# The Mahla Manual How to build the practice of your dreams. Operational guides for therapists, in writing and on video. # How to Get Your First Therapy Clients: A Prioritized, Ethics-First Roadmap for New Private Practices How to get therapy clients: a prioritized, ethics-first roadmap for new private practices. Fill your caseload with directories, referrals, and easy booking. By Jonathan Read · Head of Product at Mahla Published: 2026-09-11T00:00:00Z Updated: 2026-09-11T00:00:00Z Source: https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/ Reviewed by Alex Cohan, MS, LPC-Associate, NCC · Clinical Therapist Review scope: Advertising and solicitation ethics guidance Reviewed: 2026-09-11T00:00:00Z If you're searching for how to get therapy clients, you already know the hard part. You finished graduate school and supervised hours ready to help people, not to run ads, chase followers, or build a personal brand. Then the caseload doesn't fill on its own, and every guide on how to get clients as a therapist hands you the same list of twenty things to do at once, in no particular order, with no mention of whether any of it is even allowed for a licensed clinician. This guide does three things those lists don't. It's **prioritized**, so you know what to do first when time and money are scarce. It's **ethics-first**, so every recommendation stays inside APA, ACA, NASW, and state-board rules, and we flag the popular advice that crosses them. And it's **operationally grounded**, built on a decade of running behavioral health practices across multiple states, so it connects getting clients to the systems that keep them. The short version: getting your first clients when you're starting a private practice is a referral and retention problem, not a marketing one. It runs on three levers. Be easy to **find**, easy to **refer to**, and frictionless to **book**. We'll walk through that system in order of payoff, so your first hour of effort goes where it pays. --- ## Why "Marketing Harder" Backfires (and What Actually Fills a Caseload) If the phrase "market yourself" makes you want to close this tab, that instinct is worth listening to. Most marketing advice for therapists tells you to do more. More social media, more ads, more networking events. For a clinician who trained to help people and not to sell, that feels exhausting and slightly wrong. It usually is. Getting your first clients is a referral and retention system, and it runs on three levers: - **Findable.** You show up where clients and referrers are already looking. - **Referable.** You're easy and safe for a colleague to send someone to. - **Bookable.** Nothing stands between "I need help" and a confirmed first session. **The fastest way for a new therapist to get their first clients is to become easy to find, easy to refer to, and frictionless to book, then deliver a professional first session so referrals compound.** That means three moves, in order: (1) list on the directories your ideal clients search, (2) build board-compliant referral relationships around a clear niche, and (3) remove every step between an inquiry and a booked first session. Posting on Instagram, running ads, and "putting yourself out there" didn't make that list. Those are amplifiers. Reaching for them before the foundation exists is why marketing feels like a second full-time job. When you can't do everything, the only question that matters is what to do first. --- ## The Prioritized Roadmap: Where to Start When Time and Money Are Scarce You can't do fifteen things at once in your first month, and no one should ask you to. So the real question behind "how to get therapy clients" is "what should I do first?" Channels differ sharply on cost, effort, and how quickly they produce a booked client. Ranking them beats listing them. In our experience operating behavioral health practices across multiple states, the two channels that convert fastest for a brand-new clinician are almost always **directories** (Findable) and **referral relationships** (Referable). Not paid ads and not social media. Published practitioner guidance points the same direction, treating directories and referral networks as the primary first-client channels while paid and social pay off more slowly. [\[13\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-13)[\[10\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-10) Directories put you in front of people already searching for a therapist. Referrals arrive pre-trusted. Everything else amplifies these two once they're working. Use this table to pick your first two moves based on your budget, time, and niche: | Channel | Cost | Effort | Speed to first client | Ethics notes | Best for | |---|---|---|---|---|---| | Therapist directories | Free–$30/mo | Low (one-time profile) | Fast | Truthful profile, no guarantees | Almost everyone. Start here. | | Referral relationships | Free | Medium (ongoing) | Fast once seeded | Anti-kickback + board rules apply | Highest trust, compounds over time | | Website + booking | Free–low | Medium (one-time setup) | Medium | Accurate claims only | Turning interest into sessions | | Niche + bio | Free | Low (thinking work) | Indirect (multiplier) | Honest scope of practice | Making every channel convert better | | Social media | Free–time-heavy | High (ongoing) | Slow | No client testimonials | Optional amplifier, later | | Insurance/telehealth networks | Free–credentialing time | High (paperwork) | Slow | Standard payer rules | Steady volume once credentialed | *Costs are typical 2026 ranges and vary by directory and region. [\[6\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-6)* If you only do two things this month, do the top two: get listed, and start a handful of referral conversations. You don't have to be everywhere. You have to be in the two places that convert fastest. Every fast channel on that table depends on the same thing working underneath it: a referred or searching client has to be able to schedule with you. We'll come back to that. First, get found. --- ## Get Listed Where Clients Actually Search: Therapist Directories, Compared When someone decides to find a therapist, they rarely start on your website. They start on a directory or a search engine. That makes a directory profile the highest-priority Findable action you can take, and often the source of your first inquiry. Directories aren't interchangeable. They differ by cost, by the audience they attract, and by how well they fit a given niche. Here's how the best therapist directories compare: | Directory | Cost | Audience | Best for | |---|---|---|---| | Psychology Today | ~$30/mo ($29.95) [\[7\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-7) | Largest general therapy-seeker audience | Broad reach, most niches | | TherapyDen | Free–low | Values-aligned, inclusive-care seekers | Progressive/identity-focused niches | | Insurance-based directories | Free (with credentialing) | Clients filtering by coverage | Panel-based, insurance-reliant practices | | Google Business Profile | Free | Local searchers ("therapist near me") | Zero-cost local discoverability | A profile only works if it converts. Two habits separate profiles that fill a caseload from profiles that collect dust. First, write for the client, not the credentialing board. Lead with who you help and what you help with, in plain first-person language, not a wall of letters after your name. Second, **measure and prune.** Track which directory produces booked clients. Most practitioners find a small number carry the bulk of their bookings, so a little conversion tracking tells you where to keep spending. [\[14\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-14) You don't need to be on every directory. You need to be on the one your ideal client browses. Start with a free Google Business Profile plus one paid directory that fits your niche and you have real discoverability at close to zero cost. Being found is half of Findable. The other half is being someone a colleague trusts enough to send a client to. --- ## Build a Referral Network That Compounds A client sent by a physician, a former supervisor, or a colleague shows up already believing you can help. That is why referrals convert better than almost any other channel a new clinician has. [\[13\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-13) The word "networking" is where a lot of clinicians freeze, because it sounds like sales. Learning how to get referrals as a therapist has little to do with working a room. You're making it effortless for a trusted colleague to send someone your way. The people worth a short, real introduction include: - Primary care physicians and psychiatrists - School counselors and college counseling centers - Clinical colleagues in adjacent specialties (you take what they don't) - Former supervisors and training-site contacts - Complementary providers (dietitians, OB-GYNs, physical therapists) **A referral only converts if you're easy to book.** A colleague who refers a client to you is putting their own reputation on the line. If that client hits a ten-minute booking form or waits three days for a reply, the referrer hears about it and stops referring. Being easy to refer to means three concrete things: a clear niche, a bio that builds confidence, and one-click scheduling. More networking doesn't fix any of those. You'll also want social proof, and for a clinician the ethical version looks different. Skip client testimonials (there's a board-rules reason, covered below). Lean on professional referrals, compliant directory presence, and plain descriptions of your training and approach instead. Before we get to booking, three assets make every referral and directory listing convert better in the first place. --- ## Make Your Practice Easy to Choose: Niche, Bio, and Website Before a client books, they make a quick, gut-level decision: *does this person get someone like me?* Three assets answer that question. Your niche, your bio, and your website. Get them right and every other channel converts better. Get them vague and even great directories underperform. Start with niche, because it's the multiplier. A niche is a *who*. "Anxiety therapy" is a modality. "First-generation professionals navigating burnout" is a niche. A narrow niche is the reason the right client feels you're speaking directly to them. To find yours: 1. List the clients you most enjoy and feel most effective with. 2. Name what they'd say you helped them with, in their words. 3. Match that to the directories and referral sources those clients use. 4. Write your bio in that same language. That last step matters because your bio does triple duty. It's your directory copy, your website copy, and the story a referrer tells on your behalf. Combine your credentials (briefly), your approach (plainly), and client-facing language that names the problem before the method. Your website has one job, and it's more important than most people think: **make booking effortless.