Checklist · Healthcare · Behavioral Health Practice

Behavioral Health Practice Compliance Checklist

A printable checklist for opening and running an Illinois behavioral health practice. It covers licensure and supervision, entity choice, mental health confidentiality, HIPAA, limits on artificial intelligence in therapy, substance use disorder records where they apply, workforce duties, and the evidence to keep.

By Lincoln Square Law · 15-minute read

🖨 Print this checklist

A therapy practice in Illinois answers to more than one confidentiality regime. HIPAA sets the federal baseline, but the Illinois Mental Health and Developmental Disabilities Confidentiality Act (the Confidentiality Act) decides who may see therapy records and communications, what a valid consent must say, and when a subpoena can be honored, and it lets an aggrieved person sue for damages (740 ILCS 110/3, 740 ILCS 110/15). Since August 1, 2025, Illinois has also limited what artificial intelligence may do inside a therapy practice (225 ILCS 155/20).

Use this list when forming the practice, adding a clinician or a new discipline, changing software, and preparing for an audit. It is written for clinical psychologists, clinical social workers, clinical professional counselors, marriage and family therapists, and group practices that combine them. Items marked as a recommendation go beyond what a statute requires.

1. Licensure, supervision, and titles

• Identify every licensed discipline in the practice and the act that governs it: the Clinical Psychologist Licensing Act, the Clinical Social Work and Social Work Practice Act, the Professional Counselor and Clinical Professional Counselor Licensing and Practice Act, or the Marriage and Family Therapy Licensing Act. Do not assume a structure or role permitted for one profession is permitted for another.
• Verify each clinician’s active Illinois license before the first scheduled session, and calendar every renewal and every change in supervisory status.
• Document the supervision the statute requires for each pre-clinical license. A licensed social worker in independent practice works under the order, control, and full professional responsibility of a qualifying clinician, a licensed professional counselor may not independently practice clinical professional counseling, and an associate licensed marriage and family therapist may not practice independently. A licensed professional counselor providing clinical services must give every client the supervisor’s name and contact information (225 ILCS 20/10(c), 225 ILCS 107/18, 225 ILCS 55/40(c)).
• Before an applicant sees clients while a license application is pending, confirm that the profession’s act allows it and on what conditions. The counseling act, for example, requires supervision and proof that the Department has received the application (225 ILCS 107/47).
• Write role descriptions that separate licensed therapy or psychotherapy from administrative work, so intake staff, coaches, care coordinators, interns, and technology vendors do not drift into services that require a license.
• Check every title on the website, business cards, directories, and scheduling system against the license actually held. Each licensing act protects its own titles, such as “psychologist,” “licensed clinical social worker,” “licensed clinical professional counselor,” and “licensed marriage and family therapist” (225 ILCS 15/3, 225 ILCS 20/10(a), 225 ILCS 107/20, 225 ILCS 55/15).
• Track the scheduled repeal date. As of this writing, the compiled text of the Clinical Psychologist Licensing Act and of the Marriage and Family Therapy Licensing Act each shows a repeal date of January 1, 2027, and the Governor’s Office of Management and Budget recommended in May 2026 that the psychology act be continued. Confirm with IDFPR before that date whether the General Assembly has extended both acts.

2. Entity, ownership, and compensation

• Choose the entity form before signing a lease, a payer application, or a vendor contract. A limited liability company that will provide a professional service licensed by IDFPR must be formed under the Professional Limited Liability Company Act (805 ILCS 180/1-25(d)).
• If clinicians from more than one discipline will co-own the practice, confirm the combination is permitted. Clinical psychology, social work, marriage and family therapy, and professional counseling may be combined in a professional service corporation or a professional limited liability company, with each service offered only by persons licensed to provide it (805 ILCS 10/3.6, 805 ILCS 185/13(b)).
• Issue shares or membership interests only to persons the statute permits. A professional service corporation may issue stock only to individuals licensed to render the same or related professional services (805 ILCS 10/11).
• Obtain the certificate of registration before the entity opens or operates an establishment, and calendar its renewal (805 ILCS 10/12, 805 ILCS 185/15(b)).
• Review every compensation formula, including associate splits, billing-company fees, and marketing or referral arrangements. The psychology and marriage and family therapy acts make it a ground for discipline to give or receive compensation for professional services not actually or personally rendered, while leaving bona fide employment and independent contractor arrangements in place (225 ILCS 15/15(a)(12), 225 ILCS 55/85(a)(12)).
• Recommendation: put terms in the owner agreement for death, disability, license discipline, departure, and sale, and name who takes custody of client records if an owner leaves or the practice closes.

