Article
HIPAA security risk assessments, in plain English
The HIPAA Security Rule requires a risk assessment. Here is what it covers, how often to do it, and where small practices usually fall short.
- PROTECT
6 min ·
INDUSTRY / BEHAVIORAL HEALTH
Someone reaching out for help deserves a fast, human answer. Your intake line shouldn't make them wait.
When someone finally calls or fills out a form asking for help, the speed and warmth of that first response can decide whether they get care at all. At the same time, your records hold some of the most sensitive information a person has. Cyber6 helps you respond quickly to the people reaching out, protect what they share with you, and give your clinicians back time for the work only they can do.
AUTOMATEPROTECTEMPOWER
6 min read
a quiet, welcoming therapy office waiting area with a phone and intake tablet on a side table
Example
New inquiry
- 8:52 PMWeb inquiry received · "Looking for someone to talk to"
- 8:53 PMThank you for reaching out. Someone from our team will follow up within one business day. If this is an emergency, please call 988 or go to your nearest emergency room.
- 8:54 PMAssigned to intake coordinator · flagged for morning follow-up
WE GET IT
We know what your week looks like
- 01
A late-night inquiry waits until Monday
Someone fills out a contact form on a Saturday night asking about therapy. Nobody sees it until Monday morning, and by then they may not follow up.
- 02
The waitlist quietly loses people
A prospective client is told they're on a waitlist. Weeks pass with no update, and they stop responding when a spot finally opens.
- 03
No-shows disrupt the day and the client's care
A client misses a session with no notice. The clinician's hour goes unfilled, and the missed session may set back the client's progress.
- 04
Clinicians spend evenings on notes instead of with family
After a full day of sessions, clinicians stay late writing progress notes that insurance and licensing require.
- 05
Authorizations delay care
A course of treatment needs prior authorization from an insurer, and the wait can mean sessions are delayed or canceled.
- 06
Telehealth sessions happen over consumer apps
A clinician takes a session over a personal video app because it's familiar, without knowing whether it meets privacy requirements for clinical care.
- 07
A record is more sensitive than most
Notes may reference substance use, a diagnosis, or details a client has never told anyone else. A breach here can cause harm no dollar figure captures.
- 08
Staff turnover interrupts continuity
A front-desk or intake coordinator leaves, and the next hire has to learn, quickly and carefully, how to handle people who are often in distress.
THE IMPACT
What it's costing you
People who never make it to care
Every inquiry that waits too long is a chance someone doesn't follow up, and doesn't reach out again.
Clinician hours that can't be recovered
A missed session leaves a clinician's hour empty and unpaid, and the client further from consistent care.
Documentation time that isn't clinical time
Hours spent writing notes are hours not spent with clients or resting between sessions, which affects both care quality and staff retention.
A breach involving especially sensitive information
Notes involving mental health or substance use carry a level of harm and exposure beyond a typical medical record if they're disclosed.
Trust that's hard to rebuild
Clients come to you because they trust you with something private. A privacy incident can end that relationship, and others by reputation.
COMPLIANCE
Rules you have to follow
HIPAA (Privacy, Security, and Breach Notification Rules)
- What it is
- The federal law protecting patient health information, including mental health records.
- Who it applies to
- Behavioral health practices that create, store, or transmit patient health information.
- What it expects of you
- A documented risk assessment, safeguards like access controls and encryption, staff training, business associate agreements with vendors, and notification if a breach occurs.
- How Cyber6 helps
- We run your HIPAA security risk assessment, put safeguards in place, and train your staff with care for the sensitivity of this work.
42 CFR Part 2
- What it is
- A federal law giving extra confidentiality protection to records of substance use disorder treatment, stricter in places than HIPAA.
- Who it applies to
- Programs that provide substance use disorder diagnosis, treatment, or referral and receive federal assistance in a qualifying way.
- What it expects of you
- Specific written client consent before most disclosures of Part 2 records, even for treatment coordination in many cases.
- How Cyber6 helps
- We help you identify which records fall under Part 2 and build access controls and consent workflows that respect the extra protection those records require. [OWNER: confirm which client programs are subject to Part 2 and how consent workflows are documented.]
State mental health confidentiality laws
- What it is
- State-level laws that often add protection for mental health and therapy records beyond HIPAA.
- Who it applies to
- Behavioral health providers, varying by state.
- What it expects of you
- Requirements vary, but commonly include stricter consent rules for sharing psychotherapy notes.
- How Cyber6 helps
- We build your safeguards to the stricter of HIPAA and your state's requirements. [OWNER: confirm which state-specific rules apply to each client before publishing state-specific guidance.]
California Confidentiality of Medical Information Act (CMIA)
- What it is
- California's own medical privacy law, which includes specific protection for mental health information.
- Who it applies to
- Practices in California, and practices treating California clients.
- What it expects of you
- Patient consent before sharing medical information in many cases, and reasonable safeguards to protect it.
- How Cyber6 helps
- We build your safeguards to meet HIPAA, Part 2, and CMIA together.
This is general information, not legal advice.
THE FIX
How Cyber6 helps
AUTOMATE
Fill the gaps automatically
- Get found
The right customers find you on Google, AI search, and social, in your own voice.
- Get customers
Every call, text, form, and quote turns into booked work.
Fast, warm intake response
Every inquiry gets an immediate, warm acknowledgment with next steps and crisis resources, and your intake team gets it first thing the next morning.
Waitlist management
People on the waitlist get periodic, gentle check-ins so they know they haven't been forgotten, and openings go out the moment they exist.
- Serve customers
Customers hear from you at the right time, without your team chasing them.
Reminders and re-engagement
Clients get a caring, plainly worded reminder before each session, and a gentle re-engagement message if they miss one.
