Secure File Sharing for Therapists: HIPAA Compliance Made Simple

You became a therapist to help people, not to become a cybersecurity expert. But HIPAA doesn’t care—the moment you store or share any client information electronically, you’re required to meet complex security standards that carry serious penalties if violated.

Here’s what you actually need to know, without the legal jargon, and with practical solutions you can implement today.

What HIPAA Actually Requires for File Sharing

The Core Rule

If you create, receive, maintain, or transmit Protected Health Information (PHI) electronically, you must:

Ensure confidentiality, integrity, and availability of all ePHI

Translation: Keep it private, keep it accurate, and make sure clients can access it when needed.

What Counts as PHI for Therapists

Pretty much everything in a client file:

• Clinical notes (session notes, treatment plans, progress notes)
• Assessment results (intake forms, diagnostic evaluations, questionnaires)
• Client identifying information (names, contact info, SSN, insurance info)
• Correspondence (emails, messages, letters to/from clients)
• Billing information (invoices, insurance claims, payment records)
• Appointment scheduling (if it includes name + appointment time)
• Audio/video recordings (recorded sessions, assessments)

If it identifies a client AND relates to their health, it’s PHI.

The Technical Safeguards You Must Have

HIPAA requires four specific technical safeguards:

1. Access Control

• Only authorized people can access PHI
• Unique user IDs for each person
• Automatic logoff after inactivity
• Encryption when required

2. Audit Controls

• Log who accessed what information and when
• Be able to review these logs

3. Integrity Controls

• Ensure PHI isn’t improperly altered or destroyed
• Detect unauthorized changes

4. Transmission Security

• Encrypt PHI sent over networks
• Protect against unauthorized access during transmission

What Therapists Actually Share

With Clients

• Intake forms and consent forms
• Homework assignments
• Psychoeducational materials
• Treatment plan updates
• Billing statements
• Discharge summaries
• Letters of support (for accommodations, ESA, etc.)

With Other Providers (With Consent)

• Progress reports
• Treatment plans
• Assessment results
• Consultation notes
• Referral information

With Insurance

• Claims documentation
• Treatment authorizations
• Progress reports
• Clinical justification

HIPAA-Compliant File Sharing Options

Option 1: Client Portal with BAA (Best Practice)

What You Need:

• Provider signs Business Associate Agreement
• End-to-end encryption
• Access controls (password + 2FA)
• Audit logging
• Automatic session timeout
• Secure messaging capability

Recommended Solutions:

Simple Practice

• Built for therapists
• EHR + client portal + billing
• BAA included
• Client messaging
• Telehealth integrated
• $29-69/month per clinician

TherapyNotes

• Comprehensive EHR
• Client portal included
• Insurance billing
• Outcome measures
• $49/month per clinician

Doxy.me Plus

• Telehealth + file sharing
• HIPAA compliant with BAA
• Simple interface
• No client account needed
• $35/month

Hushmail

• Encrypted email service
• Provides BAA
• Contact forms for intake
• File attachments encrypted
• $49.98/year

Persay

• Client portal with encrypted storage
• Credential management
• Unlimited file storage
• Provides BAA
• Not EHR-integrated

When to Use: If you have more than 5 active clients and do regular document sharing. This becomes your primary communication method.

Option 2: Encrypted Email with BAA

Requirements:

• Provider must sign BAA
• Must be true end-to-end encryption
• Must have audit capabilities
• Must have access controls

Options:

Hushmail for Healthcare

• Designed for HIPAA compliance
• Provides BAA automatically
• Works like regular email
• $49.98/year

ProtonMail

• Swiss privacy laws
• True end-to-end encryption
• Will sign BAA for paid plans
• Free tier NOT HIPAA compliant
• $4.99+/month

Virtru for Gmail/Outlook

• Adds encryption to existing email
• Provides BAA
• Access controls and expiration
• $8-15/user/month

When to Use: For one-off file sharing with other providers or quick client communication. Not ideal for large files or regular use.