** Visible scheduling on every page, a clear path from homepage to booked session, mobile-friendly, telehealth-ready. The practice-management tools running behind your website are what make one-click booking real. A beautiful site with a buried "contact me" form converts worse than a plain site with a booking button above the fold. --- ## Remove Booking Friction and Nail the First Session The referral you worked hardest for is the one you lose to a booking form that takes ten minutes to find. Most guides stop at "get the inquiry." The stretch between an inquiry and a returning client (booking, intake, and the first session) is where a lead becomes a caseload. This is the retention half of acquisition, and it's the half competitors ignore. Operations aren't glamorous, but they're measurable, and small frictions add up. From our operating data across multi-state behavioral health practices, a handful of factors decide whether an inquiry ever becomes a booked, retained client. Industry guidance says the same thing: fast, low-friction follow-up improves acquisition and retention. [\[13\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-13)[\[11\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-11) - **Response time.** Inquiries answered quickly convert far more often than those left overnight. The first practice to reply usually wins the client. - **One-click scheduling.** Every extra step between "I want to book" and a confirmed appointment sheds people. - **Short intake.** A long pre-session form is where motivated clients drop off. Ask for what you need for the first session, not everything. - **Instant confirmation.** A booked-and-confirmed appointment with a reminder reduces no-shows and reassures an anxious first-timer. - **A prepared first session.** The first session is where one client turns into word-of-mouth. Arrive organized, oriented, and present. I watched this pattern hold while building a HIPAA-compliant telehealth platform used by thousands of patients across multiple states. The practices that grow are rarely the ones with the flashiest marketing. They're the ones a nervous new client can reach, book, and trust in under a minute. None of this requires more of *your* energy. A professional, compliant foundation that handles booking, intake, and documentation for you removes the overhead so you can focus on clients and care. That means the telehealth platform you use to see clients and [a compliant EHR that handles documentation for you](/manual/free-ehr-for-therapists-2026/). It can cost $0 to set up, which we'll get to shortly. First, one barrier stops many clinicians before they list, refer, or book anything at all: the fear that promoting themselves is against the rules. --- ## The Ethics of Therapist Marketing: What Boards and APA/ACA/NASW Actually Allow > **This section is general educational information, not legal or compliance advice.** Advertising and solicitation rules vary by profession and by state licensing board. Verify the specific requirements for your license and jurisdiction before acting. Before you act on any of this, the fear that stops most clinicians cold deserves an answer: *am I even allowed to promote myself?* Yes. You are allowed to advertise. What you can't do is promise outcomes or ask current clients for testimonials. [\[1\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-1)[\[4\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-4) Here's the line, in plain language. **Generally allowed:** - Truthful, non-deceptive advertising of your services and specialties [\[1\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-1)[\[2\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-2) - Accurate presentation of your credentials, licensure, and training - Professional referrals and compliant directory listings - Educational content that informs rather than diagnoses **Restricted or prohibited:** - **Soliciting testimonials from current psychotherapy clients**, and in many cases former clients, because of the power differential and privacy risk. [\[1\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-1)[\[2\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-2)[\[3\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-3) - Guaranteeing outcomes or cures - Deceptive, misleading, or fabricated claims about results or qualifications The testimonials point deserves a flag, because popular articles tell new therapists to "collect client testimonials." **Follow that advice and you may be violating your ethics code.** [\[5\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-5)[\[1\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-1) Soliciting a review from someone currently in your care creates a coercive dynamic your board takes seriously. Rely on professional referrals, plain descriptions of your approach and training, and compliant directory presence instead. You have real permission to market. You do it within rules designed to protect the people you serve. > *The advertising and solicitation guidance in this section was clinically reviewed by Alex Cohan, MS, LPC-Associate, NCC, September 2026.* --- ## Is Social Media Worth It? (Probably Not First) If you'd rather not post on Instagram, good news: it's optional, and it's almost never where your first clients come from. Social media is high effort and slow payoff for a new practice. Building an audience takes months of consistent posting before it produces a single booked client, and for a clinician stretched thin, that's energy pulled away from the two channels that convert now. [\[13\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-13) Treat social media as an amplifier, something you might add once directories, referrals, and your booking flow are working. If you do want a presence, keep it small and sustainable. Pick one platform, post consistently rather than constantly, and share useful ideas instead of promoting yourself. Skipping it at the start is a strategy. Put that hour into your directory profile or a referral coffee. That's where your first caseload is, and it can be built for almost nothing. --- ## How to Get Therapy Clients for Free: Starting at Zero Cost You do not need to spend money you don't have yet to look professional and stay compliant. A new clinician with no revenue can become findable and bookable at $0. Here's a zero-cost starter stack that gets you visible, credible, and ready to see clients: - **A free directory presence.** A Google Business Profile plus at least one free or low-cost directory listing in your niche. - **A simple, booking-first web presence.** Even a single page with a scheduling link. - **A compliant, free booking/intake/documentation foundation.** So inquiries can turn into confirmed sessions. The most common misconception is that "free" means "not HIPAA-compliant" or "not professional." That's no longer true. A free starter stack of practice tools can be fully compliant, and there are free, HIPAA-compliant telehealth platforms built for exactly this stage. > **Disclosure:** This guide is published by Mahla. The product mention below is clearly labeled and kept separate from the ethics and compliance guidance above. This is where Mahla fits. Mahla is a free base platform for video, scheduling, intake, documentation, and compliance, the frictionless-booking foundation this whole guide points to. There are no per-user fees, no trial countdowns, and no sales calls. You pay about $1 per task for AI features (a SOAP note, a treatment plan, a CPT code suggestion) when you use them. A therapist with zero clients can set up a professional, compliant first-session experience today for zero dollars, so your energy goes to clients instead of stitching together five disconnected apps. With money answered, the other big worry is time. --- ## How Long It Takes and What a Healthy First-Year Caseload Looks Like Unrealistic expectations cause more early burnout than slow phones do. Most new therapists see their first clients within a few weeks to a few months of setting up directories and referrals. Not days, and not a year. [\[9\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-9)[\[10\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-10) The range is wide because it varies by niche, referral relationships, insurance status, and location. A narrow, well-matched niche in an underserved area fills faster than a general practice in a saturated metro. Building a caseload usually takes months, not days. That's normal. As for "how many clients is enough," a sustainable full-time caseload is often in the range of roughly 20–25 client sessions per week, with many clinicians intentionally seeing fewer. Burnout risk climbs past the low-to-mid 20s once documentation and admin are counted. [\[11\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-11)[\[12\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-12) More isn't better if it costs you the quality of care that earns referrals in the first place. One accelerator worth repeating: reducing booking friction shortens the gap between interest and a first session, so the operations work you did earlier shortens this timeline. Here's where to spend your first week. --- ## Your First-Week Action Plan You don't have to do all of this today. Start with step one. Here's the highest-return version of how to get therapy clients in your first week, in Findable → Referable → Bookable order: 1. **Pick your niche and write a client-facing bio.** One clear "who," in their language. 2. **List on the one directory your ideal clients actually search**, plus a free Google Business Profile. 3. **Set up a free, compliant booking and documentation foundation.** The easiest, highest-return win of the week, and the step that makes every referral convert. 4. **Email 3–5 potential referral sources.** A short, real note, not a pitch. 5. **Turn on one-click scheduling**, so the very next inquiry can book without friction. That's a week of focused effort, and it sets up a system that keeps working after the week ends. The whole idea is to become easy to find, easy to refer to, and frictionless to book, then let a good first session turn one client into the next referral. Results vary by niche, location, and referral network, but the sequence is what compounds. If you want the booking foundation handled from day one, setting up your free Mahla account is a reasonable step three. The sequence matters more than the tool. Do these five things and you've built the referral and retention engine instead of checking marketing boxes. --- ## Frequently Asked Questions ### How much does it cost to start getting therapy clients? You can start at essentially $0. A free Google Business Profile, a free or low-cost niche directory, and a free therapy software foundation for booking and documentation get you visible and bookable without spending money you don't have yet. Paid directories (roughly $30/month) are optional once you can measure what converts. [\[7\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-7) ### Is it ethical for therapists to advertise? Yes. Truthful, non-deceptive advertising and professional referrals are permitted under APA, ACA, NASW, and state-board guidance. What's restricted is soliciting testimonials from current clients and guaranteeing outcomes. See the ethics section above for the specifics. [\[1\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-1)[\[2\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-2)[\[3\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-3) ### How long does it take to get your first therapy client? Usually a few weeks to a few months after setting up directories and referral relationships, depending on your niche, location, and insurance status. Reducing booking friction tends to shorten it. [\[9\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-9) ### Do I need to be on insurance panels to get clients? Not necessarily. Many new therapists start private-pay or with a single panel while building referrals. Panels add steady volume but take credentialing time. ### How do I get therapy clients without paid directories or ads? Use the free channels: a Google Business Profile, referral relationships, a clear