Compliance isn’t a yearly project. It’s a set of habits the practice manager keeps running every week, so audits and incidents are routine instead of emergencies.
The consent and policy packet
Every new patient signs, and the front office files, before the first session:
- Notice of Privacy Practices acknowledgment
- Informed consent for treatment (and telehealth consent if applicable)
- Financial policy, cancellation/no-show policy, card-on-file authorization
- Releases of information for anyone the patient wants involved
- For minors: consent from the right guardian, per state law
Check a sample of new charts every month to make sure nothing is missing.
Record requests
| Who asks | What to do |
|---|---|
| The patient | Verify identity; respond within HIPAA’s timeline (generally 30 days) or your state’s, if shorter; psychotherapy notes follow separate rules, so involve the clinician |
| Another provider (for treatment) | Confirm the request and send the minimum necessary through a secure channel |
| An attorney or court | Don’t respond on your own; escalate to the owner, who may involve counsel |
| A payer (audit) | Log the deadline; send exactly what’s requested |
Keep a log of every request: date received, who, what was sent, date sent.
Payer audits
- Log the deadline the day the letter arrives. Missing it usually means automatic recoupment.
- Pull exactly what’s requested with the clinician: notes, treatment plans, time documentation.
- Check the documentation supports the codes billed (for example 53+ minutes for 90837). Never alter or add to records after the fact.
- Send through the payer’s secure channel and keep proof of delivery.
- Learn from it: if documentation was weak, set up training and a monthly self-audit.
Incident handling
Privacy incidents, safety events, complaints: each gets the same treatment.
- Contain it (stop the email, secure the device, separate the people).
- Report to the owner and the privacy officer the same day.
- Document what happened, when, who was involved, and what was done.
- The owner decides on notifications (HIPAA breach rules, payers, licensing boards), with advice where needed.
- Fix the cause and update the policy or SOP.
Keeping policies current
- Review every policy once a year, and whenever a law, payer rule or service changes.
- Keep a compliance calendar with license renewals, CAQH attestations, malpractice, and payer revalidations (see “Provider onboarding & credentialing basics”).
- Train staff on HIPAA at hire and every year, and keep a signed record.