A4 sizes both included
• Works on Mac, Windows, iPad, GoodNotes, Notability
• Lifetime access, unlimited prints

Updated 2026

The Part 2 Final Rule reflects the Federal Register publication of February 2024 and the February 2026 compliance deadline. The OCR Civil Enforcement Program reflects the February 2026 announcement. The Security Rule proposal reflects the December 2024 publication. Civil monetary penalty figures reflect OCR amounts effective January 2026. NIST SP 800-66 Rev 2 reflects current guidance. Ransomware presumption follows the HHS fact sheet. Telehealth security follows current CMS recommendations.

A note from the designer

I am a clinician who has run the same compliance review for my own practice and watched colleagues miss the Part 2 deadline because every available template predated 2024. The section I refer back to most is the breach decision tree. The section I share with every practice owner is the 60-day timeline.

This kit is a compliance reference, not legal advice. For complex situations such as large breaches, OCR audits, multi-state practice or novel vendor configurations, engage HIPAA counsel.

Digital download. No physical product ships. Reach out by email if anything does not work or if you have questions.