niche, and frictionless booking. You can start at zero cost with free therapy software and add paid channels once you know what converts. ### How many clients is a healthy full-time caseload? Often around 20–25 sessions per week for full-time work, and many clinicians intentionally see fewer. Burnout risk rises past the low-to-mid 20s once documentation and admin are counted. Sustainable beats maximal. [\[11\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-11)[\[12\]](https://d2og2m6rio8myg.cloudfront.net/manual/how-to-get-therapy-clients/#reference-12) ### Should I be on social media to get clients? It's optional and low-return at the start. Directories, referrals, and easy booking fill a first caseload faster. Add one social platform later if you enjoy it, once the fundamentals are working. --- ## About the Author **Jonathan Read** is Head of Product at Mahla and a two-time health tech founder. He built a HIPAA-compliant telehealth platform serving thousands of patients across a multi-state practice, and now focuses on the operational systems (booking, intake, documentation, and compliance) that help new therapists fill and keep a caseload. **Clinically reviewed by Alex Cohan, MS, LPC-Associate, NCC**, a clinical therapist trained in EMDR who works with adults, adolescents, and families. He reviewed the advertising and solicitation ethics guidance in this article for accuracy and alignment with professional-conduct standards (APA, ACA, and NASW codes). --- ## About This Guide *This article is general educational information for clinicians and is not legal, compliance, or clinical advice. Advertising and solicitation rules vary by profession and by state licensing board. Verify the requirements for your license and jurisdiction before acting. Written by Jonathan Read, Head of Product at Mahla. Clinically reviewed by Alex Cohan, MS, LPC-Associate, NCC. Last reviewed: September 2026. This guide is reviewed at least annually, and whenever APA/ACA/NASW or state-board advertising guidance changes. Every claim in this guide was fact-checked against primary ethics codes and industry sources. Commercial mentions are disclosed and kept separate from the compliance guidance.* *Disclosure: This guide is published by Mahla. Product mentions are clearly labeled and kept separate from the ethics and compliance guidance.* --- ## Sources & References 1. American Psychological Association. (2017). *Ethical Principles of Psychologists and Code of Conduct* (Standards 5.01 & 5.05). https://www.apa.org/ethics/code 2. American Counseling Association. (2014). *ACA Code of Ethics*, Section C.3: Advertising and Soliciting Clients (incl. C.3.b Testimonials). https://manifold.counseling.org/read/aca-code-of-ethics/section/5403851f-9eea-4961-91f4-a1e22670043f 3. National Association of Social Workers. (2021). *NASW Code of Ethics*, Standard 4.07(b): Solicitations. https://www.socialworkers.org/About/Ethics/Code-of-Ethics/Code-of-Ethics-English 4. Paubox. (2024). *Navigating the ethics of soliciting reviews for mental health professionals.* https://www.paubox.com/blog/navigating-the-ethics-of-soliciting-reviews-for-mental-health-professionals 5. The Practice Institute. (2023). *Asking for testimonials: Ethics and implications.* https://thepracticeinstitute.com/tpi-blog/asking-for-testimonials-ethics-and-implications/ 6. MyTherapyFlow. (2026). *11 best therapist directories to get listed in 2026.* https://mytherapyflow.com/best-therapist-directories/ 7. ChoosingTherapy. (2026). *Psychology Today review 2026: Cost, pros & cons.* https://www.choosingtherapy.com/psychology-today-review/ 8. Reframe Practice. (2026). *Psychology Today $29.95/month: Is it still worth it in 2026?* https://reframepractice.com/guides/psychology-today-cost-analysis 9. TelepsychHealth. (2025). *How long does it take to build a full-time caseload in private practice?* https://www.telepsychhealth.com/how-long-to-build-a-full-time-caseload-in-private-practice/ 10. Liberation Healing Seattle. (2024). *How long does it take to get a full caseload?* https://www.liberationhealingseattle.com/supervision-blog/how-long-does-it-take-to-get-a-full-caseload-private-pratice-therapy 11. Grow Therapy. (2025). *Managing your schedule: How many sessions per week is sustainable?* https://growtherapy.com/blog/manage-sustainable-schedule/ 12. Mentalyc. (2025). *What is the average caseload for a private practice therapist?* https://www.mentalyc.com/blog/average-caseload-for-private-practice-therapist 13. SimplePractice. (2025). *Start a private practice: Guide to getting your first 30 clients.* https://www.simplepractice.com/resource/how-to-get-therapy-clients/ 14. WebsiteTherapy. (2026). *Are therapist directories worth it in 2026? An honest ROI breakdown.* https://websitetherapy.com/blog/therapist-directories-worth-it-2026 --- # Meet Mahla: the EMR that does your work for you Meet Kali, Cory, and Mary: AI colleagues who help with scheduling, patient questions, intake, and notes. You choose what to hand off. By Mahla team Published: 2026-09-01T12:00:00Z Updated: 2026-10-12T03:56:24Z Source: https://d2og2m6rio8myg.cloudfront.net/manual/cash-pay-starter-package/ Your last session is over. The reminders, intake forms, and notes are still waiting. Meet Mahla: an EMR with AI colleagues to help carry the work around care. ## Meet your AI colleagues **Kali helps with your calendar.** She confirms appointments, handles rescheduling, and helps fill openings. **Cory helps you arrive prepared.** He answers patient questions and follows up on intake. **Mary drafts your notes.** You review each draft, make it yours, and sign. ## You decide what to hand off Choose what runs automatically, what needs your approval, and what stays with you. ## Free EMR. Pay for the work. The EMR is free. You pay for the work your AI team does. Keep the therapy. Lose the rest. [Meet your team](/#team) or [join the waitlist](/waitlist/). ## Video https://www.youtube.com/watch?v=WUwL2tuRPgw ## Chapters - 0:00 — Meet Mahla - 0:18 — Kali: your calendar - 0:29 — Cory: questions and intake - 0:39 — Mary: your notes - 0:51 — You stay in control - 1:01 — Free EMR, pay for the work - 1:11 — Keep the therapy. Lose the rest. ## Transcript [0:03] Your last session is over, but the reminders, the intake forms, the notes, they’re still waiting. [0:11] Meet Mahla, an EMR with AI colleagues to help carry the work around care. [0:18] Kali confirms appointments, handles rescheduling, and helps fill openings in your calendar. [0:29] Cory answers patient questions and follows up on intake so you can arrive prepared. [0:39] Mary drafts the note. You review it, make it yours, and sign. [0:51] Choose what runs automatically, what needs your approval, and what stays with you. [1:01] The EMR is free. Pay for the work your team does. [1:11] Keep the therapy, lose the rest. Meet Mahla. --- # Free EHR for Therapists: What's Actually Available in 2026 Compare 5 free EHR platforms for therapists in 2026. Reviews of free, freemium, and trial options, plus a 6-point HIPAA verification checklist. By Jonathan Read · Head of Product at Mahla Published: 2026-04-27T00:00:00Z Updated: 2026-09-11T00:00:00Z Source: https://d2og2m6rio8myg.cloudfront.net/manual/free-ehr-for-therapists-2026/ Reviewed by Alex Cohan, MS, LPC-Associate, NCC · Clinical Therapist Review scope: Clinical accuracy of this guide Reviewed: 2026-09-11T00:00:00Z ## Why Free EHR Matters for Therapists in 2026 If you're a therapist or counselor searching for a free EHR for therapists in 2026, you already know that legacy electronic health records (EHR) vendors still charge like it's 2015. Platforms built on decade-old infrastructure want $100 to $300 per month, per provider, for software that feels as dated as the code it runs on. For early-career therapists carrying student loan debt or solo practitioners watching every dollar, that monthly bill is a barrier to running a documented practice. Whether you call it an EHR or EMR (electronic medical records), the need is the same: clinical documentation you can afford. The technology has changed. Modern platforms built on cloud infrastructure can offer free tiers that are not loss leaders or 30-day bait, because the underlying costs are different than they were five years ago. The free EHR for mental health professionals market is in the middle of a structural shift, and therapists are the ones who benefit. This guide covers what is available for free in 2026: what "free" means for each platform, where the limits are, and which option fits your practice. No vendor marketing copy. No generic feature lists. A clear look at the free behavioral health EHR market from people who build healthcare technology. *This guide provides general information about EHR platforms for therapists. It is not legal, compliance, or clinical advice. Consult a qualified professional for guidance specific to your practice and jurisdiction.* --- ## What "Free" Really Means: 5 Types of Free EHR Before you evaluate any platform, know what kind of "free" you're looking at. The word covers at least five business models, and the differences matter for your practice. **1. Genuinely Free** No client limits, no time limits, permanent free access. These platforms sustain themselves through insurance partnerships, adjacent revenue streams, or venture funding. The free tier is the product, not a gateway to a paid plan. Watch for: whether the platform is financially stable and whether features stay free as the company grows. **2. Freemium** A free tier with real restrictions: client caps, feature locks, storage limits, or missing integrations. The free version works, but it's designed to make you feel the limits once your practice grows. How they sustain it: upgrade revenue from users who outgrow the free tier. **3. Free Trial** Time-limited access, usually 14 to 30 days. This is a sales funnel with a countdown timer. After the trial, you're paying full price. SimplePractice offers a 30-day trial, not a free tier. It's a solid platform, but if you're searching for "free EHR," this isn't it. **4. Open Source** Free software you can download, install, and modify. The catch: you handle hosting, setup, configuration, and maintenance. Community-supported with optional enterprise services. Works for tech-savvy providers. Overwhelming for most solo therapists. **5. Free + Pay-Per-Use AI** A newer model that emerged in 2025-2026: the base clinical documentation platform is free, with optional AI features priced at about $1 per task for things like AI-generated SOAP notes or treatment plan suggestions. You pay only for what you use, only when you use it. Every platform reviewed in this guide is classified into one of these five types. When you see a "free" claim, you'll know what it means. --- ## Why Modern EHR Platforms Can Offer Free Tiers Most EHR comparison articles skip this question: why is free EHR possible now when it wasn't five years ago? Legacy EHR platforms were expensive for real reasons. They ran on dedicated server infrastructure that cost thousands per month to maintain. They used per-seat licensing models inherited from the enterprise software era. Their decade-old codebases required large engineering teams to keep running. Those costs got passed to you, the provider, at $200 or more per month. Modern platforms built from scratch in the 2020s have different economics. They run on shared cloud infrastructure where costs scale with usage. Deployment is automated. AI handles tasks that used to require support staff. The marginal cost of serving one more therapist on modern infrastructure is a