Option 3: Healthcare-Specific File Transfer

For Larger Files or Formal Records Transfer:

ShareFile Healthcare

• Citrix enterprise solution
• HIPAA compliant with BAA
• Custom branding
• E-signature included
• $70+/month

Paubox

• Email + file sharing
• HIPAA compliant
• BAA included
• Works with Gmail/Outlook
• $29+/user/month

When to Use: Transferring complete client records to another provider, or if you need audit trails for compliance verification.

Option 4: Practice Management Systems

Most EHR/practice management systems include compliant file sharing:

Psychology Today Suite

• Profile + forms + payments
• HIPAA compliant
• BAA included
• $29.95+/month

ICANotes

• Mental health specific EHR
• Template-based notes
• Portal included
• $49+/month

Owl Practice

• HIPAA compliant scheduling
• Client forms
• Telehealth
• $9/month

What About Texting Clients?

Regular SMS/Text Is NOT Compliant

Regular text messages:

• Not encrypted by default
• Stored unencrypted on phone companies’ servers
• No audit capability
• No access controls
• Cannot be used for PHI

Compliant Alternatives

OhMD

• HIPAA compliant texting
• BAA included
• Works with existing numbers
• $20/month

Spruce Health

• Secure messaging
• Phone + text
• BAA included
• $25-100/month

Simple Practice/TherapyNotes messaging

• Built into practice management
• Requires client to use portal

When Texting Is Okay:

You CAN text:

• Appointment reminders (first name only, no clinical info)
• “Your session is tomorrow at 2pm”
• “Running 10 minutes late”
• Link to client portal

You CANNOT text:

• Clinical information
• Diagnosis or symptoms
• Treatment discussions
• “How are you feeling since we discussed your depression?”

Step-by-Step: Becoming HIPAA Compliant

The Intake Process: Starting Compliant

Before First Contact

Your Website:

• Contact forms must be encrypted (HTTPS at minimum)
• Better: Use secure form service with BAA
• Don’t collect PHI in initial contact forms
• “Tell us why you’re seeking therapy” = PHI, don’t use regular forms

First Phone Call:

• You can discuss services and scheduling
• Don’t take clinical history over regular phone line
• Don’t leave detailed voicemails
• Voicemail: “This is Dr. Smith returning your call about scheduling” (no mention of therapy or clinical issues)

Intake Forms

Two Options:

Option 1: Paper Forms (In-Person)

• Client fills out on paper in office
• You scan to encrypted storage
• Shred or secure file original
• Most compliant but least convenient

Option 2: Secure Online Forms

• Use HIPAA-compliant form service (Jotform HIPAA, Formstack, or your EHR’s forms)
• Must have BAA from form provider
• Forms must be encrypted
• Must be access-controlled
• Send client secure link

Never use: Google Forms, Microsoft Forms, SurveyMonkey free tier, Typeform free tier

Consent for Electronic Communication

Your intake forms must include:

“I consent to electronic communication with [Practice Name] through the secure client portal. I understand:

• Electronic communication carries some risk of unauthorized access
• I should not share sensitive information via regular email or text
• I will access my portal regularly for important communications
• I can revoke this consent at any time in writing”

Common HIPAA Violations Therapists Make

1. Using Personal Devices Without Encryption

The Violation:

• Taking notes on unencrypted laptop
• Accessing client files on personal phone without security
• Storing files in personal Dropbox/Google Drive

The Solution:

• Full disk encryption on all devices (FileVault for Mac, BitLocker for Windows)
• Strong passwords + biometric lock
• Remote wipe capability enabled
• Never store PHI on personal cloud services without BAA

2. Discussing Clients in Public

The Violation:

• Taking phone calls about clients in coffee shops
• Discussing cases in elevators or waiting rooms
• Visible client information on screens in public

The Solution:

• Private space for all PHI discussions
• Privacy screens for laptops
• Lock screen when leaving device unattended
• Headphones for video sessions

