How to Create a Therapist Informed Consent Form for Private Practice (with Free Template)
This guide walks a solo therapist or small private practice through the eleven substantive steps of building a HIPAA-aware informed consent form that satisfies APA Ethics Code 10.01, ACA Code A.2, and the patchwork of state-specific telehealth and mandatory-reporting rules. Each step is one paragraph of working guidance. Estimated time end-to-end: 45 minutes from blank document to signed PDF when using an AI form builder. Formfy is the AI form builder private practice clinicians use; the same builder produces the consent form, captures the HIPAA-compliant e-signature, and stores the audit trail behind a Business Associate Agreement under 45 CFR 164.314.
Before you start, gather six pieces of information: (1) your scope of practice and the modalities you offer, (2) your fee structure including any sliding scale, (3) the telehealth platform you use and its BAA status, (4) your state mandatory-reporting statute citations, (5) your malpractice carrier name, and (6) your supervisor name and license number if you are pre-licensure. With those six inputs, the substantive drafting takes under 45 minutes. Without them, the consent cannot be drafted because the scope, fee, and supervision clauses cannot be filled in.
Step 1: Define your scope of practice and treatment limits
Begin by stating exactly what services the engagement covers. Name the therapeutic modalities you practice (Cognitive Behavioral Therapy, Emotionally Focused Therapy, EMDR, Internal Family Systems, psychodynamic, ACT, DBT). Name the populations you serve (adults, adolescents, couples, families) and the populations you do not (active psychosis, active substance dependence requiring medical detox, court-mandated forensic evaluations). Name the clinical focus areas (anxiety, depression, trauma, relationship issues) and the issues that fall outside your competency (eating disorders requiring nutritional medical management, severe personality disorders requiring DBT-team coordination). Name the session format (50-minute individual sessions, 80-minute couples sessions). Vague scope produces ethics-board complaints; specific scope produces predictable engagements. The APA Ethics Code 2.01 (Boundaries of Competence) and ACA Code C.2.a require clinicians to practice only within the boundaries of their competence based on education, training, supervised experience, and consultation. State explicitly when you will refer out and to whom.
Step 2: Reference your HIPAA Notice of Privacy Practices (45 CFR 164.520)
Under 45 CFR 164.520, every covered entity must provide a Notice of Privacy Practices (NPP) to each new patient at first service delivery and obtain a written acknowledgment of receipt. The NPP is a separate document from the informed consent for treatment, but the consent form should cross-reference it. The NPP describes how protected health information may be used and disclosed for treatment, payment, and health care operations under 45 CFR 164.506, the patient rights under 45 CFR 164.524 to 164.528 (right to access records, right to request amendments, right to an accounting of disclosures), and the practice contact for privacy complaints. The consent form should state: I have received a copy of the practice Notice of Privacy Practices and have had an opportunity to read it before signing. Failure to deliver the NPP is one of the most common HIPAA violations cited by the Office for Civil Rights.
Step 3: Document informed consent for treatment (APA 10.01, ACA A.2)
APA Ethics Code 10.01(a) requires psychologists to obtain informed consent at the outset of treatment using language reasonably understandable to the patient and to inform the patient of the nature and anticipated course of therapy, fees, involvement of third parties, and limits of confidentiality. ACA Code of Ethics A.2.b lists the same disclosure elements for licensed counselors. Document each element explicitly. State the nature of the therapy you offer (modality, expected session frequency, expected duration of treatment range). State the foreseeable risks and benefits (emotional discomfort during trauma processing, no guarantee of outcome). State the alternatives to therapy (medication consultation, group therapy, self-help resources). State the limits of confidentiality up front (mandatory reporting triggers, court orders, imminent danger). Use plain language; do not bury terms in legalese. The consent must be voluntary and revocable.