fraction of what legacy systems require. Think of the shift from buying DVDs to streaming. The content is similar, but the delivery infrastructure is so much cheaper that companies can offer it for free or near-free. EHR is going through the same transition. This is a permanent structural shift driven by the same cloud computing economics that made Gmail free, Google Docs free, and Zoom's basic tier free. The technology that delivers clinical documentation software for therapists has gotten dramatically cheaper to operate, and that savings is finally reaching providers. The question is whether the specific platform you're evaluating was built on modern infrastructure or is a legacy system offering a stripped-down loss leader. --- ## Free EHR Comparison Table: All Platforms at a Glance With that framework in mind, here's a side-by-side comparison of every platform covered in this guide. The "Free Tier Type" column uses the typology from the previous section so you can see what kind of "free" each platform offers. | Platform | Free Tier Type | Client Limit | Key Features | HIPAA | Telehealth | AI Features | Best For | |---|---|---|---|---|---|---|---| | Sessions Health | Freemium | 3 clients | Notes, scheduling, portal | Yes | No | No | Testing EHR workflows | | Mahla | Free + Pay-Per-Use AI | Unlimited | Documentation, video, compliance | Yes | Yes | Yes (about $1/task) | Early-career, telehealth-first | | SimplePractice | Free Trial (30 days) | Unlimited (during trial) | Full practice management | Yes | Yes | Limited | Established practices (paid) | | TherapyNotes | Free Trial (30 days) | Unlimited (during trial) | Full EHR + billing | Yes | Yes | No | Insurance-heavy practices (paid) | | OpenEMR | Open Source | Unlimited | Full EHR (self-hosted) | Configurable | Configurable | No | Tech-savvy providers, clinics with IT | *Pricing and features verified against vendor pages as of September 2026. EHR platforms update frequently. Confirm details on the vendor's site before signing up.* --- ## How We Evaluated These Free EHR Platforms This guide evaluates tools that handle sensitive patient data, so here is how we approached it. **Our evaluation criteria:** - **HIPAA compliance posture**: BAA availability, encryption standards, access controls, audit logging - **Free tier limits**: client caps, feature restrictions, storage, and what triggers a paid upgrade - **Ease of setup**: time from sign-up to first documented session - **Clinical workflow fit**: how well the platform supports therapist-specific documentation (SOAP notes, treatment plans, progress notes) - **Data portability**: export formats available, migration difficulty if you outgrow the platform - **Growth path**: what your costs look like at 10, 25, and 50 clients - **AI capabilities**: whether AI features are native, bolted on, or absent **Our disclosure:** This guide is written by the product team at Mahla, built on a decade of experience running behavioral health operations across multiple states. We've spent ten years building HIPAA-compliant telehealth infrastructure, which gives us a hands-on perspective most comparison articles lack. We evaluate our own platform against the same criteria as every other option in this guide. Where we fall short, we say so. --- ## Free EHR Platforms for Therapists Now the platforms themselves. We'll start with the ones that offer free EHR access designed for ongoing practice, then cover the trials and the open-source option. ### Sessions Health **Free Tier Type:** Freemium **What you get:** EHR documentation, scheduling, client portal, and secure messaging for up to 3 active clients. Sessions Health is a clean, therapist-focused platform that's straightforward to set up. Creating a new client record and writing your first SOAP note takes about 10 minutes from sign-up. Scheduling and client portal features work well for a small practice. **Free Tier Reality Check:** The 3-client limit is the hard constraint. For testing whether you like the EHR workflow, it's perfect. For running a practice, even a small one, you'll hit the wall fast. Upgrade pricing starts at $39 per month. **Best For:** Therapists who want to test a dedicated EHR before committing. Good for pre-licensure providers seeing a handful of clients under supervision. **Skip If:** You need a free platform for more than 3 clients. The limit makes this a trial in practice, even though the free tier doesn't expire. ### Mahla **Free Tier Type:** Free + Pay-Per-Use AI **What you get:** Clinical documentation, HIPAA-compliant video sessions, compliance tools, scheduling, and client management, all free. AI features (SOAP note generation, treatment plan suggestions, CPT code identification, session quality feedback) cost about $1 per task. Mahla was built as a modern documentation platform from day one, not a legacy EHR adapted for telehealth. The free tier is the actual platform, not a stripped-down version of a paid product. Instead of charging a monthly subscription and locking features behind tiers, the base platform is free and AI features are priced per task. When you finish a session and need to write your progress note, you can do it by hand for free or have the AI assistant draft a SOAP note for about $1. You only pay when you choose to use AI, and only for what you use. **Free Tier Reality Check:** Mahla is newer to the market than platforms like SimplePractice or TherapyNotes. The ecosystem is still developing. Integrations with external billing systems are limited, and the user community is smaller. If you need a mature ecosystem with extensive third-party integrations today, this isn't there yet. What Mahla does well: modern interface, fast setup, native telehealth, and AI documentation tools that early-career therapists use. **Supervisor access:** Mahla supports sign-off flows for supervised documentation, relevant if you're pre-licensure and need your supervisor to review and co-sign notes. **Best For:** Early-career therapists, telehealth-first practices, and providers who want modern clinical documentation with optional AI assistance without a monthly subscription. **Skip If:** You need deep insurance billing integration or a large ecosystem of third-party tools today. Full disclosure: Mahla is our product. If it fits your practice profile, you can sign up at no cost, no credit card or trial period required. --- ## Free-Trial EHR Options The platforms below appear in "free EHR" searches, but their free access is time-limited. That doesn't make them bad. It does mean you should know what you're getting before you invest time in setup. ### SimplePractice **Free Tier Type:** Free Trial (30 days) **What you get during trial:** Full access to the complete platform: scheduling, documentation, telehealth, billing, client portal, and insurance claims. SimplePractice is not a free EHR for therapists. It offers a 30-day trial that gives you access to everything, after which pricing starts at $49 per month (Starter plan) and goes up to $99 per month (Plus plan) for the full feature set. The Starter plan at $49/month lacks several features most therapists need, so budget for the Essential ($79/month) or Plus tier. SimplePractice is popular for good reasons. The platform is polished, the mobile app is strong, and the all-in-one approach (documentation, billing, scheduling, and telehealth) appeals to therapists who want one tool for everything. If you can afford $49-99 per month, it's a solid choice. If you found this article searching for "free EHR for therapists," SimplePractice is not the answer. The trial is useful for testing whether the platform is worth paying for, not for running your practice long-term. **Best For:** Therapists who want a mature, full-featured practice management suite and can budget $49-99 per month. **Skip If:** You need something free. This is a trial, not a free tier. ### TherapyNotes **Free Tier Type:** Free Trial (30 days) **What you get during trial:** Full EHR with clinical documentation, scheduling, billing, telehealth, and a client portal. TherapyNotes is another strong paid platform that offers a trial, not a free tier. It's well-regarded for insurance billing workflows and clinical documentation that maps cleanly to standard clinical formats. After the 30-day trial, pricing starts at $69 per month for a solo provider (as of December 2025). Like SimplePractice, it's a trial designed to convert you to a paying customer. That's fine. It's also not free. **Best For:** Insurance-heavy practices that need strong billing integration and want to test before committing. **Skip If:** You're looking for a free long-term solution. --- ## Open-Source EHR: Free but Technical ### OpenEMR **Free Tier Type:** Open Source **What you get:** A full-featured, ONC-certified electronic health records system [\[3\]](https://d2og2m6rio8myg.cloudfront.net/manual/free-ehr-for-therapists-2026/#reference-3)[\[4\]](https://d2og2m6rio8myg.cloudfront.net/manual/free-ehr-for-therapists-2026/#reference-4) that you can download, install, and customize. Documentation, scheduling, billing, e-prescribing, and a client portal are all included. OpenEMR is free and powerful. It's ONC-certified (version 8.0.0 holds current Ambulatory EHR Certification), actively maintained by a global open-source community, and offers a feature set comparable to many commercial EHRs. For the right user, it's the most capable option on this list. The catch: you're responsible for everything. That means provisioning a server ($10-50 per month for cloud hosting), installing the software, configuring it for your specialty, managing updates, and handling backups. If you're comfortable with server administration, or your clinic has IT support, OpenEMR offers maximum control and zero vendor lock-in. For most solo therapists and counselors, the hosting and configuration overhead outweighs the cost savings. If you're tech-savvy or running a small clinic with IT resources, OpenEMR is a serious option. **Best For:** Tech-savvy providers, clinics with IT staff, or practices that need maximum customization and data control. **Skip If:** You want something you can sign up for and start using in minutes. --- ## HIPAA Compliance for Free EHR: What to Verify Before You Sign Up The concern that stops most therapists from trusting a free platform is HIPAA compliance. It's the non-negotiable requirement for any EHR that touches patient data, and it deserves a direct answer. **Can a free EHR be HIPAA compliant?