Best HIPAA Compliant Therapy Software in 2026

What HIPAA compliance actually requires

There is no official HIPAA certification. No government body stamps software as compliant, so when a vendor says "HIPAA compliant," it can only mean two things: the software supports the safeguards the law requires, and the vendor will sign a business associate agreement accepting legal responsibility for the protected health information (PHI) it handles for you. Compliance itself belongs to your practice, not to any product you buy.

The requirements come from three rules. The Privacy Rule governs how PHI can be used and disclosed. The Security Rule requires administrative, physical, and technical safeguards for electronic PHI: access controls, encryption, audit logs, integrity controls, and transmission security. The Breach Notification Rule requires you to notify affected clients and the Department of Health and Human Services when unsecured PHI is compromised. Good software makes the technical safeguards automatic and gives you the records you would need after an incident.

This guide covers the full stack a therapy practice touches: EHRs, engagement and homework platforms, and telehealth video. For the broader category comparison beyond compliance, start with our guide to the best therapy software.

The BAA: what makes software legal for PHI

A business associate agreement (BAA) is a contract required by HIPAA whenever a vendor creates, receives, stores, or transmits PHI on your behalf. It binds the vendor to safeguard that PHI, report breaches to you, and accept liability for its share of a failure. Using software that touches client data without a BAA in place is itself a HIPAA violation, no matter how secure the software is. That is why "will you sign a BAA?" is the first question to ask any vendor, and why we verified the answer for every tool in this guide.

How it works varies by vendor, and the differences matter in practice. TherapyNotes builds the BAA directly into its terms of service (effective April 23, 2026), so covered entities are covered through acceptance of the terms with no separate signature. Sessions Health executes a BAA that becomes effective on the date you sign up. Quenza handles it the traditional way: you request the BAA by emailing info@quenza.com, sign it, and receive a countersigned copy for your records. doxy.me includes a BAA on every plan, including its free one. SimplePractice and Carepatron both make BAAs available as part of their compliance programs. Whichever route your vendor uses, keep a copy of the executed agreement or the governing terms that names your legal entity; an auditor will ask for it.

The HIPAA compliance checklist

Use these criteria for HIPAA compliance in therapy software when you evaluate any vendor, whether it appears in this guide or not.

• A BAA you can actually obtain. Not a claim of compliance, an agreement. If sales cannot tell you how the BAA gets executed, walk away.
• Encryption in transit and at rest. TLS for data moving to and from the server, and strong encryption (AES-256 is the standard the vendors here cite) for stored data.
• Unique logins and role-based access. Every clinician and admin needs their own account with permissions matched to their role; shared logins destroy accountability.
• Two-factor authentication. The cheapest single defense against credential theft, and table stakes in 2026.
• Audit trails. A record of who viewed and changed what, and when. You need this for the Security Rule and you will really need it after an incident.
• Automatic logoff and session controls. Screens left open in shared offices are a classic small-practice breach.
• Backups and disaster recovery. Availability of records is part of the Security Rule, not a nice-to-have.
• Data export. You must be able to get client records out in a usable format, both for continuity of care and for leaving the vendor.

Independent security certification is a strong extra signal. HITRUST certification, which SimplePractice, TherapyNotes, and Ensora Mental Health hold, means an outside assessor validated the vendor's controls rather than taking the marketing page's word for it.

The best HIPAA compliant therapy software in 2026

1. Quenza

Quenza is our top pick among client engagement platforms because it brings full compliance to the layer of therapy software where compliance is most often ignored: homework, assessments, and between-session communication. Therapists routinely send worksheets over regular email or collect intake forms through generic survey tools, and neither will sign a BAA. Quenza replaces that gray zone with a compliant system: build forms, assessments, and psychoeducation in the Activity Builder, chain them into automated Pathways, message clients through 1:1 or group chat, and let clients complete everything in a mobile app. It is HIPAA and GDPR compliant with AES-256 encryption and PIN protection on the client app, and the BAA is requested by email and countersigned by the company.

Pricing starts at $25 per month (Spark, 10 clients), with Growth at $50 for 250 clients, Impact at $125, and Collective at $160 for 3 professionals; annual billing is 20 percent off and the 30-day trial needs no card. The honest limits: Quenza is not an EHR and has no insurance billing, no calendar booking, and no video calling, so it runs alongside one of the EHRs below rather than replacing them.

2. SimplePractice

SimplePractice is the most widely used private-practice EHR in the United States, and its compliance posture matches its scale: HITRUST certified, BAA available, encrypted records, telehealth, and a client portal that keeps documents and messages out of email. Plans run $49 (Starter), $79 (Essential), and $99 (Plus) per month, with a 30-day free trial, no card required, and a 50 percent discount on the first 3 months at the time of writing. The limitation is cost creep: useful capabilities like the AI note taker and some plan features sit in add-ons and higher tiers, so price the tier you will actually need.

3. TherapyNotes

TherapyNotes treats compliance as a product feature. It is HITRUST certified, extended that certification to its AI features, and in April 2026 moved the BAA into its terms of service so every covered entity is automatically covered, an approach that removes the most common compliance paperwork failure (the unsigned BAA sitting in someone's inbox). Records, telehealth, the client portal, and unlimited document storage are all included at $69 per month solo or $79 plus $50 per additional clinician for groups, with free non-clinical staff accounts, 24/7 phone support, and a 30-day trial. The limitation: it is mental health only and less customizable than newer rivals, though custom note templates have narrowed that gap.

The best HIPAA compliant therapy software on a budget

4. Sessions Health

Sessions Health proves that a $39 per month EHR can take compliance as seriously as the big names: AES-256 encryption at rest and in transit, two-factor authentication, role-based permissions, detailed audit trails, and a BAA that becomes effective the day you sign up, with terms that carry into a paid account. There is a free plan for up to 3 active clients, and the paid plan is $39 for the first practitioner with unlimited clients. Limitations are scope, not security: lighter automation than SimplePractice, and telehealth costs an extra $10 per month per practitioner.