Step 4: Disclose fees, insurance, and no-show policy
State the fee per session in dollar terms (not vague language like usual and customary). If you offer a sliding scale, state the eligibility criteria and the fee tiers. State whether you accept insurance and which networks (Aetna, Anthem, BCBS, Cigna, Optum, United Behavioral Health) or whether you are out-of-network. If out-of-network, state that you will provide a superbill the patient can submit for reimbursement and that reimbursement is between the patient and their insurance. State the No Surprises Act good faith estimate obligation under 45 CFR 149.610 for self-pay or uninsured patients (effective January 1, 2022). State the no-show policy (typical practice charges 100 percent of the session fee for cancellations under 24 hours). State accepted payment methods and the billing cadence. APA Ethics Code 6.04 requires accurate fee disclosure as early as feasible.
Step 5: Add telehealth informed consent (state parity laws and Ryan Haight)
If you offer telehealth, the consent form must include a separate telehealth section. State the technology platform (Zoom for Healthcare, Doxy.me, SimplePractice Telehealth, all of which sign HIPAA Business Associate Agreements). State the patient location requirement: the patient must be physically located in a state where you are licensed at the time of the session, or in a state with telehealth interstate compact participation (PSYPACT for psychologists, Counseling Compact for LPCs, Social Work Licensure Compact). State the foreseeable telehealth-specific risks (technology failure mid-session, reduced ability to assess nonverbal cues, privacy in patient location). State the emergency protocol for telehealth (verify patient address each session, identify a local emergency contact, identify the nearest hospital). If controlled substances are ever prescribed in the practice, the Ryan Haight Online Pharmacy Consumer Protection Act (21 U.S.C. 829(e)) requires at least one in-person evaluation absent a special registration; document the in-person requirement. State telehealth parity law disclosures by state where applicable.
Step 6: Document mandatory reporting language (CAPTA and state-specific)
Mandatory reporting is the most-cited limit of confidentiality. State each trigger explicitly. The federal Child Abuse Prevention and Treatment Act (CAPTA) at 42 U.S.C. 5106a sets the federal floor; all 50 states designate licensed mental health professionals as mandated reporters of suspected child abuse and neglect. Most states extend mandatory reporting to suspected abuse of vulnerable adults (definitions vary by state) and elder abuse under state Adult Protective Services statutes. Some states (California Welfare and Institutions Code 15630, New York Social Services Law 473-b) have specific timing requirements (immediate phone report plus written report within 36 to 48 hours). Document the limit-of-confidentiality language: I am required by law to report suspected child abuse or neglect, suspected abuse of a vulnerable adult or elder, and credible threats of imminent harm to identified victims. State the reasonable belief standard. Do not promise confidentiality you cannot legally maintain.
Step 7: Address termination and abandonment prevention (APA 10.10)
APA Ethics Code 10.10(a) and ACA Code A.11 require clinicians to terminate when the patient no longer needs services, is not benefiting, or is being harmed by continued service. APA 10.10(c) requires advance notice and termination counseling, and provision of pretermination counseling and referrals as appropriate, except where precluded by patient actions or third-party factors. The consent form should state the termination protocol: either party can end the therapeutic relationship; the clinician will provide reasonable notice (typically two to four sessions) absent safety concerns; the clinician will offer referrals to other providers; and the clinician will provide a written summary of treatment if requested. Address abandonment prevention explicitly. Abandonment occurs when a clinician ends services without adequate notice, transition planning, or referral. Abandonment is one of the top three causes of state licensing board complaints against therapists. State what happens if the patient stops attending without notice (typical practice: clinician makes two outreach attempts over four weeks, then administratively closes the file with a letter).
Step 8: Establish a court-ordered records subpoena protocol
Patients in custody disputes, personal injury litigation, and criminal cases are routinely subpoenaed for therapy records. The consent form should state the subpoena protocol so the patient knows what to expect. State that the clinician will not produce records in response to a subpoena alone; the clinician will require either a signed patient authorization meeting 45 CFR 164.508 standards or a court order signed by a judge. State that the clinician will notify the patient of any subpoena received and will assert applicable privilege (psychotherapist-patient privilege under Jaffee v. Redmond, 518 U.S. 1, 1996, in federal court; state evidentiary privilege under each state code) absent waiver. State that the patient bears the cost of legal review if the subpoena is contested. Document the response timeline: HIPAA 45 CFR 164.512(e) requires either patient notification or a qualified protective order before producing records under subpoena alone. Confused subpoena responses produce malpractice liability and licensing board complaints.
