HIPAA Compliance

Last updated: 13 June 2026. HIPAA requirements depend on how the platform is used. This page is information only and should be reviewed by appropriate US HIPAA counsel before regulated use.

HIPAA and Private Therapy Network

HIPAA applies to US covered entities and business associates that handle protected health information. UK-only users usually do not need HIPAA compliance, but we provide HIPAA-focused safeguards and documentation for US users and professionals who may handle US protected health information through the platform.

Business Associate Agreement

Professionals creating an account are required to review and accept our Business Associate Agreement where HIPAA-related use may apply. The BAA explains permitted uses of protected health information, safeguards, breach reporting, subcontractors, access support and professional responsibilities.

Technical safeguards

• Encrypted HTTPS connections for data transmitted between users and the website.
• Encryption controls for sensitive lead and client fields where implemented in the application.
• Authentication required for portal access.
• Role-based access so users only access areas appropriate to their account type.
• Password hashing and secure account handling through the application framework.
• Audit-aware administrative workflows to help monitor sensitive account and data activity.
• Backups and hosting controls intended to support availability and recovery.

Administrative safeguards

• Professional account registration and review workflows.
• Policies covering privacy, terms, safeguarding, complaints and professional responsibilities.
• Data minimisation practices so enquiries only request information needed for matching and support.
• Confidentiality expectations for anyone with access to sensitive platform information.
• Processes for responding to security issues, account concerns and support requests.

Physical and hosting safeguards

The platform is hosted through third-party infrastructure providers that maintain their own physical security, environmental controls, network controls and availability processes. Where providers may access regulated information, appropriate contractual and security expectations should be maintained.

Professional responsibilities

Professionals are responsible for their own HIPAA status, client notices, consents, clinical records, secure communications outside the platform, professional judgement, identity checks, patient rights requests and any disclosure of information after an enquiry has been accessed.

Important limitation

No website can make a professional automatically HIPAA compliant. Compliance depends on the professional's own policies, workflows, staff training, technology choices and how protected health information is handled. Private Therapy Network provides platform safeguards and contractual documentation to support HIPAA-related use.