Consent, the Notice of Privacy Practices, and the Good Faith Estimate — a plain-English tour of what a self-pay practice has to create, deliver, and keep. Not legal advice; a map so you know what to go verify.
Published August 2026 · Written by Perry Emerick, LPC · 7 min read
Going insurance-free removes a mountain of billing complexity, and that's a real gift. But it doesn't remove your documentation obligations — it just changes which ones apply, and a couple of the remaining ones are exactly the pieces solo clinicians tend to overlook because no billing system nags them about it. This is a practitioner's overview of the three that come up most: informed consent, the Notice of Privacy Practices, and the Good Faith Estimate.
One honest caveat up front, because precision is a trust issue in this field: I'm a licensed counselor, not an attorney, and the specifics vary by state, license board, and situation. Treat what follows as a map of the territory, not a substitute for confirming the details with your board and, where it matters, a healthcare attorney.
Informed consent is the foundation, and it's more than a signature you collect once. It's the document — and the conversation behind it — that establishes what services you provide, the risks and benefits, your policies on fees, cancellations, and communication, the limits of confidentiality, and how someone ends services. For a cash-pay practice, this is also where you set expectations about payment plainly, since there's no insurer in the middle.
Practically, you create a consent document, review it with the client, obtain their agreement (typically a signature), and retain it. Many boards expect this before or at the first session. The content that belongs in it is genuinely yours to get right for your modality and state — the takeaway here is simply that it exists, it's specific to your practice, and the signed version becomes part of the record you keep.
If you're a HIPAA covered entity, you must maintain a Notice of Privacy Practices (NPP) — the document that tells clients how their protected health information may be used and disclosed, and what rights they have over it. You provide it at the first service encounter and make it available on request (and posted, if you have a physical office or a website).
Here's the piece that trips people up. Under the HIPAA Privacy Rule (45 CFR §164.520), you're required to make a good-faith effort to obtain a written acknowledgment that the client received the Notice — not to get them to "sign" or consent to it. The acknowledgment documents delivery; it is not the client agreeing to your privacy practices, and treatment isn't conditioned on it.
That distinction matters for how you build the record. What you retain is proof the Notice was provided and that you sought acknowledgment of receipt. If a client declines to acknowledge, you document your good-faith effort and the reason it wasn't obtained. It's a receipt, not a contract.
Getting the mechanism right — acknowledgment of receipt versus signed agreement — keeps this small obligation from quietly becoming a compliance gap in an audit.
This is the newest of the three and the one most likely to be missed. Under the federal No Surprises Act, providers must give uninsured and self-pay clients a Good Faith Estimate (GFE) of expected charges for services. For a cash-pay therapy practice, that's most of your caseload — which makes the GFE a routine part of onboarding, not an edge case.
In broad strokes, the estimate is provided in writing when services are scheduled or on request, covers the expected cost of care (for ongoing therapy, that generally means an estimate reflecting the anticipated course or a defined period), and gets refreshed when things change. There are notice and timing specifics worth confirming against current federal guidance, because this rule is relatively young and the details are exactly the kind that get updated.
The GFE is a good example of why documentation-first thinking pays off: it's an obligation that produces a document you must create, deliver, and retain — with no billing platform reminding you to do it.
Notice the shared shape across all three obligations. Each one is a document you must create for the client, deliver to them in a specific way, and retain as proof you did. A cash-pay practice lives or dies on doing that consistently, by hand, without a big system prompting you — which is precisely where a documentation-first habit earns its keep.
That habit is the philosophy behind Practice Pad. Today, the app's job is the clinical record itself: it captures your handwritten session notes, converts them to text on-device, and keeps them organized and retained in a place you own — so the documentation half of your practice is dependable and yours. It does not currently generate consent forms, Notices of Privacy Practices, or Good Faith Estimates for you; those practice-level documents remain yours to create and deliver, ideally from templates a HIPAA consultant or attorney has helped you build.
What Practice Pad brings to this picture is the conviction that your records should be thorough, well-organized, and owned by you rather than trapped in a platform — and a product built to make the day-to-day documentation you're responsible for something you can actually keep up with.
Practice Pad captures your session notes and keeps your clinical records organized and yours — the dependable documentation half of a cash-pay practice.
iPad app · On-device encryption · US & Canada
Where these documents live and how to protect them — compliance is behavior, not a checkbox.
Keep your EHRFor self-pay clinicians on a lightweight EHR who just want the note-taking to stop hurting.
Part of our series on running a HIPAA-aware practice on Google Workspace. Start with the pillar guide: Google Workspace as a Therapy EHR — and the missing piece.