Therapists, psychologists, psychiatrists, and counselors know that confidentiality is everything. Your website must reflect that trust. Media Express builds HIPAA and 42 CFR Part 2 compliant websites for mental health practices - secure intake, encrypted session portals, and telehealth-ready infrastructure that puts patient privacy first.
Mental health practices must comply with HIPAA (Privacy Rule, Security Rule, Breach Notification Rule) AND state mental health laws (often stricter). If you treat substance abuse or addiction, 42 CFR Part 2 applies — a separate, stricter federal law.
U.S. federal law. Psychotherapy notes are classified as highly protected. Privacy Rule (who sees what), Security Rule (encryption, access controls), Breach Notification Rule (60-day notification). Violations carry $137–$2.07M civil penalties per category per year.
Applies to substance abuse treatment records. Stricter than HIPAA — requires written patient consent before sharing records with anyone, even other providers. Violations carry $300–$2,500 per violation. Critical for counselors, psychiatrists, and clinics treating addiction.
State law enforced by Illinois Department of Human Services and licensing boards. Requires documented privacy and security policies, patient consent, therapist-patient privilege protections. Violations can result in license suspension or revocation.
Any vendor who touches patient records (EHR platforms, telehealth, patient portals, transcription, billing, cloud hosts) must sign a BAA. You are liable for their HIPAA and 42 CFR Part 2 violations. Media Express provides tested BAA templates.
Every system we deploy is designed for mental health confidentiality: HIPAA-compliant website, 42 CFR Part 2 intake management, encrypted session portals, and telehealth-ready infrastructure.
Website fully compliant with HIPAA Privacy Rule. Notice of Privacy Practices (public + downloadable). Patient consent forms. Clear privacy policy. Psychotherapy notes policy. No PHI exposed in public-facing areas.
Encrypted, HIPAA and 42 CFR Part 2 compliant intake forms. Collect only necessary information. Explicit consent to treat. Pre-treatment questionnaire (PHQ-9, GAD-7, etc.). Stored securely in encrypted portal.
Encrypted portal for session notes, treatment plans, and progress summaries. Role-based access (patients see limited info, therapists see full records). Audit logs for HIPAA compliance. Supports multi-location practices.
Integration with HIPAA-compliant telehealth platforms (Doxy.me, Talkspace with BAA, etc.). Secure video/audio transmission. Session recordings (encrypted, patient consent required). Calendar integration.
Polish/Spanish/English website and forms. Notice of Privacy Practices in patient's language. Interpreter services documentation. Serve Chicago's diverse mental health community compliantly.
If you treat substance abuse, 42 CFR Part 2 compliance: written consent requirements, 1202(c) redisclosure restrictions, records isolation, incident response procedures. Media Express manages this from day one.
Solo therapists can get HIPAA-ready quickly. Group practices with multiple providers need more infrastructure. All pricing is fixed and includes ongoing maintenance.
Pricing depends on practice size, number of providers, and whether 42 CFR Part 2 applies. Substance abuse treatment programs may require additional specialized compliance work.
Above are typical Illinois market rates. Media Express pricing is more accessible — we reuse compliant templates and workflows across practices. Contact us for a personalized quote based on your practice structure and regulatory scope.
⚜ Free Consultation →Yes. Mental health records are classified as psychotherapy notes under HIPAA and receive heightened protection. Psychotherapy notes can only be disclosed to you or someone you specifically authorize. Additionally, if you treat substance abuse or addiction, 42 CFR Part 2 applies — a separate, stricter federal law that prohibits disclosure without written consent, even to other healthcare providers.
Yes, but carefully. You can describe the conditions and populations you serve (e.g., "depression, anxiety, PTSD, trauma") without patient identifying information. Never use real patient names, photos, or stories without explicit written consent. Testimonials must comply with FTC endorsement rules and HIPAA. Media Express helps you create compliant marketing copy that builds trust without violating privacy.
Use encrypted, HIPAA and 42 CFR Part 2 compliant forms — not email or unsecured PDFs. Forms should collect only necessary information, include a clear Notice of Privacy Practices and consent-to-treat, and be stored in a secure encrypted portal. Media Express builds intake systems that meet all federal and state requirements.
If you treat substance abuse or addiction, 42 CFR Part 2 applies — stricter than HIPAA. It requires written patient consent before sharing records with anyone, even other healthcare providers. Violations carry $300–$2,500 per violation and can result in license suspension. Media Express ensures your website, intake, and records systems comply with both HIPAA and 42 CFR Part 2.
Under HIPAA, patients have the right to request their records — but therapists can withhold psychotherapy notes if they believe disclosure would harm the patient. This is a HIPAA exception unique to mental health. Build a secure patient portal so patients can access allowed records safely, and therapists can withhold sensitive notes when medically indicated.
Telehealth platforms must meet HIPAA's technical safeguards: encryption in transit, authentication, access controls, and audit logs. Zoom/Teams/Skype are not HIPAA-ready without a Business Associate Agreement. Use HIPAA-compliant telehealth platforms (Doxy.me, Talkspace with BAA, etc.). Media Express integrates your telehealth platform securely and ensures all documentation meets HIPAA requirements.
Mental health practices interact with multiple regulations. Here are the most important.
Contact us for a free consultation. We'll assess your current posture, explain what HIPAA and 42 CFR Part 2 mean for your practice, and give you a fixed-price roadmap. No pressure. Confidential.