Behavioral Health EHR Security Features

Is ICANotes Secure and HIPAA Compliant?

Yes. ICANotes is a HIPAA-compliant behavioral health EHR, built to protect the most sensitive records in healthcare: therapy notes, psychiatric evaluations, and substance use treatment records. Every account gets layered security controls, and every customer gets a signed Business Associate Agreement (BAA). ICANotes Classic is also ONC certified, so it meets federal standards for health IT.

Start Free Trial Book a Demo

30-Day Free Trial

At a glance, ICANotes provides:

HIPAA compliance:: a BAA for every customer, plus an annual security risk assessment based on NIST guidelines
Access control:: individual logins, multi-factor authentication (MFA), and role-based permissions
Encryption:: encrypted data transmission and encrypted offsite backups
Audit trails:: logs of every sign-in and every patient record opened
Behavioral health privacy:: psychotherapy notes stored separately, with their own password protection
Backup and recovery:: continuous saving, hourly snapshots, and geographically separate backups

Credentials You Can Check

HIPAA Compliant

BAA signed with every customer

ONC Certified

2015 Edition Cures Update (verify on CHPL)*

*ICANotes Classic only

CARF Ready

Documentation that supports CARF standards

Joint Commission Ready

Supports Joint Commission behavioral health standards

Security Designed Around Behavioral Health

General medical EHRs treat security as one-size-fits-all. Behavioral health records carry more risk, because a single disclosure can affect a client's relationships, employment, and willingness to continue care.

Federal law recognizes this. HIPAA gives psychotherapy notes extra protection, and 42 CFR Part 2 sets additional rules for substance use disorder treatment records.

ICANotes has served mental health providers exclusively since it was founded, and clinicians help shape the product. That focus shows in the security model:

Psychotherapy notes are kept separate from the official record, as HIPAA intends
Permissions follow how behavioral health teams work, from solo therapists to group practices with front-desk, billing, and supervisory staff
Documentation controls support the standards behavioral health practices are audited against, including HIPAA, CARF, and the Joint Commission

Access Control

Access control decides who can open a record and what they can do with it. In ICANotes, that comes down to five controls:

Individual Authentication of Users

Every user signs in with their own username and password, so every action in the record ties back to one person. Shared logins aren't needed, and they shouldn't be used.

Multi-Factor Authentication (MFA)

MFA adds a second check after the password, so a stolen password alone can't open your records. Users can verify with an authenticator app, a text message code, or a recovery email, and can register more than one method as a backup. Trusted devices can be remembered for 90 days.

Role-Based Access Control (RBAC)

Role-based access control limits each user to the information their job requires. Clinicians can see the full chart, while records staff can be limited to browsing and printing, and billing staff can be given only the access they need for claims. Fewer people see sensitive notes, which is the "minimum necessary" principle HIPAA expects.

Access Establishment and Modification

Practice administrators manage permissions directly: adding users, removing access when someone leaves, changing roles, and resetting passwords. When a staff member's role changes, their access can change the same day, without a support ticket.

Protection of Remote Access Points

ICANotes is web-based, so clinicians can work securely from the office, from home, or between sites. To protect unattended devices, ICANotes logs off workstations, or drops them from the network, after a set period of inactivity. A laptop left open in a shared office doesn't stay signed in to client records.

Data Protection

Data protection keeps records confidential, intact, and available whenever you need them.

Privacy of Psychotherapy Notes

Psychotherapy notes, a clinician's private notes analyzing a session, get special status under HIPAA. Most disclosures need the client's specific written authorization, even for purposes such as billing that would normally be allowed, and the notes aren't part of a client's general right to access their records.

ICANotes is built to respect that line. Psychotherapy notes are:

Stored separately from the official medical record, so they aren't released with routine record requests
Password-protected with an additional layer beyond the standard sign-in
Kept out of progress notes, treatment plans, and billing documentation that other staff and payers see

Clinicians can record their full clinical thinking without worrying that it will travel with the chart. Many general-purpose EHRs don't make this distinction at all.

Encryption

Data sent between your device and ICANotes is encrypted, so it can't be read in transit. Offsite backups are sent over encrypted connections and stored in encrypted form.