3. Illinois mental health confidentiality

• Treat all records and communications as confidential and disclose them only as the Confidentiality Act provides (740 ILCS 110/3(a)).
• Use a written consent form, signed by the person entitled to consent, that contains each element of section 5(b): the person or agency receiving the information, the purpose, the nature of the information, the right to inspect and copy what will be disclosed, the consequences of refusing, the calendar date on which the consent expires, and the right to revoke. Without a calendar date, information may be released only on the day the therapist receives the form (740 ILCS 110/5(b)).
• Refuse blanket releases. Disclose only the information relevant to the stated purpose, and file a copy of the consent in the record with a notation of the action taken on it (740 ILCS 110/5(b), 740 ILCS 110/5(c)).
• Recommendation: send each disclosure with a written notice that the recipient may not redisclose it without the specific consent of the person who authorized the release (740 ILCS 110/5(d)).
• When you disclose without consent under one of the Act’s exceptions, note in the record the information disclosed, the purpose, the date, and the name of the recipient, except for the categories section 13 exempts (740 ILCS 110/13).
• Map access rights by age before the first minor client is scheduled. A recipient 12 or older has a personal right of access, a parent or guardian of a child under 12 has access, and a parent’s access to the record of a 12 to 18 year old depends on whether the minor is informed and does not object, or on the therapist finding no compelling reason to deny it. HIPAA defers to this state rule (740 ILCS 110/4(a), 45 C.F.R. 164.502(g)(3)(ii)).
• Write an intake path for minors 12 and older who ask for outpatient counseling or psychotherapy without a parent’s consent. For minors under 17, services are initially limited to eight 90-minute sessions, and by the eighth session the provider must decide, and tell the minor, whether a parent’s consent will be sought (405 ILCS 5/3-550).
• Train front-desk staff not to comply with a subpoena for therapy records unless it comes with a written court order or a section 5 consent from the person whose records are sought, and route every subpoena to the privacy officer the day it arrives (740 ILCS 110/10(d)).
• Do not ask clients to sign any waiver of Confidentiality Act protections. Such an agreement is void (740 ILCS 110/14).

4. Therapist notes and HIPAA access

• Decide, as practice policy, whether clinicians will keep personal notes under Illinois law. They stay outside the record only if kept in the therapist’s sole possession for personal use and not disclosed to anyone other than the therapist’s supervisor, consulting therapist, or attorney (740 ILCS 110/2, 740 ILCS 110/3(b)).
• Configure the EHR so psychotherapy notes, if kept, are separated from the rest of the record, and keep medications, session times, modalities, test results, and summaries of diagnosis and progress in the main record (45 C.F.R. 164.501).
• Obtain a HIPAA authorization for any use or disclosure of psychotherapy notes outside the narrow exceptions, such as use by the originator for treatment or the practice’s own supervised training programs (45 C.F.R. 164.508(a)(2)).
• Track access requests against the HIPAA deadline: action within 30 days, with one extension of no more than 30 days on written notice. Psychotherapy notes are excluded from the right of access (45 C.F.R. 164.524(a)(1), 45 C.F.R. 164.524(b)(2)).
• Send any proposed denial of access on safety grounds to a licensed health care professional, and offer review by a different licensed professional who did not take part in the original decision (45 C.F.R. 164.524(a)(3), 45 C.F.R. 164.524(a)(4)).

5. HIPAA security, vendors, and breach response

• Name a security official with authority to make and document decisions (45 C.F.R. 164.308(a)(2)).
• Complete a risk analysis of the real systems, including the EHR, telehealth platform, email, texting, phones, laptops, cloud storage, backups, and any AI documentation tool, and record the measures chosen to reduce each risk (45 C.F.R. 164.308(a)(1)(ii)(A), 45 C.F.R. 164.308(a)(1)(ii)(B)).
• Sign a business associate agreement before any vendor creates, receives, maintains, or transmits protected health information for the practice. The Confidentiality Act permits disclosure to a business associate on HIPAA’s terms (45 C.F.R. 164.502(e), 740 ILCS 110/9.8).
• Write the breach procedure with real names and phone numbers, and calendar the outer deadline: notice to each affected individual without unreasonable delay and no later than 60 calendar days after discovery (45 C.F.R. 164.404(b)).

6. Artificial intelligence in the therapy practice

• Inventory every AI feature in scheduling, billing, documentation, messaging, and client-facing tools, and classify each as administrative support, supplementary support, or a function the Act prohibits (225 ILCS 155/10, 225 ILCS 155/15).
• Disable any feature that makes independent therapeutic decisions, interacts directly with clients in therapeutic communication, generates therapeutic recommendations or treatment plans without the licensed professional’s review and approval, or detects emotions or mental states (225 ILCS 155/20(b)).
• Before AI assists with a session that is recorded or transcribed, inform the client or legally authorized representative in writing that AI will be used and for what specific purpose, and obtain consent (225 ILCS 155/15(b)).
• Assign a licensed professional who keeps full responsibility for each approved use, its outputs, and the data it handles, and record that assignment (225 ILCS 155/15(a)).
• Review marketing, app listings, and chatbot names so nothing offers therapy that is not conducted by a licensed professional. IDFPR may impose civil penalties of up to $10,000 per violation (225 ILCS 155/20(a), 225 ILCS 155/30).