- Get paid
Money you've already earned comes in sooner, without awkward phone calls.
- Run the business
Less retyping and waiting, more time for the work that matters.
Documentation assistance, with clinician review and client consent
Clinicians get a drafted note based on session content they choose to share, which they review, edit, and finalize themselves. Nothing is used without the clinician's and client's understanding of how it works.
PROTECT
Protect what you're trusted with
- 01
Strict access controls on client records
Access to notes and records is limited to the staff who need them for a specific client's care, not the whole practice by default.
What this means for you: A curious login or a compromised account can't browse every client's file.
- 02
Telehealth and messaging built for privacy
Video sessions and client messaging run on platforms built to protect health information, not consumer apps never designed for clinical care.
What this means for you: A session stays between the clinician and the client.
- 03
Multi-factor authentication everywhere records live
Every login to your EHR, email, and telehealth platform requires , not just a password.
What this means for you: A stolen password alone can't reach a client's history.
- 04
Encryption for records at rest and in transit
Client records are encrypted on the systems that store them and whenever they're sent between your practice and another provider.
What this means for you: If a device is lost or a message is intercepted, the information inside stays unreadable.
- 05
Audit logging on every record
Every time a record is opened, changed, or shared, it's logged, so you can show exactly who accessed what and when.
What this means for you: You can answer, with confidence, any question about who saw a specific client's file.
EMPOWER
Train the people doing the work
Clinicians and clinical supervisors
Privacy and confidentiality training for clinicians
Careful, practical training on HIPAA, 42 CFR Part 2, and everyday situations, like what to do when a family member calls asking about a client.
Intake coordinators and front desk staff
Front desk and intake privacy training
How to handle sensitive calls and forms with care, spot phishing attempts, and know what information can and can't be shared without consent.
Clinicians and administrative staff
Safe AI use with clinical notes
Clear rules for what clinical content can and can't go into AI tools, and how documentation assistance tools are used only with the client's understanding.
A DAY WITH CYBER6
A day in your practice with Cyber6
8:10 AMAUTOMATE
An overnight inquiry from a person in distress already received a warm, immediate response with crisis resources, and is flagged for your intake coordinator to call first.
11:00 AMPROTECT
A login attempt from an unrecognized device is blocked before it can reach your EHR.
1:30 PMEMPOWER
An intake coordinator declines to share a client's attendance history with a caller who couldn't verify their identity, exactly as trained.
5:45 PMAUTOMATE
A clinician reviews and finalizes a drafted progress note in a few minutes instead of forty, and leaves on time.
YOUR TOOLS
Systems we commonly see
- SimplePractice
- TherapyNotes
- Valant
- Kipu
We work alongside the systems you already use. We'll confirm what connects during your assessment.
QUESTIONS
Questions from behavioral health
Every message is written with care, in plain and warm language, and always includes a way to reach a person and crisis resources when needed.
We help you identify which records fall under Part 2 and build consent and access controls that meet its stricter requirements, separate from standard HIPAA handling.
No. Clinicians choose what to share, review every draft, and finalize the note themselves. Nothing goes into a client's record without clinician review.
Consumer video and messaging apps aren't built for clinical privacy requirements. We help you move to platforms designed for it without disrupting care.
Yes, and we set up reminders so consent is documented and messages avoid sensitive clinical detail.
Yes. We can extend what your EHR already does, close gaps in intake response and follow-up, and strengthen the security around it.
That request is honored. Documentation assistance is opt-in and explained to clients, never assumed.
Nothing. It's a free, confidential conversation about your intake process and privacy safeguards, with a written summary of what to address first.
RESOURCES
Learn more
ArticleThe Change Healthcare outage: what one missing login step cost
The 2024 Change Healthcare attack showed how a single missing security step can disrupt an entire industry for weeks.
- PROTECT
6 min ·
ArticleA HIPAA compliance checklist for small practices
Protecting patient health information requires more than just a locked door. Use this HIPAA compliance checklist to audit your physical, technical, and administrative safeguards.
- PROTECT
6 min ·
WHO WE'VE WORKED WITH
- A statewide cybersecurity assessment program
- Credit unions
- A water and wastewater utility
- Housing organizations
- Nonprofits and churches
- Small businesses
- A health and wellness startup
Every result is measured against your own starting point.
How we prove it →PART OF ONE PARTNER
One partner for all three.
Protect · IT & Cybersecurity
IT and cybersecurity, managed around the clock.
You're here
Empower · Training for Businesses & Individuals
Training that builds skills for your team and your career.
Explore Empower
WHY CYBER6
Why businesses choose Cyber6.
One partner, not three vendors
The people automating your work also run and protect your IT and train your team, so nothing falls between companies.
Plain language and real people
You talk to people who explain things clearly, answer the phone, and tell you what they'd do in your place.
Measured against your own numbers
We record where you start before anything changes, then report results against that baseline.
Marquis Carroll, Founder & CEO. Marquis has spent years doing hands-on IT and security work through his own business, and runs a mentorship program that has helped people start careers in tech.
Our storyGETTING STARTED
Four steps from first call to results.
Explore
A relaxed 30-minute conversation about how your business runs and what's getting in the way. No cost, no pressure.
You get: honest answers on whether we can help.
Assess
We look at your systems, security, manual work, and training needs, and record your starting numbers.
You get: a plain-English picture of your risks and opportunities.
Set up
A prioritized plan and proposal, then a kickoff that introduces your team and sets up access safely.
You get: a shared timeline and who to call for what.
Enable
We roll out in phases, train your team, and walk you through your first results.
You get: your first plain-English report, measured with PROVE.
Let's look at your practice together, carefully and confidentially.
A 30-minute call. No cost, no pressure, and honest answers.