Compliance is the part of private practice most likely to be described in a tone of dread. Some of that is warranted. The rules are real and the consequences can be serious. But a lot of compliance content is written to sell reassurance, and it blurs the line between what the law requires of a solo clinician and what a large health system has to do. Here’s the floor.
The non-negotiables
Informed consent before treatment, consistent with your licensing board’s rules and your professional code. A written notice of privacy practices, if you’re a HIPAA covered entity. A Good Faith Estimate for clients who are uninsured or choose not to use insurance. Records kept securely and retained for the period your state requires. And a plan for crises, written down before you need it.
Are you a HIPAA covered entity?
Here’s where a lot of anxiety is misplaced. Under HHS’s definition, a health care provider is a covered entity when it transmits health information electronically in connection with standard transactions, such as billing insurance electronically. A purely private-pay clinician who never does that may not be a covered entity at all. That doesn’t make confidentiality optional. Your license, your ethics code, and state law, which in Wisconsin protects mental health records under Wis. Stat. 51.30, still apply. Most clinicians follow HIPAA practices anyway, because they’re a sound standard and because a practice that later takes insurance becomes covered.
The Good Faith Estimate in plain terms
Under the No Surprises Act, you give uninsured and self-pay clients a written estimate of expected charges. For a service scheduled at least three business days out, it’s due within one business day of scheduling; for one scheduled ten or more business days out, within three. For ongoing therapy, one estimate can cover up to twelve months. If the final bill comes in $400 or more above the estimate, the client can start a dispute process. The estimate needs specific elements, including expected service codes and charges, your NPI and tax ID, and the dispute rights.
Where state law is stricter
Federal rules set a floor. States can go further, and mental health records often get more protection than other health records. Minors, release of information, and record retention are where state rules most often differ, so check your own state on each.
A one-page compliance floor
Write down, on one page, how you handle each of these: consent, privacy notice, Good Faith Estimates, record storage and retention, release of information, and crisis response. If you can’t fill in a line, that’s your next task. If you can fill in all six, you’re in better shape than most new practices, and you didn’t need to be afraid to get there.