Important: HIPAApropriateness reviews, including their summaries, are for informational purposes only. They are neither consultation nor legal advice. Be aware that while we do our best to be thorough and complete, information may be missing or possibly even inaccurate. Products also change quickly, and the review may become out of date. By continuing to read, you agree to use the information in HIPAApropriateness reviews and their summaries at your own risk.

Vital Stats

HIPAA compliance with this product appears possible?: Yes.
Recommend for your HIPAA risk management needs?: Yes. We previously had some concerns, but TherapyNotes is addressing them. We are also currently re-doing our review, and you'll see a deeper update here soon.
# of Caveats: 1 view caveats→
# of Usage Notes: 2 view notes→

Relevant Product Characteristics

  • This product is designed specifically with mental/behavioral health professionals in mind.
  • The leadership or management behind this product includes at least one mental/behavioral health professional. In addition, at least one technical leader or manager has an extensive background serving the health care industry.

What Is This Product?

TherapyNotes LogoTherapy Notes is a popular and large (company-wise), feature-rich, and well-designed practice management system. For a review of Therapy Notes’ quality, see Tame Your Practice’s Official Review of Therapy Notes→.

TherapyNotes’ biggest advantage, in our eyes, is the completeness of features. This includes features that help you stick the letter of the HIPAA standards. If you have employees who can access your record system, or you have multiple clinicians, TherapyNotes offers many of the more obscure features necessary for compliance with HIPAA standards.

We are in the midst of updating our review of TherapyNotes, and more information will be available here when we complete that process.

Previous Concerns

In our original version of this review, we encountered some issues with TherapyNotes’ company culture that gave us pause. Since that time, they have addressed the concerns we raised with them and let us know about it. They are also assisting us in updating our review.

While we are still watching to see if our concerns about company security culture are valid, this responsiveness is a good sign. That plus TherapyNotes’ features that strongly contribute to HIPAA compliance compel us to change our recommendation to a “Yes” while we continue our review.


This product offers a free service tier or a free trial account:

We encourage all clinicians interested in this product to try out the free trial or experiment with the free tier to see if it suits your needs.

If you discover anything of concern that isn’t addressed in this review yet, please tell Liath about it at [email protected].

This product has also been reviewed by:

  • Tame Your Practice: Rob Reinhardt of Tame Your Practice does highly-respected reviews of EHR products. While we review them primarily for risk management appropriateness, Rob reviews them for features and quality. Read Rob’s review of this product→


Caveats are criticsms of the company or product that we feel are relevant to your risk management or other important considerations.

1) Previously gave us concern about company security culture

As stated in the formal review text above, we previously had concerns about TherapyNotes’ company security culture. This was based on finding a discrepancy in their Business Associate Agreement contract followed by silence from the company when we asked them to address it.

In the intervening months, they have told us that they corrected the BAA issue and are helping us create an updated review.



Notes cover points where the product can’t ensure compliance or ethical action for you. These help you know what your part of the compliance puzzle looks like when using this product. A high note count usually correlates with a feature-rich product, and not necessarily with a product that has problems.

1) Download and Execute Your Business Associate Agreement When You Sign Up

Therapy Notes does not automatically execute the BAA with you. Be sure to download, sign and send it before you start using the software to handle any protected health information.

2) Avoid sending unsecured appointment reminders without proper collaborative risk analysis

Therapy Notes offers appointment reminders by email, SMS text message, and automatic voice call.

First, we recommend the voice reminder. It’s easier to stay copacetic with HIPAA that way. And Therapy Notes does a Business Associate Agreement with you, so it’s acceptable for them to be the ones who make those calls on your behalf.

If it turns out that unsecured email or text communications are legally-ethically workable for you,Therapy Notes executes a Business Associate Agreement with you, which makes it legal for them to send those emails or texts on your behalf.

Read our article on unsecured communications here for some guidance to help you decide what you need to do to around appointment reminders to stay legal and ethical in your practice. It is also covered in Engaging in HIPAA Security and Digital Confidentiality as a Mental Health Professional, Module 4: Using Email, Text, Phone, and Video in a HIPAA-Compliant Manner in detail.


Scheduled Maintenance

We will be temporarily taking the website offline at 10:00 PM Pacific (1:00 AM Eastern) tonight, July 6, in order to make some improvements. We plan to be back online by midnight Pacific (3:00 AM Eastern). We apologize for any inconvenience this may cause. Dismiss