BUILD YOUR PRACTICE

Therapy Practice Policies and Forms Checklist

Therapy private practice forms should document the practice you actually operate, not imitate another clinician’s packet. This checklist organizes consent, privacy, financial, telehealth, intake, release, clinical, and closing documents by purpose and applicability, then shows how to review, test, version, and maintain them before the first client.

By Gabriel Benaim, LMHC | Official information checked: September 6, 2026

Important boundary

This page is a document inventory, not a collection of universal legal templates. A form can look polished and still conflict with your services, jurisdiction, license, payer contracts, technology, population, or actual workflow. Have consequential documents reviewed by qualified legal, clinical, privacy, billing, and insurance resources as appropriate.

Begin with the HIPAA and privacy setup guide for the operating safeguards behind these documents. Use the startup checklist for the overall launch sequence. This page focuses only on what the practice may need to communicate, collect, authorize, document, and maintain.

Build a document-control system
Informed consent and practice disclosures
Privacy notices and communication preferences
Fees, payment, cancellation, and estimates
Telehealth, location, emergency, and technology
Releases and coordination of care
Intake and assessment
Treatment, progress, and termination records
Minors, couples, families, and special situations
Test the first-client workflow
Professional review and maintenance
Frequently asked questions

1. Build a document-control system

Do not begin by downloading a large packet. Create a document register that explains why each item exists and how it connects to the practice workflow.

Fields to track for every policy, form, notice, and template
Field	Question	Evidence
Purpose	What decision, disclosure, permission, record, or workflow does this document support?	Plain-language purpose statement
Applicability	Is it generally needed, conditional, or operational?	Controlling source or written rationale
Owner	Who updates, distributes, reviews, and responds?	Named role, even in a solo practice
Version	Which wording was active and when?	Version number, effective date, archive
Delivery	When and how does the client receive it?	Portal, secure link, paper, or other method
Acknowledgment	Is a signature, acknowledgment, authorization, or no signature needed?	Configured requirement and stored result
Review	Who reviewed it and against which authority?	Name or role, date, source, next review
Operational test	Does it work in the real client journey?	Fictional end-to-end test

Keep superseded versions with their effective dates rather than silently replacing the only copy. If a policy changes, decide which current clients need notice, acknowledgment, or a new agreement instead of assuming a website update is enough.

Generally required Informed consent should accurately describe the services and professional relationship. The document and conversation may need to address:

Clinician identity, credentials, license, role, and contact information
Nature and expected course of services, potential benefits and risks, alternatives, and voluntary participation
Scope and limits of the practice, including services it does not provide
Confidentiality and its applicable limits
Communication methods, response expectations, after-hours limitations, and emergencies
Consultation, coordination, supervision, coverage, trainees, recordings, or observers when applicable
Fees and financial practices or a clear link to the governing financial agreement
How complaints or concerns may be raised
Termination, referrals, interruptions, clinician unavailability, and practice closure

Consent is a process, not just a signature. Preserve the form in effect, the client’s acknowledgment, later revisions, and any situation-specific discussion. Avoid promising outcomes, absolute confidentiality, uninterrupted access, or a response time the practice cannot reliably provide.

3. Privacy notices and communication preferences

Conditional HIPAA-covered providers must develop and distribute an applicable Notice of Privacy Practices. HHS revised its model notices in February 2026, including changes related to substance-use-disorder records. The model can support drafting, but it must be completed and used for the actual entity and practices.

The privacy workflow may include:

Notice of Privacy Practices and acknowledgment process when HIPAA applies
Privacy contact and complaint instructions
Requests for access, amendment, restrictions, confidential communications, or an accounting of certain disclosures
Authorization and revocation handling
Communication-channel preferences and permissions
Portal, email, text, voicemail, mail, and shared-device cautions
Website privacy information for inquiries, analytics, scheduling, and other collection

Do not place every privacy issue inside informed consent. A Notice of Privacy Practices, authorization, communication preference, and clinical consent serve different purposes. The privacy implementation guide covers the risk analysis, safeguards, vendors, and incident procedures behind them.

4. Fees, payment, cancellation, and estimates

Generally required or conditional A financial agreement should match the practice’s cash-pay, insurance, platform, or mixed model. Address only terms the practice can apply consistently.

Session and service fees, when they apply, and how changes are communicated
Payment timing, accepted methods, stored payment authorization, receipts, refunds, credits, and failed payments
Cancellation and missed-appointment terms, exceptions, and how the practice records the decision
Insurance billing roles, benefit-verification limits, client responsibility, noncovered services, deductibles, coinsurance, denials, recoupments, and payer changes
Superbills, what they contain, when they are issued, and the fact that reimbursement is not guaranteed
Outstanding balances, payment plans, collection procedures, and effects on scheduling or termination
Sliding arrangements, review dates, and documentation of individual decisions

Conditional Federal good-faith-estimate requirements may apply to uninsured or self-pay individuals. Build an intake question, estimate-generation method, delivery record, update process, and dispute-notice workflow using current CMS guidance. Do not treat an ordinary fee agreement as automatically satisfying a separate estimate requirement.

