Practice tips
The HIPAA Liability of Email in a Therapy Practice
Why email and text are a HIPAA liability for intake and scheduling, and the audit-trail question that matters most when choosing a client portal.
Published June 7, 2026 · Updated August 29, 2026 · 6 min read
Why email and text are the wrong default
It is common for a solo or small-group practice to start with email for intake paperwork and text for rescheduling, because it's what's already installed on every phone. The problem is that neither is built to hold protected health information, and most email providers won't sign a Business Associate Agreement for a personal or generic business account. Every intake form emailed as a PDF attachment, every “can we move Tuesday's session” text with a client's name in it, is technically PHI sitting outside a covered system.
A portal solves this by giving clients one place — branded to your practice, covered under your BAA — to do everything that used to happen over insecure channels.
The core liability question, not the full feature list
For the complete feature checklist — booking, digital intake, outcome measures, rollout sequencing — see Client Portal for Therapy Practices. What matters most from a liability standpoint is narrower: does the portal message thread create a real audit trail, or does that exchange still end up living in a clinician's personal phone where it can't be produced if a record request or audit ever requires it?
Why branding on the portal isn't cosmetic
For a telehealth-heavy practice, the portal may be the only “place” a client ever interacts with your practice outside of the session itself — there's no physical waiting room reinforcing that this is a real, established clinic. Your practice name, logo, and colors on every login, form, and reminder email are a legitimacy signal that generic third-party branding doesn't provide.
What to check before choosing a portal
- Is the portal covered under the same BAA as the rest of the platform, or a separate bolted-on tool?
- Can clients complete intake and consent forms fully online, with e-signature?
- Do outcome measures score automatically and appear as a trend in the chart, not a static PDF?
- Is messaging two-way and logged, or one-way notifications only?
- Can the portal carry your practice’s own name and branding, not the vendor’s?
In Ritaja Practice, the portal, chart, billing, and messaging all live in the same tenant — a client's intake form, PHQ-9 score, and session note are already connected when the clinician opens the chart, with no separate export or upload step.
FAQ
- Is email HIPAA compliant for sending intake forms to clients?
- Generally no, unless you have a Business Associate Agreement with your email provider and are using encrypted transmission — most personal or standard business email accounts don’t meet this bar. A client portal covered under your practice’s BAA is the safer default.
- What is the biggest risk with texting clients from a personal phone?
- That exchange typically isn’t logged or covered under a Business Associate Agreement, and can’t be produced if a record request or audit later requires it — unlike a portal message thread tied to the chart.
Ready to simplify your practice?
Calendar, notes, billing, payroll, and client portal — in one workspace.
No card required to sign up. Your trial begins when you complete clinic activation. No usage meters and no overage charges — your bill is always your plan rate times your billable clinicians.