Therapy, counseling and addiction treatment practices hold some of the most sensitive records in medicine. A session note or a treatment history can follow someone for years if it ends up in the wrong place. At the same time, these practices run lean, with clinicians who split time between the office and home and a front desk that handles intake, scheduling and billing all at once. We support behavioral health practices in Central Kentucky today, and this page covers what's different about their IT. For the broader picture of how we protect patient data, see our healthcare IT page.
Systems we work around
Behavioral health practices we support run EHRs such as Lightning Step, which is built for addiction treatment and behavioral health programs, and AdvancedMD. We don't replace or resell your EHR. Our job is everything around it: the computers and accounts people use to reach it, the network it runs over, the scanners that feed it, and the email and files that sit beside it.
What's different about behavioral health
- Clinicians work from more than one place. Telehealth sessions from a home office are normal. That means laptops outside your building, home internet you don't control, and a real need for each device to be secured and kept up to date.
- Some records carry extra protection. HIPAA gives psychotherapy notes stronger protection than the rest of the chart. Programs that provide substance use disorder treatment are also covered by 42 CFR Part 2, which limits how those records can be shared, with updated rules in effect since February 2026. Your consent and disclosure policies are clinical and legal decisions; we make sure the IT side, such as who can open which folder or mailbox, matches them.
- Paper still comes in. Intake forms, insurance cards, IDs, releases of information and records from other providers arrive on paper or fax and have to be scanned into the chart.
- Shared spaces. Front desk computers in view of a waiting room, and staff sharing workstations between shifts, make screen privacy and individual sign-ins matter more.
What we set up and support
- Document scanners that land files in the right place. We set up scanners and scan workflows so intake paperwork goes where your staff expects, instead of piling up in a shared inbox or a desktop folder.
- Shared network drives with sensible permissions. Clinical, billing and admin folders are organized so each role sees what it needs. Anything holding substance use disorder or psychotherapy material is kept to the people allowed to see it.
- File access from wherever clinicians work. Secure access to the files people need, in the office or at home, without emailing documents to personal accounts.
- Mailbox configuration. Individual and shared mailboxes for intake and referrals, set up so the right people see them, plus encrypted email for when patient information has to leave the building.
- Networking. A practice network with staff and guest Wi-Fi kept separate, so a client in the waiting room isn't on the same network as your EHR workstations.
- The basics done properly. Multi-factor authentication, prompt removal of access when someone leaves, and backups that are tested.
Compliance-aware, not compliance theater
We give practical, compliance-aware guidance on the technical safeguards HIPAA expects, and on how Part 2 affects who can reach which records. We don't certify your practice or promise an audit outcome. Compliance stays your practice's responsibility, and our compliance consulting helps you document the IT side so it holds up when someone asks.
Who this is for
Solo and group therapy practices, counseling centers, and outpatient and residential addiction treatment programs in Lexington and the surrounding Central Kentucky towns we serve. If your current IT is a relative, a vendor's support line or nobody at all, an assessment is a good place to start.
See how we handle security and compliance in the Mash IT trust center.
Common questions
We support practices that run them. The EHR vendor supports the software itself; we handle the computers, network, scanners, accounts, email and files around it, and we work with the vendor when a problem sits between the two.
It applies to federally assisted programs that provide substance use disorder diagnosis, treatment or referral. That's a legal question for your practice and counsel. If it does apply, we set up file and mailbox access so Part 2 records reach only the people allowed to see them.
Yes. We secure the laptops they use, require multi-factor sign-in, and give them access to the files they need without saving client documents to personal devices or accounts.
Yes. We set up the scanners and the scan destinations so intake forms, insurance cards and outside records land in a predictable place for your staff to attach to the chart.