Prevention of Destruction of the Electronic Record

Signed notes are locked with a digital electronic signature, so finished documentation can't be quietly altered or deleted. That protects the integrity of the record in an audit or legal review.

Data Backups and Disaster Recovery

Security also means your records are there when you need them. ICANotes protects data availability at several levels:

Continuous saving: each field saves as soon as you complete it, so a dropped connection doesn't cost you a note
Hourly snapshots: the full database is captured every hour and feeds a read-only replica for failover
Redundant storage: live data runs on fault-tolerant systems with redundant disk arrays
Offsite, encrypted backups: backups are stored in multiple geographically separate locations
Long-term retention: daily backups are kept for 30 days, and weekly full backups are kept long-term

ICANotes maintains a documented disaster recovery plan that follows state and federal contingency planning requirements. For security reasons, the full plan isn't published.

Monitoring & Compliance

Monitoring shows what happened in your records, and compliance controls show you're meeting your obligations.

Audit Trails

ICANotes keeps two audit logs:

A sign-in log recording the date, time, and identity of every user who logs in
A record-access log recording which patient notes were opened, when, and by whom

If a client asks who has seen their record, or a payer or accreditor asks for proof of access controls, you have the answer. Audit trails also help you spot unusual activity, such as a user opening records outside their caseload, before it becomes a reportable breach.

Compliance Monitoring

ICANotes treats its own security as an ongoing program:

An annual security risk assessment, based on NIST guidelines
HIPAA policies and procedures, with staff trained when hired and every year after
A designated HIPAA security official
Frequent security updates
Third-party integrations, including HIE connections, held to the same security standards
Federal ONC certification, with annual Real World Testing published on our ONC Certification page (ICANotes Classic only)

Alarm and Event Reporting

After three failed password attempts in a row, ICANotes blocks further attempts for five minutes and reports the event to your system administrator. Guessing attacks are slowed down, and your administrator knows about them.

Documentation Controls

Behavioral-health-specific templates prompt clinicians for the elements auditors look for, such as diagnoses, treatment plan goals, and progress toward them. Time-stamped entries and automated record-keeping make documentation complete and consistent. These controls support HIPAA, CARF, and Joint Commission requirements.

Security Is a Partnership

No EHR makes a practice compliant on its own. ICANotes secures the platform and gives you the controls; your practice decides how they're used, as the HIPAA Security Rule requires.

ICANotes

Secures the platform your records live on
Gives you the access, permission, and audit controls
Signs a Business Associate Agreement

Your practice

Decides who gets access
Trains staff
Manages client consents
Completes its own risk assessment

Evaluating ICANotes for your practice?

See the security controls in action, or try them with your own team. Compare how ICANotes stacks up in our ICANotes vs SimplePractice guide.

Book a Demo Start Free Trial

EHR Security FAQs

Is ICANotes HIPAA compliant?

Yes. ICANotes operates as a HIPAA-compliant business associate and signs a BAA with every customer. It completes an annual NIST-based security risk assessment, trains its staff on HIPAA every year, and provides the access controls, audit trails, and encryption your practice needs to meet its own HIPAA obligations.

What security features should an EHR include?

A secure EHR should cover three areas. Access control means individual logins, MFA, and role-based permissions. Data protection means encryption, backups, and disaster recovery. Monitoring means audit trails and alerts. Behavioral health practices should also look for separate protection of psychotherapy notes and a signed BAA.

Does ICANotes use role-based access controls?

Yes. Administrators assign each user permissions that match their role, so clinicians, front-desk, records, and billing staff each see only what their work requires. Permissions can be changed or removed at any time, which supports HIPAA's minimum-necessary standard.

How does ICANotes protect psychotherapy notes?

ICANotes stores psychotherapy notes separately from the official medical record and protects them with an additional password. They aren't included in progress notes, treatment plans, billing, or routine record releases, which matches the special protection HIPAA gives these notes.

Does ICANotes provide audit trails?

Yes. ICANotes logs the date, time, and identity of every user who signs in, and separately records which patient notes each user opened and when. Administrators also receive alerts after repeated failed login attempts.

How does ICANotes protect patient data from loss?

Every field saves as you complete it, the database is captured hourly, and encrypted backups are stored in multiple geographically separate locations. Live data runs on fault-tolerant, redundant storage, and ICANotes keeps a documented disaster recovery plan.