Step 9: Disclose supervision status (LCSW, LMFT, LPC, pre-licensure)
If you are pre-licensure (associate, intern, registered, provisional), state your supervision status explicitly. State the supervisor name, license type, and license number. State that the supervisor reviews cases regularly and may be consulted by the patient if concerns arise. APA Ethics Code 10.01(c) and ACA Code F.1 require supervised trainees to inform patients of the trainee status and identify the supervisor. Pre-licensure clinicians have specific malpractice risk: state licensing boards have ruled that failure to disclose pre-licensure status constitutes a deceptive practice. If you are fully licensed (LCSW, LMFT, LPC, LPCC, PhD, PsyD), state your license type, license number, and the licensing state. State whether you carry malpractice insurance (most carriers will not certify a clinician for risk pool participation without evidence of insurance). Trainee disclosure is independently required even if the patient does not ask. Do not bury the supervision status in a footer; place it in the body of the consent.
Step 10: Require Business Associate Agreements with vendors (45 CFR 164.314)
HIPAA 45 CFR 164.314(a) requires every covered entity (including solo private practice therapists) to execute a Business Associate Agreement (BAA) with any vendor that creates, receives, maintains, or transmits PHI on behalf of the practice. Common vendors requiring a BAA include: practice management software (SimplePractice, TherapyNotes, TheraNest), telehealth platforms (Zoom for Healthcare, Doxy.me), email providers handling PHI (Hushmail, Paubox, Microsoft 365 with HIPAA BAA, Google Workspace with HIPAA BAA), cloud storage providers (Google Drive HIPAA, Dropbox Business HIPAA), e-signature and form vendors that capture intake data, transcription services, billing services, and external answering services. The BAA must include the elements at 45 CFR 164.504(e): permitted uses and disclosures, safeguards, breach reporting obligations, subcontractor requirements, and termination. The consent form does not need to enumerate every BAA vendor, but it should state that the practice executes BAAs with vendors that handle PHI and that the BAA list is available on request. Failure to maintain a current BAA inventory is the second-most-cited finding in OCR HIPAA audits.
Step 11: Capture signature and audit trail (e-sign with HIPAA BAA)
Use an e-signature workflow that produces a tamper-evident audit trail with timestamp, IP address, and consent to electronic records, and that operates under a HIPAA Business Associate Agreement. The federal ESIGN Act (15 U.S.C. 7001) and the Uniform Electronic Transactions Act (adopted in 49 states) make e-signed informed consent forms legally equivalent to wet-ink. Store the signed consent in a system that lets you retrieve it on 24-hour notice if a malpractice carrier or licensing board asks. Formfy, SimplePractice, TherapyNotes, DocuSign, and Adobe Acrobat Sign sign HIPAA BAAs and meet ESIGN Act evidentiary requirements. The audit trail should include: signer name, signer email, IP address, timestamp, document hash, and consent text. For minor patients, capture both the parent or guardian signature and the minor assent (typically required for ages 12 and older, state-specific). Consent is voluntary and revocable; document the revocation procedure. Do not email a Word doc and ask for a typed name in the signature line; that produces a weaker evidentiary record and an arguable HIPAA gap.
Free template and downloadable PDF
Formfy ships a private practice therapist informed consent template that maps one-to-one to the eleven steps in this guide. The template is editable in the AI form builder: describe the practice in plain English and the builder returns a delivery-ready consent form with the e-signature block, telehealth section, and optional intake fields. The PDF version is generated automatically when the patient signs and is stored alongside the audit trail behind a HIPAA Business Associate Agreement under 45 CFR 164.314.
See also: /faq/private-practice-therapists-therapist-informed-consent for the FAQ companion hub covering the most common solo therapist informed consent questions.
Related resources
Build a HIPAA-aware informed consent form in 30 seconds
Free 15-day Formfy trial. No credit card. Submission-based pricing. BAA on request.
Start your free trialLast verified: 2026-04-25. This page is informational; it is not legal or clinical advice. Therapists should review state-specific mandatory reporting, telehealth licensure compact participation, and abandonment-prevention rules with counsel and their licensing board.