** Yes, provided the platform meets specific technical and administrative requirements. HIPAA compliance is about policies and infrastructure, not price tags. A HIPAA-compliant free EHR running on modern cloud infrastructure can meet every requirement. What matters is whether it meets these six criteria. The checklist below helps you verify, but consult a compliance professional for your specific situation. ### The 6-Point HIPAA Verification Checklist Use this checklist with any platform, free or paid, before entering patient data: **1. Business Associate Agreement (BAA)** Get it in writing before you create your first patient record. Every HIPAA-compliant EHR must sign a BAA with you. If a platform can't provide one, stop there. *Good answer:* BAA is available on the website or provided during onboarding. *Red flag:* "We don't offer BAAs" or no mention of HIPAA on the site. **2. Encryption Standards** Data must be encrypted at rest (stored data) and in transit (data moving between your device and the server). Look for AES-256 encryption at rest and TLS 1.2 or higher in transit [\[5\]](https://d2og2m6rio8myg.cloudfront.net/manual/free-ehr-for-therapists-2026/#reference-5)[\[6\]](https://d2og2m6rio8myg.cloudfront.net/manual/free-ehr-for-therapists-2026/#reference-6). These are the HIPAA-standard encryption specifications per NIST SP 800-111 and SP 800-52. *Good answer:* Specific encryption standards listed in their security documentation. *Red flag:* Vague language like "we take security seriously" without specifics. **3. Role-Based Access Controls** The system should let you control who sees what. If you have a practice with multiple staff, each person should have appropriate access levels. *Good answer:* Configurable user roles with different permission levels. *Red flag:* Everyone can see everything with no access differentiation. **4. Audit Logging** The platform should maintain logs of who accessed which records and when. This is essential for breach investigation and compliance verification. *Good answer:* Audit trail available and viewable by the account administrator. *Red flag:* No logging or no access to logs. **5. Data Hosting Location** Know where your patient data is stored. US-based hosting is recommended for US practices, and the platform should be able to tell you specifically. *Good answer:* "Data is hosted on [specific cloud provider] in US data centers." *Red flag:* Can't specify where data is hosted. **6. Breach Notification Policy** The platform should have a documented procedure for notifying you if a breach occurs. Under HIPAA, covered entities must be notified without unreasonable delay and in no case later than 60 calendar days from discovery of a breach [\[1\]](https://d2og2m6rio8myg.cloudfront.net/manual/free-ehr-for-therapists-2026/#reference-1)[\[2\]](https://d2og2m6rio8myg.cloudfront.net/manual/free-ehr-for-therapists-2026/#reference-2). *Good answer:* Written breach notification policy available in their security documentation. *Red flag:* No documented breach procedures. You can usually check these in a short session by reviewing the platform's security page and requesting their BAA. If any platform, free or paid, can't satisfy these criteria, move on. *Telehealth licensing requirements vary by state. Before providing telehealth services, verify you are properly licensed in the state where your client is located during the session.* --- ## Which Free EHR for Therapists Is Right for You? Instead of naming one platform "best" (that depends on your practice), here's a decision framework based on the four most common therapist profiles we see. ### If You're Newly Licensed and Building Your First Caseload You need low cost, simple setup, and documentation that won't embarrass you in front of your supervisor. Supervisor access for note co-signing is a plus. **Start with:** Mahla. Free documentation and telehealth, supervisor sign-off flows, and AI tools for when you need help with notes. ### If You're a Solo Cash-Pay Therapist You need clean clinical documentation and telehealth without billing complexity. You're not processing insurance claims, so you don't need a billing engine, just reliable documentation software for your practice. **Start with:** Mahla (free documentation and native telehealth) or Sessions Health (if you have 3 clients or fewer and want a simple interface to test). ### If You're a Solo Insurance-Based Practice You need claims processing, credentialing support, and documentation that supports clean billing. The EHR and billing workflow need to work together. **Start with:** None of the free platforms in this guide is built around insurance billing. Use Mahla for documentation and telehealth, and run the TherapyNotes or SimplePractice trial to decide whether $49-99 per month is worth it for integrated claims. ### If You're a Small Group Practice (2-5 Providers) Multiple providers mean you need role-based access, possibly shared scheduling, and costs that scale reasonably. Free tiers may work initially, but plan for growth. **Start with:** OpenEMR if you have IT resources. Otherwise be realistic: at 2-5 providers, you will likely outgrow free tiers and should budget for a paid platform. ### Growth Path: What It Costs as You Scale | Platform | Free Limit | What Triggers Upgrade | Est. Cost at 25 Clients | Data Export | |---|---|---|---|---| | Sessions Health | 3 clients | 4th client | ~$39/month | CSV export available | | Mahla | Unlimited | AI feature use | $0-50/month (AI usage) | Export available, verify formats | | SimplePractice | 30-day trial | Trial expiration | $49-99/month | CSV, PDF | | OpenEMR | Unlimited | N/A (hosting costs) | $10-50/month (hosting) | Full data access (self-hosted) | If you're starting your first practice and want a modern, free EHR for therapists without the legacy price tag, Mahla lets you get started free today. --- ## Frequently Asked Questions About Free EHR for Therapists ### Is there a genuinely free EHR that works for therapists? Yes, with caveats. In 2026, Mahla offers free documentation, video, and compliance tools with no time limit and no client cap, charging only for optional AI tasks. Sessions Health is free indefinitely but capped at 3 clients. OpenEMR is free if you host it yourself. The key is understanding what "free" means for each platform. Check the free-tier typology earlier in this guide to know what you're getting. ### Do therapists legally have to use an EHR? It depends on your state and payer contracts. While no federal law mandates EHR use for all therapists [\[7\]](https://d2og2m6rio8myg.cloudfront.net/manual/free-ehr-for-therapists-2026/#reference-7)[\[8\]](https://d2og2m6rio8myg.cloudfront.net/manual/free-ehr-for-therapists-2026/#reference-8), many insurance contracts require electronic documentation. Some states have specific requirements. Connecticut mandates HIE connection for behavioral health providers, and California's CalMHSA initiative pushes EHR interoperability for state behavioral health programs. Medicare's "Promoting Interoperability" programs also effectively require certified EHR technology for participating providers. Even without a legal mandate, electronic documentation improves record accuracy, simplifies audits, and protects you in case of a board complaint or malpractice claim. *This is general information, not legal advice. Requirements vary by state, payer, and provider type. Consult your state licensing board or a healthcare attorney for your specific situation.* ### Can a free EHR really be HIPAA compliant? Yes. HIPAA compliance depends on infrastructure, policies, and agreements, not on price. A free platform on modern cloud infrastructure can meet every HIPAA requirement. The 6-point checklist in this guide walks you through how to verify compliance for any platform. The critical requirement is a signed Business Associate Agreement (BAA). ### What's the difference between an EHR and practice management software? An EHR (Electronic Health Record), sometimes called an EMR (Electronic Medical Record), handles clinical documentation: SOAP notes, treatment plans, progress notes, and patient history. Practice management software handles the business side: scheduling, billing, insurance claims, and client communication. Some platforms combine both. If you're searching for "free EHR," clarify whether you need documentation tools, practice management, or a combination. ### Is BetterHelp an EHR? No. BetterHelp is a therapy delivery platform that connects clients with therapists. It doesn't provide the documentation, billing, or practice management tools that therapists need to run an independent practice. If you're a therapist looking for documentation tools for your own practice, those are different products entirely. ### Can I switch EHRs later without losing patient data? Yes, but the difficulty varies by platform. Before choosing any EHR, check what export formats are available (CSV, PDF, and HL7 FHIR are common). Some platforms make data export straightforward. Others make it painful. The growth path table in this guide rates data portability for each platform. A general rule: never enter patient data into a platform until you've confirmed you can get it back out. ### Are free EHR platforms secure enough for private practice? Security and price are independent variables. A free platform built on AWS or Google Cloud infrastructure can have stronger security than a paid legacy system running on outdated servers. What matters is the platform's specific security implementation: encryption, access controls, audit logging, and breach notification. Use the HIPAA checklist in this guide to verify. ### What are the best free alternatives to SimplePractice? For therapists and counselors who want SimplePractice's all-in-one approach without the $49-99 per month price tag: Mahla offers free documentation with native telehealth and optional AI tools at about $1 per task. Sessions Health works if your caseload is 3 clients or fewer. OpenEMR is the full-featured option if you can self-host. The "Which Free EHR for Therapists Is Right for You?" section above matches them to specific practice profiles. --- ## How We Keep This Guide Current The EHR market moves fast. Platforms update pricing, add features, and occasionally shut down. A comparison guide is only as useful as it is accurate. **Our update commitment:** We review this guide regularly. Each review includes verification of free tier terms, pricing, feature changes, and HIPAA compliance status for every listed platform. Each article undergoes fact-checking against primary sources, clinical review by a licensed healthcare professional, and editorial review before publication. All pricing and feature claims are verified against vendor pages. **Last reviewed:** September 2026. **Mahla disclosure:** This guide is written by the Mahla product team. Mahla is included in this comparison and evaluated with the same criteria as every other platform. If you spot outdated information or know of a free EHR platform we should include, let us know. We'd rather correct a mistake than let inaccurate information guide a therapist's decision. --- ## About the Author Jonathan Read is Head of Product at Mahla and a two-time health tech founder. He built a HIPAA-compliant telehealth platform serving thousands of patients across a multi-state practice, and brings that infrastructure experience to evaluating every platform in this guide. **Clinically reviewed by Alex Cohan, MS, LPC-Associate, NCC**, a clinical therapist trained in EMDR who works with adults, adolescents, and families. He reviewed this guide for clinical accuracy. --- ## Sources & References 1. U.S. Department of Health and Human Services. "Breach Notification Rule." HHS.gov, 2026. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html 2. 