The HIPAA Mistake That Could Haunt Your Practice

Oooohh… spooky

It’s spooky season – and while everyone else is worried about ghosts and goblins, the scariest thing I can think of as a therapist in private practice is a HIPAA violation I didn’t even see coming.

Because here’s the thing about compliance mistakes – they don’t announce themselves. They don’t show up in a scary costume or knock on your door. They quietly happen in the background while you’re busy doing the actual work of showing up for your clients. And by the time you find out, the damage is already done.

So consider this your October warning.

The Most Common HIPAA Haunting

If you’ve been following along here, you already know I’ve been on a compliance deep dive lately – and email has been the biggest surprise. Most therapists I talk to assume their email is fine. They’re using a well-known platform, they’re not doing anything obviously wrong, and nobody has complained.

Sound familiar?

Here’s what I’ve learned: the most common HIPAA mistake therapists make isn’t something dramatic. It’s simply assuming that because a platform is popular, it’s compliant. Gmail. Outlook. These are tools millions of people use every day – and none of them are HIPAA compliant by default. If you pay for Google Workspace or Microsoft 365, you can get the signed agreement. What you still don’t get is encryption on the emails you send. You can have the paperwork done and still be sending client information out unprotected.

Every intake email, every appointment confirmation, every coordination message with a referring provider – if your email isn’t properly encrypted and covered by a signed business associate agreement (a BAA) with your provider, that information isn’t as protected as you think.

For therapists in private practice especially, there’s no IT department catching this for you. It falls entirely on you to know AND to fix it.

What “Haunting Your Practice” Actually Looks Like

HIPAA violations related to email are real. Email shows up over and over in the breach reports HHS publishes, and the consequences range from formal corrective action plans to significant financial penalties – even when the violation was unintentional.

The “I didn’t know” defense doesn’t hold up. And the “I thought I was compliant” defense holds up even less.

The good news – and I promise there is good news – is that this is one of the more straightforward things to fix once you know about it.

What I Use and Why

After doing my research, I added my practice email to Paubox – and it has genuinely changed how I think about client communication. Everything is encrypted automatically, every single time, without me having to do anything differently. My clients receive emails directly in their inbox with no portal login required. And the formal data protection agreement that HIPAA requires? Handled.

It works exactly like regular email. Same address, same inbox. I didn’t have to switch anything. That’s the part I didn’t expect – I assumed switching to something compliant meant adding friction. It didn’t. 

All it is? Security running quietly in the background that keeps my email HIPAA compliant and protects me, my team, and my clients.

What sold me beyond the features is who else uses it. (I snoop –  cmon you dont?!)

Paubox works with major health systems, Oura, Cost Plus Drugs, and more than 9,000 other healthcare organizations – which means the security standards they hold are the same ones protecting some of the biggest names in healthcare. The fact that a solo private practice like mine can access that same level of protection at an affordable price point is honestly what sealed it for me.

Your October Action Item

Before the month is out, take ten minutes and actually look into your email setup. Ask yourself:

• Do you have a formal written agreement with your email provider around patient data protection? (for real – look this up. It is NOT auto included even with your custom domains.)
• Are your emails automatically encrypted every time you hit send?
• Would your current setup hold up if a client or regulatory body asked questions?

If you’re not sure – that’s. your. answer.

You can try Paubox free for 14 days. If you stay, my code MADDIE takes $250 off your first year, so it’s $134 instead of $384 for up to five people. It’s a one-time discount on your first bill.. Consider it your treat this Halloween – because the alternative is definitely the trick.

This post is sponsored by Paubox. All opinions are my own.