3. Improper Disposal of PHI

The Violation:

• Throwing intake forms in trash
• Deleting files without secure deletion
• Leaving old phones/computers without wiping

The Solution:

• Shred all paper PHI
• Secure deletion software for electronic files
• Factory reset devices before disposal
• Destruction certificates for large volumes

4. No Audit Controls

The Violation:

• Can’t track who accessed which client file
• No logging of document downloads
• No record of portal access

The Solution:

• Use software that provides audit logs
• Review logs periodically
• Document your review process

5. Sharing Credentials

The Violation:

• Sharing portal password with assistant
• Using same login for multiple staff members
• Writing passwords on sticky notes

The Solution:

• Unique login for each person
• Password manager for credential storage
• Two-factor authentication where available

The Cost of Non-Compliance

HIPAA Violation Penalties

Tier 1: Unknowing

• $100-50,000 per violation
• Up to $1.5 million per year

Tier 2: Should Have Known

• $1,000-50,000 per violation
• Up to $1.5 million per year

Tier 3: Willful Neglect (Corrected)

• $10,000-50,000 per violation
• Up to $1.5 million per year

Tier 4: Willful Neglect (Not Corrected)

• $50,000 per violation
• Up to $1.5 million per year

Real Examples

Small therapy practice in Oregon:

• Emailed PHI without encryption
• $40,000 fine
• Required corrective action plan
• Increased malpractice insurance

Individual therapist in Florida:

• Laptop stolen from car with unencrypted client files
• $25,000 fine
• State board investigation
• Lost clients due to breach notification

Solo Practice Budget HIPAA Solution

Minimum compliance setup: ~$100/month

• Simple Practice Basic ($29/mo) - EHR + portal + BAA
• Google Workspace Business ($12/mo) - Email with BAA
• Backblaze ($7/mo) - Encrypted backup with BAA
• 1Password ($7.99/mo) - Password management
• Malwarebytes ($39.99/year = $3.33/mo) - Antivirus
• Risk assessment template ($50 one-time)
• Policy templates ($75 one-time)

Total: $59/month + $125 setup

This is not optional overhead—it’s the cost of practicing legally.

Quick Compliance Checklist

Before you share ANY client file, verify:

• Service provider has signed BAA
• Transmission is encrypted
• Access is password-protected
• Audit logging is enabled
• Client has consented to electronic communication
• You’ve documented security measures
• Minimum necessary rule applied (only sharing what’s needed)
• You can prove compliance if audited

What to Do If You Haven’t Been Compliant

Don’t Panic, But Do Act Quickly

1. Stop the non-compliant behavior immediately

   • No more regular email for PHI
   • No more unencrypted file sharing
   • No more unsecured storage

2. Assess your exposure

   • How many clients’ data may have been at risk?
   • Has anyone actually accessed it inappropriately?
   • Do you need to report a breach?

3. Implement compliant systems now

   • Sign up for HIPAA-compliant services
   • Get BAAs in place
   • Start using secure methods only

4. Document your remediation

   • Risk assessment showing you identified the gap
   • Evidence you corrected it
   • Training documentation
   • New policies in place

5. Consider consulting a HIPAA attorney

   • Especially if you suspect a breach occurred
   • They can advise on reporting requirements
   • Better to be proactive than reactive

The good news: If you identify and correct violations before there’s a complaint, penalties are typically much lighter or waived.

Conclusion

HIPAA compliance for file sharing comes down to three simple rules:

1. Only use services that sign a BAA
2. Ensure everything is encrypted
3. Document your compliance efforts

You don’t need to become a security expert. You just need to use the right tools and follow basic protocols.

Choose a HIPAA-compliant client portal or EHR this week. Get your BAAs signed. Update your consent forms. Train yourself on the requirements.

Your clients trust you with their most sensitive information. Honor that trust by protecting their data properly—and protect yourself from devastating fines.

HIPAA compliance isn’t complicated. It’s just non-negotiable.