45 CFR § 164.404 — Notification to Individuals. Cornell Law Institute, Legal Information Institute. https://www.law.cornell.edu/cfr/text/45/164.404 3. "ONC Certification Criteria for Health IT." HealthIT.gov, Office of the National Coordinator for Health Information Technology, 2026. https://www.healthit.gov/topic/certification-ehrs/onc-certification-criteria-health-it-regulatory-update-deadline 4. "OpenEMR Certification ONC HTI-1 Final Rule." OpenEMR Project Wiki, 2026. https://www.open-emr.org/wiki/index.php/OpenEMR_Certification_ONC_HTI-1_Final_Rule 5. "HIPAA Encryption Requirements 2026." Medcurity, 2026. https://medcurity.com/hipaa-encryption-requirements/ 6. "HIPAA Encryption Requirements: Key Requirements & Templates." Konfirmity, 2026. https://www.konfirmity.com/blog/hipaa-encryption-requirements 7. "Mental Health EHR Requirements: What Providers Need to Know." Specode.ai, 2026. https://www.specode.ai/blog/mental-health-ehr-requirements 8. "Telemental Health Laws: 2026 Overview." Epstein Becker Green, 2026. https://www.ebglaw.com/insights/publications/telemental-health-laws-2026-overview ### Additional Sources Consulted - SimplePractice Pricing Page (2026): https://www.simplepractice.com/pricing/ - TherapyNotes Pricing Page (2026): https://www.therapynotes.com/pricing/ - TherapyNotes 2025 Pricing Update: https://blog.therapynotes.com/therapynotes-2025-pricing-update - Sessions Health Pricing Page (2026): https://www.sessionshealth.com/pricing/ --- # Free HIPAA-Compliant Chat: The Complete Guide for Healthcare Providers (2026) Free HIPAA-compliant chat exists. Compare compliant messaging apps, see what HIPAA requires, and set up secure patient texting in under 30 minutes. No IT needed. By Jonathan Read · Head of Product at Mahla Published: 2026-02-22T00:00:00Z Updated: 2026-09-11T00:00:00Z Source: https://d2og2m6rio8myg.cloudfront.net/manual/free-hipaa-compliant-chat/ Reviewed by Alex Cohan, MS, LPC-Associate, NCC · Clinical Therapist Review scope: Clinical accuracy, crisis protocols, between-session guidance, and substance use confidentiality Reviewed: 2026-09-11T00:00:00Z *Last updated: September 2026. Pricing and compliance information verified as of this date. Verify current details directly with each vendor.* *This guide is reviewed and updated quarterly to reflect changes in HIPAA requirements, platform pricing, and compliance certifications.* --- You already know HIPAA matters. You went through the training, you lock your filing cabinets, you're careful about what you say in the waiting room. Then a patient texts you a question about their medication between sessions, and that careful instinct kicks in: *is this okay?* It's a fair question. The answer depends on the platform. **HIPAA-compliant chat is a messaging platform that meets all HIPAA requirements for protecting patient health information (PHI). That means end-to-end encryption, a signed Business Associate Agreement (BAA), audit trails, and access controls, working together so every message is protected in transit, at rest, and in the event of a breach.** Whether you're searching for HIPAA-compliant texting, secure text messaging, or compliant chat, the requirements are the same, and free options that meet every standard exist today. One distinction to keep in mind: a platform can be *secure* without being *compliant*, and *capable* of compliance without being *compliant*. Security is one technical layer. Compliance is the full picture: legal agreements, operational policies, and technical safeguards working together. This guide walks through what free HIPAA-compliant chat requires, which free tools meet those requirements, and how to get set up in under 30 minutes with no IT department. *Disclaimer: This guide provides general information about HIPAA-compliant communication tools for healthcare providers. It is not legal advice, and should not be relied upon as a substitute for consultation with a qualified healthcare compliance professional or attorney. HIPAA compliance requirements may vary based on your specific practice, state regulations, and organizational structure.* --- ## The Three Pillars of HIPAA-Compliant Chat HIPAA-compliant chat stands on three pillars. Remove any one and the whole thing collapses. Knowing the three gives you a way to evaluate any platform, free or paid, in about five minutes. ### Pillar 1: Secure Infrastructure End-to-end encryption means messages are scrambled the moment they leave your device and only unscrambled when they reach the intended recipient. Think of a locked filing cabinet that only you and your patient have the key to, except the lock changes with every message. Secure infrastructure also includes US-based HIPAA-compliant data hosting, automatic session timeouts, and message retention policies that define how long data lives and when it's purged. ### Pillar 2: Legal Protection (the BAA) A Business Associate Agreement is a legally binding contract between you and your technology vendor that spells out how they'll protect patient data and what happens if something goes wrong. It works like the confidentiality agreement you'd sign with an outside billing company. **A platform that won't sign a BAA cannot make you HIPAA compliant.** Without that legal agreement, you carry all the liability yourself ([HHS.gov, "Business Associates"](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html)). ### Pillar 3: Operational Compliance This is your part. The platform handles Pillars 1 and 2. Pillar 3 is how you and your team *use* the tool: written messaging policies, staff training, and access limited to the people who need it. Role-based access makes that separation automatic. Your front-desk coordinator sees scheduling messages, not clinical notes. ### The 7-Point HIPAA Chat Compliance Checklist Before you commit to any platform, run it through these seven non-negotiables: 1. **End-to-end encryption**: Messages protected in transit and at rest 2. **Signed Business Associate Agreement (BAA)**: Legal accountability from the vendor 3. **Audit trail**: A log of who accessed what and when 4. **Role-based access controls**: Different permissions for different team members 5. **US-based HIPAA-compliant hosting**: Data stored on servers meeting federal standards 6. **Automatic session timeout**: Idle sessions lock after a set period 7. **Message retention policy**: Clear rules for storage duration and deletion Most platforms handle items 1, 2, 5, 6, and 7 automatically. Your main job is setting up access controls and documenting your messaging policies. --- ## Why iMessage, SMS, and WhatsApp Aren't HIPAA-Compliant Texting Apps HIPAA texting guidelines start with what standard messaging apps get wrong. If you've been texting patients on iMessage because it felt secure enough, you're in good company. Encryption is only one of three pillars, and iMessage doesn't clear the other two. **iMessage**: Apple encrypts messages end-to-end but will not sign a BAA. No audit trails, no role-based access controls. **SMS / Standard Text**: Not encrypted at all. Messages travel through carrier networks in plain text. No carrier offers a BAA. **WhatsApp**: End-to-end encryption, but Meta does not sign BAAs. Terms of service allow metadata collection. **Google Chat (Free)**: Google Workspace *paid* plans at the Business Plus tier and above can be configured for HIPAA compliance with a signed BAA ([Google Support](https://support.google.com/a/answer/3407054)). Lower-tier plans like Business Starter lack the security controls required. The free personal version does not qualify. **Signal**: Excellent encryption protocol, but no BAA, no audit trails, not designed for healthcare use. **Telegram**: Default chats are not end-to-end encrypted (only "Secret Chats" use E2E encryption). No BAA. Does not meet HIPAA standards by any measure. **RCS**: Encryption support is carrier-dependent and inconsistent. No BAA available for healthcare use. ### The Gray Areas What if a patient texts you first on iMessage? You haven't violated HIPAA by *receiving* that message. The problem starts if you respond with PHI on a non-compliant platform. Acknowledge receipt, then redirect: *"Thanks for reaching out. Let me respond through our secure messaging so we can discuss this properly."* What about peer consultation on Signal? Discussing a case with a colleague without any identifying patient information is generally acceptable. The safer habit is to use a compliant platform for all professional communication. --- ## Free HIPAA-Compliant Chat Tools That Actually Work A free tool can be HIPAA compliant. HIPAA compliance means meeting specific technical, legal, and operational standards. Those standards don't have a price floor. A platform that encrypts messages, signs a BAA, maintains audit trails, and hosts data on compliant servers meets the requirements whether it charges $200 a month or nothing. The real question is *why would a company offer this for free?* Some companies use a product-led growth model: offer a useful free product, build trust, and grow revenue through optional paid features or adjacent services. No data monetization, no selling patient information, no hidden costs. Free HIPAA-compliant instant messaging is available today, no enterprise contract required. ### Free HIPAA-Compliant Texting and Chat Apps *Disclosure: This guide is published by the Mahla team, built on our experience developing a behavioral health platform for a multi-state practice. We evaluate all platforms against the same compliance criteria, but readers should be aware of our commercial interest in Mahla. Verify all claims independently.* If you're looking for a HIPAA-compliant texting app or secure text messaging platform, these are the options that meet every requirement, and what each one costs. **Mahla**: The base platform is free. No trial, no per-user fees. Built for solo therapists, new graduates, and small clinics (1-5 providers). End-to-end encryption, BAA included at signup, full audit trail, role-based access, US-based hosting, configurable retention. The AI layer drafts session notes, coordinates appointments, and creates follow-up templates, work that eats administrative time every day, at about $1 per task. Built by a behavioral health team that built and ran a multi-state practice. **7/7 on compliance checklist.** Mahla meets all seven technical and legal requirements above. Your operational policies (Pillar 3) complete the picture. **Spruce**: A 14-day free trial, no credit card, and the BAA is included on the trial and on every paid plan ([Spruce Health](https://sprucehealth.com/plans)). After the trial, plans start at $24/user/month. Encrypted messaging, phone, fax, and team chat. **7/7 on core compliance. Free for 14 days, then paid.** **OhMD**: No free tier. Plans start at $300/month with a BAA included. Two-way patient texting, call deflection, video visits, and web chat. Solid for practices that need high-volume two-way SMS. **7/7 on core compliance. Paid only.** **Google Chat (Workspace BAA)**: If you already pay for Google Workspace at the Business Plus tier or above (~$22/user/month annually), Google Chat can be configured for HIPAA compliance ([Google Support](https://support.google.com/a/answer/3407054)). Not a free standalone solution. Requires manual security configuration. **7/7 when properly configured. Requires a paid subscription.** ### When Paid Options Make Sense If your practice has more than five providers, needs EHR integration, or operates across multiple locations, paid platforms like TigerConnect, Klara, or Halo Health offer enterprise features that justify the cost. The compliance standards are the same. You're paying for operational scale, not better security. --- ## HIPAA-Compliant Chat Comparison: Free vs. Paid at a Glance *Pricing and feature information verified as of September 2026. Platform offerings change frequently. Verify current pricing, features, and compliance certifications directly with each vendor before making decisions.