5. Carepatron

Carepatron is the strongest free option for practice software: unlimited clients and practitioners on the $0 plan, with HIPAA, GDPR, and PIPEDA compliance stated for all plans and a published business associate agreement. Paid plans are $31 (Plus) and $39 (Advanced) at regular pricing, currently half off for 6 months. The honest caveats: it is a generalist healthcare platform rather than a therapy specialist, template quality varies, and on the free tier you should confirm during onboarding that the BAA covers your entity before storing PHI, because a free plan without an executed BAA is not a compliant setup.

6. Ensora Mental Health (TheraNest)

TheraNest, now Ensora Mental Health after its parent's rebrand, is a HITRUST-certified, HIPAA compliant EHR that group practices have run on for years. Entry pricing starts at $29 per therapist per month with a 21-day free trial, and higher tiers (listed at $59 and $89) add automation, claims volume, and the Wiley Treatment Planner. The limitations: the rebrand has left documentation in transition, and per-therapist tiering plus add-on fees for admin users make real costs higher than the sticker price for growing teams.

Best for psychiatry and for teletherapy video

7. ICANotes

ICANotes is a behavioral health specialist EHR built with compliance for higher-acuity settings in mind, and it is one of the few affordable options that fully supports prescribers, with ePrescribing including controlled substances. Non-prescribing clinicians pay $75 per month full time ($55 for a notes-only seat), and prescribers pay $213 plus a $99 activation fee. Its pre-configured clinical templates produce thorough, defensible documentation quickly. The limitations: a dated interface and a 3-month minimum commitment, which no one else on this list requires.

8. doxy.me

doxy.me is the answer to a very common compliance question: how do I get HIPAA compliant video for teletherapy without another subscription? Its free plan is genuinely HIPAA compliant and includes a BAA, with no download for clients, who join from a browser link. Paid plans add features like screen sharing quality, clinic workflows, and multi-provider coverage; note that the free and individual BAAs cover a single provider, so group practices should ask doxy.me about a clinic-level BAA. The limitation is obvious but worth stating: it is video only, with no notes, billing, or records, so it complements rather than replaces the platforms above.

HIPAA compliant video, messaging, and email

Online therapy adds three compliance surfaces beyond your EHR. Video: consumer video tools are the trap here, because personal accounts on mainstream apps do not come with a BAA; use doxy.me (free BAA included), the telehealth built into SimplePractice, TherapyNotes, or Sessions Health, or a healthcare plan from a video vendor that explicitly signs a BAA for your account type. Messaging: texting clients from your personal phone puts PHI on an unsecured channel; move between-session communication into a covered platform, such as Quenza's chat or your EHR portal's messaging. Email: standard email is not encrypted end to end, so anything clinical belongs in a portal, with email reserved for logistics that contain no PHI.

The pattern across all three is the same: the compliant version of every channel exists and is often free or nearly free, so the risk is rarely worth what it saves. A practical stack for a fully remote practice in 2026 is an EHR for records and billing, doxy.me or built-in telehealth for sessions, and Quenza for homework, assessments, and secure chat between sessions.

Therapy notes software with HIPAA compliance

Documentation deserves its own compliance check because notes are the densest PHI you produce. Every EHR ranked here stores notes encrypted with role-based access and audit trails; TherapyNotes and SimplePractice are the standouts for note workflows, Sessions Health is the budget pick, and ICANotes leads for psychiatric documentation depth. Two extra checks matter for notes specifically. First, psychotherapy notes (your private process notes) receive special protection under HIPAA only if they are kept separate from the clinical record, so prefer software that supports a separate, non-disclosable notes field. Second, if you use an AI documentation tool, the AI vendor is also a business associate: it needs its own BAA, and TherapyNotes' HITRUST certification of its AI features shows what good practice looks like there.

We compare note templates, workflows, and the AI scribes in depth in our dedicated guides to therapy notes software and the broader stack in therapy practice management software.

What HIPAA compliant software cannot do for you

Buying compliant software does not make your practice compliant, and vendors who imply otherwise are overselling. Your practice still owns the administrative side: a documented security risk assessment, written policies and procedures, workforce training, a breach response plan, and sensible device hygiene like full-disk encryption and screen locks on every laptop and phone that touches client data. The most common small-practice violations are not software failures at all; they are an unencrypted laptop stolen from a car, a shared login, or a worksheet emailed to the wrong address.

Two more boundaries worth knowing. If you see clients outside the United States, HIPAA is not the only rule: EU and UK clients bring GDPR obligations, which is why Quenza's HIPAA plus GDPR coverage and Carepatron's HIPAA, GDPR, and PIPEDA coverage matter for international caseloads. And several US states now layer their own health privacy laws on top of HIPAA, so telehealth practices operating across state lines should confirm state requirements rather than assuming HIPAA is the ceiling.

How we evaluate therapy software

For this guide we verified three things per vendor on July 10, 2026: current pricing and trial terms on the vendor's own pricing page, the compliance claims the vendor makes in its own words, and the specific mechanism for obtaining a BAA, from vendor support documentation wherever it is published. We do not repeat review-site compliance claims without checking them against vendor sources, and where a detail could not be confirmed publicly (such as add-on pricing a vendor does not publish), we say so in the text and tell you to confirm with sales.

Scoring weighs the safeguard checklist above, independent certification such as HITRUST, the friction of actually executing the BAA, and value for money at solo and group scale. Vendors change pricing and terms without notice, so treat every number here as accurate on July 10, 2026 and confirm before you buy.