For the business-model distinctions behind these documents, see Cash Pay vs. Insurance for Therapists and How Therapist Insurance Reimbursement Works.

5. Telehealth, location, emergency, and technology procedures

Conditional Telehealth materials should reflect the jurisdictions, services, clients, payer rules, and technology actually used. Consider:

What telehealth involves, material risks and limitations, alternatives, and when in-person or other care may be recommended
Client identity and physical-location verification for each appointment
Local emergency contact, nearest appropriate resources, and permission boundaries
Privacy expectations at both locations, interruptions, other people present, and use of headphones
Platform access, links, portal messages, chat, file transfer, recordings, and device expectations
Technology failure, reconnection, conversion to phone when appropriate, cancellation, and emergency procedures
Travel and out-of-jurisdiction limits
How telehealth consent and location checks are documented

A platform’s technical capability does not establish authorization to serve a client in a particular location. Use current HHS telehealth privacy guidance and verify state professional and payer requirements separately.

6. Releases and coordination of care

Conditional Use a release or other valid authority appropriate to the disclosure. A release-of-information process may need to identify:

The person or entity authorized to disclose and the recipient
The information, purpose, and applicable limitations
Expiration event or date
Signature, authority, and date
Revocation process and limits of revocation
Redisclosure language or special-record requirements when applicable

Before disclosing, verify identity, authority, scope, expiration, revocation status, recipient, delivery method, and any rule that permits or requires disclosure without authorization. Document what was sent, when, why, to whom, by whom, and under what authority.

Coordination-of-care documents should also state who initiates contact, what happens when the other provider does not respond, what belongs in the clinical record, and how urgent concerns are handled. Do not make a broad release the default solution for every collaboration.

7. Intake and assessment documents

Generally required Collect information because it is clinically or operationally necessary, not because a template contains a field. The intake and assessment process may include:

Legal and chosen name, pronouns, contact information, location, and communication preferences
Emergency contact and limits of how it may be used
Presenting concerns, symptoms, functioning, history, strengths, risks, goals, prior treatment, medications, health factors, and relevant context
Guardian, representative, custody, consent, or decision-making authority when applicable
Payer, subscriber, authorization, referral, and billing information when relevant
Screening measures used within competence and their interpretation
Clinical assessment, diagnosis when within scope and supported, level-of-care considerations, and referrals

A questionnaire is not automatically an assessment, and a completed intake is not automatically informed consent. Define how the clinician reviews responses, follows up on urgent disclosures, corrects errors, and documents clinical judgment.

8. Treatment planning, progress notes, and termination

Generally required Clinical templates should support accurate records rather than produce identical notes. Build and test:

Assessment and diagnostic documentation appropriate to the clinician’s scope and payment model
Treatment or service plan with individualized goals, methods, responsibilities, review, and change
Progress notes that connect the encounter to the plan and document material clinical and risk information
Risk assessment, safety planning, consultation, mandated-reporting, emergency, and higher-level-of-care records when applicable
Collateral contact, care coordination, client communication, administrative action, and billing clarification notes
Late entry, correction, amendment, signature, cosignature, and record-locking procedures
Termination, transfer, referral, outreach, nonresponse, continuity, and closure records

Do not rely on copy-forward language without verifying every statement. Separate psychotherapy notes, if the clinician chooses to maintain them and applicable law recognizes them, from the general clinical record and understand the different handling rules before creating them.

9. Flag minors, couples, families, and special situations

These situations require more than adding a name to a generic adult form. Create a review flag rather than assuming one universal packet.

Situations requiring individualized authority and record decisions
Situation	Questions to resolve	Possible documents
Minor clients	Who may consent, access records, receive communication, make payment decisions, and authorize disclosure?	Authority verification, consent or assent, custody documentation, communication plan
Couples or families	Who is the client, what is the record, how are individual contacts handled, and what happens if relationships change?	Service agreement, participants and records policy, communication and disclosure terms
Guardians or representatives	What is the person’s current authority and are there limits?	Authority documentation, identity verification, scope and expiration record
Court or legal involvement	What role is being requested, who retained the clinician, and what conflicts exist?	Role clarification, legal-process log, counsel-reviewed communication
Substance-use-disorder records	Does 42 CFR Part 2 apply, and how does it interact with HIPAA and state law?	Applicable notice, consent, redisclosure, and disclosure-accounting workflows
Cross-jurisdiction telehealth	Where is the client, what authority applies, and what emergency resources are available?	Location verification, consent, emergency plan, jurisdiction check

Use qualified legal and clinical guidance for ownership of the record, access, privilege, subpoenas, parental rights, separated parents, conflicting participants, and transitions. Do not promise a “no secrets” policy or other approach without understanding its clinical, ethical, legal, and operational effects.

