What is the minimum documentation I need before seeing my first client?

At minimum, you need: informed consent for treatment, HIPAA Notice of Privacy Practices, a client intake questionnaire or biopsychosocial assessment form, a cancellation/no-show policy (can be part of informed consent), and a Good Faith Estimate template for self-pay clients. You should also have a secure system for storing records (HIPAA-compliant EHR or locked filing cabinet), professional liability insurance, and your practice policies documented in writing.

Do I need an EHR system or can I use paper records?

There is no federal law requiring an EHR — paper records are legally acceptable as long as they are stored securely (locked cabinet, limited access). However, an EHR is strongly recommended for private practice because it streamlines documentation, automates appointment reminders, integrates billing, provides secure messaging, and makes compliance with HIPAA security requirements much easier. Many HIPAA-compliant EHR systems designed for therapy practices cost $30-$80 per month.

How long do I need to keep client records after termination?

Record retention requirements vary by state, but most states require 5-10 years after the last date of service for adult clients. For minor clients, records must typically be retained until the client turns 18 plus the standard adult retention period. Some states (like California) require 7 years for adults. Check your state licensing board's specific requirements. When in doubt, retain records for at least 7 years for adults and until age 25 for minors.

What forms do I need if I offer telehealth?

In addition to your standard practice forms, telehealth requires: a telehealth-specific informed consent (covering technology risks, privacy, emergency protocols, and platform information), documentation of the client's physical location at each session, verification that you are licensed to practice in the client's state, and a HIPAA-compliant telehealth platform with a Business Associate Agreement. Some states have additional telehealth-specific documentation requirements.

Do I need a Business Associate Agreement with my EHR and other vendors?

Yes. Under HIPAA, any vendor that creates, receives, maintains, or transmits protected health information (PHI) on your behalf is a Business Associate and must sign a BAA. This includes your EHR system, billing service, cloud storage provider, telehealth platform, email service (if used for PHI), answering service, and any AI documentation tools. Operating without BAAs in place is a HIPAA violation.

Private Practice Documentation Checklist: Every Form You Need

Why You Need a Documentation Checklist

Starting a private practice involves dozens of decisions, and documentation is one of the areas where missing something can create legal, ethical, or financial problems down the road. A missing informed consent form can become a malpractice liability. A missing HIPAA notice can become a compliance violation. A missing Good Faith Estimate can become a federal regulation issue.

This checklist covers every document you need, organized by the phase of practice when you will need it. Use it as your master list — check off each item as you complete it, and you will know your practice documentation is thorough and compliant.

The Complete Practice Documentation Checklist

Phase-by-Phase Guidance

Phase 1: Setting Up Your Practice

The documentation foundation you build before seeing your first client determines how smoothly everything runs afterward. The two most common mistakes at this stage are (1) using generic templates downloaded from the internet without customizing them for your state and license type, and (2) failing to establish HIPAA-compliant systems before handling any PHI.

Priority items to complete first:

Your informed consent form is the single most important clinical document. Have it reviewed by a mental health attorney in your state. This one investment (typically $300-500) can prevent thousands of dollars in liability.

Your HIPAA infrastructure — EHR system, telehealth platform, email — must all have signed Business Associate Agreements before you create, store, or transmit any client information through them. This is not optional.

Your Good Faith Estimate template must be ready on day one. The No Surprises Act applies from the moment you schedule a self-pay client.

Phase 2: The Intake Process

The intake process is documentation-heavy by design. You are establishing the clinical record, setting expectations, and meeting multiple legal and ethical requirements simultaneously. The key is to have a streamlined system — most therapists send intake paperwork electronically 3-5 days before the first session so clients can complete it at home rather than spending the first session on forms.

A critical note on risk assessment: Document your risk assessment at intake even if the client denies all risk factors. "Client denied current suicidal ideation, history of suicide attempts, self-harm, and homicidal ideation" is a brief sentence that demonstrates you assessed for risk. Failing to document risk assessment at intake is one of the most common and most consequential documentation omissions.

Phase 3: Ongoing Documentation

This is where documentation either becomes a sustainable routine or an overwhelming burden. The difference is almost entirely about process, not about the documentation itself.

Build notes into your schedule. Block 10-15 minutes between sessions. Write the note before your next client arrives. Therapists who batch notes at the end of the day or week consistently report more documentation stress, less accurate notes, and higher burnout.

Track treatment plan reviews. Insurance companies and best practice standards generally require treatment plan updates every 90 days. Set a recurring reminder in your calendar or EHR. A lapsed treatment plan can lead to denied claims and creates the impression of aimless treatment.

Document all non-session clinical activity. Phone calls with the client's psychiatrist, emails from a client in distress, consultation with a colleague about an ethical dilemma — all of these should be documented. If it is clinically relevant and involves the client's care, it belongs in the record.

Phase 4: Termination

Termination documentation is frequently neglected, but it serves important functions. A thorough discharge summary provides the next clinician with a roadmap of what was tried, what worked, and what the client still needs. It also protects you by documenting the client's status and risk level at the time treatment ended.

For unplanned terminations, document your attempts to re-engage the client. If a client disappears, send a letter noting that you have not heard from them, that their file will be closed after a specified date (typically 30 days), and that they are welcome to return or can contact you for referrals. Keep a copy of this letter in the file.

Organizing Your Documentation System

Whether you use an EHR or paper records, organize each client's file to include these sections:

Administrative — demographics, insurance information, payment records, signed acknowledgments
Consent — informed consent, HIPAA notice, telehealth consent, any specialty consent forms
Assessment — intake questionnaire, biopsychosocial assessment, diagnostic evaluation, standardized measures
Treatment planning — initial treatment plan, updated treatment plans, safety plans
Progress notes — session-by-session notes in chronological order
Correspondence — ROI forms, letters, reports, coordination of care notes
Termination — discharge summary, termination letter, final risk assessment

Common Mistakes When Setting Up Practice Documentation

Copying another therapist's forms verbatim. Every practice is different. Your informed consent must reflect your specific credentials, modalities, fees, state laws, and policies. A form borrowed from a colleague in another state with a different license type does not protect you.
Not having a HIPAA-compliant system in place before seeing clients. Some new practitioners start with a personal Gmail account, a standard Zoom link, and notes in a Word document on their laptop. Every one of these is a potential HIPAA violation. Invest in compliant infrastructure from day one.
Skipping the Good Faith Estimate. Many new therapists are either unaware of the No Surprises Act or assume it does not apply to them. It does. Every self-pay client must receive a GFE, and the penalty for non-compliance can be up to $10,000 per violation.
Failing to document what happens outside of sessions. A phone call from a client in crisis at 10 PM, a conversation with a client's parent, a voicemail from a client's attorney — all of these need to be documented. If you took a clinical action (or decided not to), write it down.
Not planning for termination documentation from the start. Have your discharge summary template and termination letter template ready before you need them. When a client terminates unexpectedly, you do not want to be creating forms on the fly.

Private Practice Documentation Checklist: Every Form You Need

Why You Need a Documentation Checklist

The Complete Practice Documentation Checklist