* Finding the best HIPAA-compliant text messaging app depends on your practice size, budget, and workflow needs. Here's how the leading options compare. | Tool | Free Tier | Starting Price | BAA | Encryption | AI Features | Patient Chat | Best For | |------|-----------|---------------|-----|------------|-------------|-------------|----------| | **Mahla** | Yes (full) | $0 (AI about $1/task) | Auto at signup | AES-256 + TLS | Built-in AI: session notes, scheduling, follow-ups | Yes | Solo providers, small clinics wanting free HIPAA chat + AI | | **Spruce Health** | 14-day trial (BAA included) | $24/mo/user | Yes (trial and paid) | Yes | Limited | Yes | Small practices wanting all-in-one communication | | **OhMD** | No | $300/mo | Yes | Yes | Basic | Yes | Multi-provider practices needing two-way SMS | | **Google Chat** | No | ~$22/user/mo (Business Plus) | Yes (Business Plus+) | Yes | Gemini AI | No (internal only) | Practices already on Google Workspace | | **TigerConnect** | No | Custom | Yes | Yes | Limited | Yes | Large healthcare organizations | | **Klara** | No | Custom | Yes | Yes | Workflow automation | Yes | Established practices with EHR integration needs | | **Halo Health** | No | Custom | Yes | Yes | Clinical alerting | Limited | Hospital systems, large clinical teams | ### Key Takeaways **For solo providers and small clinics, free options cover all essential HIPAA requirements.** You don't need to spend $24-50+ per user per month to message patients compliantly. **Paid platforms add enterprise features** (EHR integrations, multi-department routing, admin dashboards), but these aren't compliance requirements. **AI is the emerging differentiator.** Most legacy platforms treat chat as a static messaging pipe. AI-native platforms handle work on your behalf: drafting responses, coordinating appointments, generating documentation. --- ## How to Choose the Best HIPAA-Compliant Messaging App for Your Practice **Start with your practice size, then narrow by budget and feature priorities.** Whether you need a HIPAA-compliant texting platform for patient outreach or an internal messaging tool for your clinical team, the decision framework is the same. **Solo provider (1 provider):** - $0 → Mahla. Full HIPAA compliance, BAA at signup, AI handles scheduling and follow-ups for about $1 per task. - $25-50/mo → Spruce Health. All-in-one communication with phone, fax, and messaging. **Small practice (2-5 providers):** - Free → Mahla. AI workflow automation on a free base. - $24-49/user → Spruce Health. Add OhMD ($300/month) if you need high-volume two-way SMS. - Moderate with EHR → Klara or Spruce Health. **Growing practice (6-15 providers):** - Klara, Spruce, or Google Workspace for internal communication alongside a patient-facing tool. **Enterprise (15+ providers, multi-location):** - TigerConnect or Halo Health for clinical alerting and system-wide communication infrastructure. ### Questions to Ask Before You Sign Up 1. **Does the BAA activate automatically at signup?** If you have to negotiate terms separately, the platform wasn't designed for small practices. 2. **Where is my data physically stored?** Look for US-based, HIPAA-compliant cloud infrastructure. 3. **What happens to my data if the company shuts down?** Understand data portability before you commit. 4. **Is there a minimum user requirement?** Enterprise platforms often require 5-25+ seats. 5. **Does the platform add work or remove it?** A compliant tool that creates more administrative overhead solves one problem while creating another. ### Red Flags - **"HIPAA capable" instead of "HIPAA compliant"**: configuration responsibility falls on you. - **BAA costs extra**: a legal requirement shouldn't be a premium feature. - **Pricing hidden behind "Contact Sales"**: budget-conscious providers deserve upfront costs. --- ## HIPAA-Compliant Texting for Therapists, Counselors, and Small Practices If you're a newly licensed therapist juggling clients, a supervisor, and a growing practice, communication eats hours you could spend on your clients. Somewhere in the back of your mind, you're wondering whether those text threads are HIPAA compliant. HIPAA-compliant texting for therapists solves both problems: secure patient messaging that protects your license while cutting administrative work. ### How It Fits Therapeutic Workflows - **Intake coordination**: Send secure intake forms, consent documents, and pre-session questionnaires from the first interaction. - **Appointment reminders**: Automated reminders reduce no-shows without adding to your workload. - **Between-session check-ins**: "How did the breathing exercise go this week?" strengthens rapport compliantly. - **Session follow-ups**: Share homework summaries, resource links, or treatment plan updates securely. - **Supervision communication**: Discussing case details with your supervisor requires a compliant channel, not a text thread on your personal phone. HIPAA-compliant patient messaging keeps every clinical exchange, from intake to discharge, documented, encrypted, and audit-ready. ### Three Real-World Scenarios **Solo therapist, 15 clients.** Monday morning, your platform has already sent automated appointment reminders. Two clients reschedule in-thread in three minutes. After your first session, you send a follow-up with a mindfulness resource. No phone tag, no compliance anxiety. **Pre-licensure counselor with supervisor.** You need to discuss a client's treatment plan before your next session. Your compliant chat lets you message your supervisor with case details and document the consultation with a built-in audit trail. **Small 3-provider group practice.** Three therapists coordinate schedules, share client handoff notes when covering for each other, and discuss admin issues, all in HIPAA-compliant group chat with audit logs and access controls. ### A Note on Substance Use Treatment If any clients are receiving substance use disorder treatment, 42 CFR Part 2 adds confidentiality protections beyond standard HIPAA. Even a message that could identify someone as a substance use treatment patient triggers Part 2 requirements. Your chat platform must support the additional consent documentation Part 2 requires. The February 2024 final rule aligned Part 2 with HIPAA in several ways, including a single-consent framework for treatment, payment, and healthcare operations. The compliance deadline for these changes was February 16, 2026 ([HHS, "42 CFR Part 2 Final Rule," 2024](https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html)). --- ## Set Up HIPAA-Compliant Chat in Under 30 Minutes If you can set up an email account, you can set up HIPAA-compliant chat. This five-step process takes under 30 minutes. *Note: These steps cover platform setup. Full HIPAA compliance also requires a documented risk assessment, written messaging policies, staff training records, and ongoing review. Your platform handles the technical safeguards. Operational compliance is your responsibility.* ### Step 1: Choose Your Platform (~2 minutes) Use the comparison table above. If you're a solo provider starting at $0, Mahla is the most direct path: free, BAA included at signup. ### Step 2: Sign Up and Complete the BAA (~5 minutes) Create your account. During onboarding, sign the BAA electronically, the contract that makes your vendor legally responsible for protecting patient data. On most platforms, this is a standard 3-5 page document that activates automatically. ### Step 3: Configure Security Settings (~3 minutes) Verify these are active: two-factor authentication, automatic session timeout, encryption confirmed, and device passcode enabled. Most platforms designed for small practices handle these by default. ### Step 4: Invite Your First Patient (~10 minutes) Sample message you can copy: > Hi [Patient Name], I'm transitioning to a secure, HIPAA-compliant messaging platform. [Platform Name] protects your health information with encryption, and all our messages will be stored securely. Here's how to get started: [link]. Questions? I'm happy to walk you through it at our next session. Start with 2-3 patients you have good rapport with. ### Step 5: Establish Messaging Policies (~10 minutes) Document a brief policy covering: what you'll message about (reminders, scheduling, intake forms, brief check-ins), what you won't (detailed clinical discussions, crisis intervention), your response time, and crisis protocol (direct patients to 988 Suicide and Crisis Lifeline or 911 for emergencies). ### Already Using Non-Compliant Tools? Send patients the introduction message, give them a week to transition, then stop sending PHI through non-compliant channels. Most patients adopt the new platform without friction. **Start using Mahla free today: HIPAA-compliant messaging with AI that does the work for you at about $1 per task. No credit card. No per-user fees. Set up in under 10 minutes.** --- ## HIPAA-Compliant Chat in the AI Era Providers keep asking: *Is there a HIPAA-compliant version of ChatGPT?* No, not in the way you might hope. Standard ChatGPT is not HIPAA compliant. OpenAI does not sign BAAs for consumer accounts, and conversation data may be used for model training ([OpenAI Help Center](https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai)). Google Gemini and Anthropic Claude have similar limitations at the consumer tier. The bigger issue: most HIPAA-compliant chat platforms today are **dumb pipes**. They encrypt your messages but do nothing to help you write them, organize them, or act on them. Security without utility is a missed opportunity. **AI-native HIPAA chat** is a different category. Instead of bolting AI onto a legacy messenger, AI-native platforms build compliance infrastructure and workflow support into the same architecture: - **Auto-generated session notes** from chat conversations - **Appointment coordination** without a separate tool - **Follow-up message drafts** tailored to clinical context - **Intake form processing** that extracts and organizes information automatically These capabilities exist today inside platforms that meet every HIPAA requirement (BAA, encryption, audit trails, access controls) while cutting the administrative hours that pull providers away from clinical work. AI will change healthcare communication. The question is whether your tools will be HIPAA compliant when it does. --- ## Common HIPAA Chat Misconceptions That Put Providers at Risk Here are the myths that trip up even careful providers. ### "If It's Encrypted, It's HIPAA Compliant" Encryption is one requirement in the HIPAA Security Rule. Without a signed BAA, audit trails, and access controls, encryption alone leaves you exposed. A locked door protects your office, but if you have no visitor log, no key policy, and no agreement with the cleaning service about what they can access, the lock is doing less than you think. ### "BAAs Are Optional for Small Practices" The HIPAA Privacy Rule requires a BAA with any vendor that stores, transmits, or processes PHI, regardless of practice size ([45 CFR § 164.502(e)](https://www.law.cornell.edu/cfr/text/45/164.502)). Solo therapists carry the same BAA requirements as hospital systems. There is no small-practice exemption. ### "Regular Texting Is Fine If You Don't Use Full Names" PHI includes any information that could identify a patient in a healthcare context: an appointment time, a medication name, a reply confirming a session, or a text thread connecting a phone number to a treatment relationship ([45 CFR § 160.103](https://www.law.cornell.edu/cfr/text/45/160.103)). De-identification requires far more than dropping a last name. ### "Setting Up HIPAA-Compliant Chat Requires an IT Department" This was true a decade ago. Modern platforms handle encryption, BAA execution, audit logging, and access controls automatically during signup. If you can set up an email account, you can set up HIPAA-compliant chat. --- ## FAQ: Your HIPAA-Compliant Chat Questions Answered ### What free messaging apps are HIPAA compliant? Among the options in this guide, Mahla is the one with a free base platform: signed