10. Test the first-client document workflow

Use fictional information and the client-facing view of the actual system.

Send an inquiry and confirm the response protects privacy and states emergency limits.
Schedule an intake in the correct time zone and location.
Assign the correct packet for the service, client, payment route, and authority.
Open every document on a phone and computer.
Test required fields, optional fields, signatures, dates, initials, conditional logic, and error messages.
Confirm the client can download or receive documents they should retain.
Verify the practice receives completed documents in the correct chart and that access is limited appropriately.
Change one policy version and confirm old and new versions remain identifiable.
Run a fictional request for records, revocation, payment receipt, superbill, and termination.
Test what happens when a form is incomplete, contradictory, urgent, or assigned to the wrong person.

Opening threshold: The practice should know which packet applies, why each document exists, how the client receives it, who reviews it, where it is retained, and what happens when the information requires action.

11. Professional review and maintenance

Route each document to the reviewer whose competence matches the risk:

Attorney: contracts, consent language, confidentiality limits, minors, couples, subpoenas, records, jurisdiction, accessibility, employment, and other legal questions
Privacy or security professional: notices, authorizations, communication, access, vendor, incident, and information-handling workflows
Malpractice insurer or risk resource: documentation, emergencies, boundaries, termination, and practice-specific risk guidance
Qualified clinical consultant: assessment, treatment planning, risk, population, modality, and scope
Billing or payer resource: financial, estimate, claim, authorization, client-responsibility, and documentation terms
Tax or accounting professional: financial recordkeeping and business documents, not clinical-record retention

Review the register at least periodically and whenever the practice changes a service, population, clinician, payer, fee, location, communication method, vendor, law, contract, or workflow. Record the decision even when no wording changes.

Frequently asked questions

Can I use another therapist’s intake forms?

Do not copy them. They may be copyrighted, outdated, written for another jurisdiction, or inconsistent with your license, services, payers, technology, and actual procedures. Build a document inventory and obtain appropriate review.

Is informed consent the same as a Notice of Privacy Practices?

No. Informed consent addresses the therapeutic relationship and services. A HIPAA Notice of Privacy Practices explains privacy practices and individual rights for covered entities. Other authorizations, financial agreements, and communication preferences serve additional purposes.

Does every form need a signature?

No. Some documents require a signature or acknowledgment; others function as notices, policies, clinical templates, or internal procedures. Determine the requirement and purpose for each item rather than collecting signatures automatically.

Should all policies be combined into one intake document?

Not necessarily. One packet may be convenient, but the practice still needs clear document purposes, version control, conditional assignment, and the ability to update one component without confusing the others.

Can this checklist replace legal review?

No. It helps organize questions and workflow tests. It cannot determine the correct language or legal sufficiency for a particular practice, client, contract, or jurisdiction.

Next step

Primary next step

Once the document inventory is clear, move into payer setup with Insurance Credentialing for Therapists.

Need a different part of the setup? Return to the Build Your Practice hub.

Work out what it actually pays

Most offers are written to foreground the flattering number. The guide gives you the math to work out what reaches your account, for any offer, on any platform.

Get the Clinician Pay Guide

Official sources and review scope

Official information checked September 6, 2026. Applicability and language vary by profession, jurisdiction, entity, client, service, payer, contract, technology, and record type.

HHS model Notices of Privacy Practices: revised February 2026 models and Part 2-related notice changes.
HHS individual right-of-access guidance and authorization guidance.
HHS HIPAA and telehealth guidance.
CMS good-faith-estimate guidance for uninsured and self-pay individuals.
42 CFR Part 2: confidentiality of substance-use-disorder patient records when applicable.
Florida Board of Clinical Social Work, Marriage & Family Therapy and Mental Health Counseling, Chapter 491, and Division 64B4.

Gabriel Benaim, LMHC

About the author

Gabriel Benaim is a Florida Licensed Mental Health Counselor. DegreeToLicense helps clinicians understand licensure, compensation, and the practical decisions involved in independent practice.

Disclaimer: Educational information, not individualized legal, privacy, security, documentation, billing, financial, insurance, or clinical advice. Confirm current requirements and practice-specific language with the relevant board, government agency, payer, insurer, attorney, privacy professional, or other qualified reviewer.