7. Substance use disorder records

• Decide in writing whether the practice is a Part 2 program: one that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral, and is federally assisted, for example through Medicare participation, a DEA registration used for that treatment, federal funds, or tax-exempt status (42 C.F.R. 2.11, 42 C.F.R. 2.12(b)).
• If it is, update consent forms, patient notices, and record segmentation to the 2024 final rule, which had a compliance date of February 16, 2026 and permits a single consent for future treatment, payment, and health care operations disclosures (89 Fed. Reg. 12472).
• Recommendation: if it is not, record the reasons, and revisit the decision when the practice adds medication treatment, a new payer, or a new grant.

8. Workforce duties: reporting, protection, and telehealth

• Train every clinician as a mandated reporter within three months of starting and at least every three years, and keep the completion certificates (325 ILCS 5/4(j)).
• Teach that licensed psychologists, social workers, counselors, and marriage and family therapists are mandated reporters, that they must report immediately when they have reasonable cause to believe a child may be abused or neglected, and that the therapist and client privilege does not excuse a failure to report (325 ILCS 5/4(a), 325 ILCS 5/4(g)).
• Adopt a written duty-to-protect protocol. The Mental Health Code shields physicians, clinical psychologists, and qualified examiners from liability except where a client communicates a serious threat of physical violence against a reasonably identifiable victim, and it describes how that duty is met: a reasonable effort to warn the victim and law enforcement, or to hospitalize the client. The Confidentiality Act permits disclosure to protect against a clear, imminent risk of serious physical or mental injury (405 ILCS 5/6-103(b), 740 ILCS 110/11).
• Tell clinical psychologists and qualified examiners that determining a person poses a clear and present danger requires notice to the Department of Human Services within 24 hours. Clinical social workers, clinical professional counselors, and marriage and family therapists who meet the definition’s training and experience requirements can be qualified examiners (405 ILCS 5/6-103.3, 405 ILCS 5/1-122).
• For telehealth, hold an Illinois license or authorization for any client located in Illinois and apply the same standard of care as in person. Recommendation: confirm the client’s location at each session, and check the other state’s rules before treating a client located outside Illinois (225 ILCS 150/15).

9. The compliance file

• Recommendation: keep one compliance file holding the formation documents, certificates of registration, licenses, supervision agreements, consent templates, risk analysis, business associate agreements, AI inventory and approvals, Part 2 determination, training records, and disclosure log, and review it every year and whenever the practice adds a discipline, a location, a payer, or a software platform.

Personal notes and psychotherapy notes are not the same record

Illinois personal notes and HIPAA psychotherapy notes overlap, but their conditions differ. Under the Confidentiality Act, personal notes cover information a third party gave the therapist on condition that it never be disclosed to the client, information from the client that would harm the client’s relationships if disclosed, and the therapist’s speculations, impressions, hunches, and reminders. They stay outside the record only while they remain in the therapist’s sole possession, shared at most with a supervisor, consulting therapist, or attorney, and the statute treats them as the therapist’s work product, not subject to discovery (740 ILCS 110/2, 740 ILCS 110/3(b)).

HIPAA psychotherapy notes document or analyze the contents of a counseling session and must be kept separate from the rest of the medical record (45 C.F.R. 164.501). A note stored in a shared EHR can meet the HIPAA definition if it is properly separated, yet fail the Illinois sole-possession condition if other people can open it. Decide which category your clinicians are using before the software is configured, not when the first records request arrives.

Group practices that combine disciplines

Illinois allows clinical psychologists, social workers, marriage and family therapists, and professional counselors to own one professional entity together, but one owner’s license does not widen what the others may do. Each service must be offered by someone licensed for it, and supervision rules follow the supervised clinician’s license, not the entity’s name (805 ILCS 185/13(b), 225 ILCS 20/10(c)). The acts do not name the same supervisors. The social work act, for example, lists marriage and family therapists among those who may supervise a licensed social worker in independent practice, while the corresponding section of the counseling act does not name them (225 ILCS 20/10(c), 225 ILCS 107/18(b)).

Before a clinician of one discipline supervises another, confirm that the supervisee’s licensing act recognizes that supervisor, and keep the signed supervision agreement in the compliance file.