BAA, end-to-end encryption, audit trails, and no per-user fees, with AI features at about $1 per task. Spruce Health offers a 14-day trial with the BAA included, then $24/user/month. OhMD has no free tier. Google Chat qualifies only through a paid Google Workspace subscription with a signed BAA. The free personal version does not meet HIPAA requirements. Be cautious with platforms that gate compliance-critical features like BAA execution behind a paid tier. ### Is iMessage HIPAA compliant? No. Apple does not offer a Business Associate Agreement, which is a non-negotiable HIPAA requirement. Receiving a patient's iMessage doesn't itself violate HIPAA. The patient chose that channel. Responding with any PHI on iMessage creates a compliance violation because the platform lacks the BAA, audit trail, and access controls HIPAA requires. Redirect patient conversations to a compliant platform immediately. ### Is Google Chat HIPAA compliant? It depends on the version. Free personal Google Chat is not HIPAA compliant. Google Workspace paid plans at the Business Plus tier and above (starting around $22/user/month annually) can be HIPAA compliant with a signed BAA and proper security configuration ([Google Support](https://support.google.com/a/answer/3407054)), including disabling chat history for external users and restricting file sharing. You are responsible for proper configuration. The BAA alone does not make a misconfigured account compliant. ### Is TextFree HIPAA compliant? No. TextFree does not offer a BAA, does not provide enterprise-grade encryption for healthcare, and its terms of service do not support HIPAA-covered communications. It provides a second phone number, which some providers mistakenly believe creates sufficient separation. Using TextFree for patient communication involving PHI is a HIPAA violation. ### Is RCS messaging HIPAA compliant? No. RCS lacks a standardized BAA framework. Encryption support varies by carrier, device, and whether both parties have RCS enabled. There is no way to verify that every patient message meets consistent encryption and compliance standards. Until RCS develops healthcare-specific compliance with BAA support, it carries the same risks as standard SMS. ### Is there a HIPAA-compliant version of ChatGPT? Standard ChatGPT is not HIPAA compliant. OpenAI does not sign BAAs for consumer accounts ([OpenAI Help Center](https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai)). OpenAI offers BAA support through its Enterprise tier, API access, and the newer ChatGPT for Healthcare product ([OpenAI, 2026](https://openai.com/index/openai-for-healthcare/)), but all are designed for larger organizations and aren't practical or affordable for solo providers. AI-native HIPAA platforms like Mahla build AI capabilities (session note generation, appointment coordination, follow-up drafts) directly within HIPAA-compliant infrastructure, so providers get AI productivity without feeding PHI into a consumer tool. ### What are the HIPAA texting guidelines? HIPAA does not prohibit texting patients. It does require that any text-based communication containing PHI meet specific safeguards. The core HIPAA texting guidelines require: (1) end-to-end encryption for messages in transit and at rest, (2) a signed Business Associate Agreement with the platform vendor, (3) audit trails logging who accessed what and when, and (4) role-based access controls limiting PHI visibility to authorized users. These requirements apply equally to SMS, chat, and instant messaging. Use the 7-point compliance checklist in this guide to verify any texting or messaging platform. HIPAA texting rules don't distinguish between a chat app and a text messaging app. Both must meet the same encryption, BAA, and audit trail standards. ### Do I need a BAA for patient messaging? Yes, always. Any third-party platform that stores, transmits, or processes PHI requires a signed BAA under the HIPAA Privacy Rule. This applies to solo therapists and hospital systems equally. No exemption based on practice size or patient volume. Before signing up for any messaging tool, confirm that the vendor provides a BAA activating upon account creation, not at a paid tier. ### How much does HIPAA-compliant chat cost? Pricing ranges from $0 to custom enterprise rates. Mahla's base platform is free with no per-user fees (BAA, encryption, and audit trails included), and AI features cost about $1 per task. Spruce starts at approximately $24/user/month. OhMD's plans start at $300/month. Enterprise platforms like TigerConnect use custom pricing (contact vendor for quotes). For solo providers and small practices, free and low-cost options provide all essential compliance features. ### Can I text patients from my personal phone? You can use your personal phone as a device, but not your personal phone number or standard SMS/iMessage app. Install a HIPAA-compliant chat application and all patient communication stays encrypted and auditable within that app, separate from your personal messages. The compliant app creates its own secure channel. Your phone is the hardware running it. Enable a passcode, automatic lock, and remote wipe as additional safeguards. ### What happens if I use non-compliant messaging with patients? HIPAA violations carry civil penalties ranging from $145 to $73,011 per violation, with annual maximums up to $2,190,294 per violation category ([HIPAA Journal, "HIPAA Violation Fines — Updated for 2026"](https://www.hipaajournal.com/hipaa-violation-fines/)). Beyond fines, violations trigger corrective action plans, damage patient trust, and create professional liability exposure malpractice insurance may not cover. A single patient complaint to HHS can trigger an Office for Civil Rights investigation, and the investigation itself is disruptive even if no fine is imposed. Prevention through compliant tools costs far less than remediation. --- ## Your Next Step: Get Free HIPAA-Compliant Chat Today HIPAA-compliant chat isn't a luxury reserved for hospital systems with six-figure IT budgets. The standards are clear, free tools that meet every requirement exist today, and setup takes less time than most intake appointments. You now have the framework to evaluate any platform, the comparison data to choose, and a step-by-step path to your first compliant patient message. Free HIPAA-compliant chat puts secure, auditable patient messaging within reach of every provider, whether you're a solo therapist in private practice or a growing group clinic. The only thing left is to start. **Sign up for Mahla: free, HIPAA-compliant messaging with AI built for your practice. No credit card required.** --- **Editorial Process:** This guide was written by a health technology professional with direct experience building HIPAA-compliant communication platforms and clinically reviewed by a licensed professional counselor associate. All regulatory claims are verified against current HHS guidance and federal regulations. Platform pricing and features are verified directly with each vendor. ## About the Author Jonathan Read is a two-time health tech founder and Head of Product at Mahla, where he leads development of a free HIPAA-compliant platform with built-in AI for behavioral health providers. He previously co-founded a multi-state virtual practice for substance use and mental health treatment, and Keet Health, a patient engagement platform acquired by Clinicient. Jonathan has spent over a decade building HIPAA-compliant communication infrastructure for healthcare. **Clinically reviewed by** Alex Cohan, MS, LPC-Associate, NCC, is a clinical therapist trained in EMDR who works with adults, adolescents, and families. He reviewed this guide for clinical accuracy. --- ## Sources & References 1. U.S. Department of Health & Human Services. "Business Associates." HHS.gov, 2024. [https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html) 2. 45 CFR § 164.502(e) and § 164.504(e). "Business Associate Contracts." Code of Federal Regulations. [https://www.law.cornell.edu/cfr/text/45/164.504](https://www.law.cornell.edu/cfr/text/45/164.504) 3. 45 CFR § 160.103. "Definitions — Protected Health Information." Code of Federal Regulations. [https://www.law.cornell.edu/cfr/text/45/160.103](https://www.law.cornell.edu/cfr/text/45/160.103) 4. Google. "HIPAA Compliance with Google Workspace." Google Support, 2025. [https://support.google.com/a/answer/3407054](https://support.google.com/a/answer/3407054) 5. HIPAA Journal. "Is Google Workspace HIPAA Compliant? Updated for 2026." 2026. [https://www.hipaajournal.com/is-google-workspace-hipaa-compliant/](https://www.hipaajournal.com/is-google-workspace-hipaa-compliant/) 6. Spruce Health. "Plans & Pricing." SpruceHealth.com, 2025. [https://sprucehealth.com/plans](https://sprucehealth.com/plans) 7. OhMD. "HIPAA Compliant Texting." OhMD.com, 2025. [https://www.ohmd.com/](https://www.ohmd.com/) 8. U.S. Department of Health & Human Services. "42 CFR Part 2 Final Rule Fact Sheet." HHS.gov, 2024. [https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html](https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html) 9. OpenAI. "How Can I Get a BAA with OpenAI?" OpenAI Help Center, 2025. [https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai](https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai) 10. OpenAI. "OpenAI for Healthcare." OpenAI.com, 2026. [https://openai.com/index/openai-for-healthcare/](https://openai.com/index/openai-for-healthcare/) 11. HIPAA Journal. "HIPAA Violation Fines — Updated for 2026." 2026. [https://www.hipaajournal.com/hipaa-violation-fines/](https://www.hipaajournal.com/hipaa-violation-fines/) 12. HIPAA Journal. "Is ChatGPT HIPAA Compliant? Updated for 2026." 2026. [https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/](https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/) 13. HIPAA Journal. "Is WhatsApp HIPAA Compliant?" 2025. [https://www.hipaajournal.com/whatsapp-hipaa-compliant/](https://www.hipaajournal.com/whatsapp-hipaa-compliant/) 14. HIPAA Journal. "Is Signal HIPAA Compliant?" 2025. [https://www.hipaajournal.com/is-signal-hipaa-compliant/](https://www.hipaajournal.com/is-signal-hipaa-compliant/) 15. Anthropic. "Business Associate Agreements (BAA) for Commercial Customers." 2025. [https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) 16. OpenAI. "Enterprise Privacy at OpenAI." OpenAI.com, 2025. [https://openai.com/enterprise-privacy/](https://openai.com/enterprise-privacy/) 17. American Medical Association. "HIPAA Violations & Enforcement." AMA, 2024. [https://www.ama-assn.org/practice-management/hipaa/hipaa-violations-enforcement](https://www.ama-assn.org/practice-management/hipaa/hipaa-violations-enforcement) 18. Telegram. "Telegram FAQ." 2025. [https://telegram.org/faq](https://telegram.org/faq) 19. Google for Developers. "Data Security for RCS for Business." 2025. [https://developers.google.com/business-communications/rcs-business-messaging/terms-and-policies/data-security](https://developers.google.com/business-communications/rcs-business-messaging/terms-and-policies/data-security) 20. Compliancy Group. "Is iMessage HIPAA Compliant?" 2025. [https://compliancy-group.com/is-imessage-hipaa-compliant/](https://compliancy-group.com/is-imessage-hipaa-compliant/) 21. Paubox. "Is WhatsApp HIPAA Compliant?" 2025. [https://www.paubox.com/blog/whatsapp-hipaa-compliant](https://www.paubox.com/blog/whatsapp-hipaa-compliant) 22. Text-Em-All. "HIPAA-Compliant Texting: Everything You Need to Know." 2025. [https://www.text-em-all.com/hipaa-compliant-texting](https://www.text-em-all.com/hipaa-compliant-texting)