Behavioral Health IT Support for Group Practices

These rules set duties for the practice. A practice meets them with policies, training and the right controls; no IT product makes a practice "compliant" by itself.

• HIPAA risk analysis, 45 CFR 164.308(a)(1). HIPAA requires an accurate and thorough assessment of risks to electronic client information, then security measures that reduce them. It covers home offices and telehealth tools too. See our HIPAA risk assessment.
• Psychotherapy notes, 45 CFR 164.501 and 164.508(a)(2). HIPAA defines psychotherapy notes as a mental health professional's notes documenting or analyzing the contents of a counseling session, kept separate from the rest of the record. Most uses and disclosures need the client's authorization. In IT terms: store them apart, limit access by role and record who opens them.
• 42 CFR Part 2 for substance use disorder programs. Federally assisted SUD programs follow Part 2 as well as HIPAA. The final rule published February 16, 2024 lets a client give a single consent for future treatment, payment and health care operations, applies HIPAA's breach notification rules to Part 2 records, and requires formal policies for securing electronic records and sanitizing the media they are stored on. Compliance was required by February 16, 2026.
• Telehealth video and messaging. HHS's pandemic-era enforcement discretion for telehealth ended with the public health emergency on May 11, 2023, followed by a 90-day transition. Telehealth tools that handle client information now fall under the full HIPAA rules, including a business associate agreement with the vendor (45 CFR 164.308(b)) and protection of data in transit (45 CFR 164.312(e)).

State rules add notice duties. In California, the Confidentiality of Medical Information Act requires providers to keep medical information confidential (Civil Code 56.101), and Civil Code 1798.82 requires notice when residents' unencrypted medical information, including mental condition, is breached. Massachusetts expects a written information security program under 201 CMR 17.00, and M.G.L. c. 93H requires breach notice to the attorney general, the consumer affairs office and affected residents. Florida requires reasonable protection of electronic personal information and notice to affected individuals no later than 30 days after a breach is determined (Fla. Stat. 501.171).

For the full picture, read our 2026 HIPAA IT and security guide for behavioral health practices or see HIPAA compliance services.

Our job is to take IT and cyber worry off the practice so clinicians can focus on clients. ACS is a national, remote-first company: each practice is assigned a named Technical Account Manager and a dedicated pod of technicians who get to know its clinicians and systems, giving you fractional IT and cybersecurity expertise without building an internal IT team. Problems are solved remotely first, project work is scheduled onsite, and support stays proactive and personalized to your clinical calendar.

This service is designed around group practices of 26 to 50 people on 30 or more computers across one to three sites, with part of the team seeing clients from home. Every site and every home office gets the same sign-in rules, device standard and security baseline, so a clinician who sees clients at the clinic on Monday and from home on Tuesday signs in the same way and reaches the same records. Opening a new site is a scheduled onsite project, with internet, session-room devices and the front desk planned before the first appointment.

Every practice gets a named Technical Account Manager. Smaller practices share a specialist pod that looks after a handful of clients; larger groups get a dedicated pod.

Our mental health practice IT support comes in three plans, priced per endpoint per month: Core IT $110, Proactive IT $175 and Complete IT $295. Each includes everything in the plan below it. Count everyone who signs in, including clinicians who work from home.

Worked example (arithmetic on the list prices, not a quote): a three-site group practice with 28 computers on Proactive IT: $4,900 a month at $175 per endpoint. On Core IT, those 28 computers come to about $3,080 a month.