Security and privacy are foundational at Headway. We adhere to industry best practices across our platform and maintain SOC 2 Type II and HIPAA compliance. These safeguards ensure your information remains secure without compromising performance or reliability.

We do not sell your data. Data uploaded to our electronic health record product is not shared, unless required or legally permitted under HIPAA.

*SOC 2 stands for Service Organization Control 2 and is a security framework that defines how companies should manage, process, and store customer data.

Headway limits requests, use, and disclosure of protected health information (PHI) to what is minimally necessary to accomplish the intended purpose of the appropriate request, use, or disclosure. An example of this is if a chart review is required for the purposes of processing insurance or ensuring compliance. 

To ensure seamless operations, access is limited to authorized individuals at Headway in accordance with HIPAA regulations. Our team may access data for various healthcare treatment, payment or operations purposes such as to facilitate insurance claims, respond to insurer audits for clinical quality, or comply with legal requests like subpoenas.

All access is also governed by the "minimum necessary" standard, and we maintain audit logs consistent with HIPAA requirements. An example of this is if a chart review is required for the purposes of processing insurance or ensuring compliance. In addition, Headway team members receive specialized training on HIPAA, the importance of PHI safety, and the “minimum necessary” rule.

If you have further questions or suspect any misuse, please contact us.

Headway will only share PHI (protected health information) to individuals or organizations outside of Headway for reasons allowed or required by law, including HIPAA, such as for treatment, payment, or healthcare operations. Headway will not share, sell or otherwise distribute documentation without prior authorization or consent. . As part of Headway’s mission to create a mental healthcare system everyone can access, we are trusted with individuals’ most sensitive information. We take this very seriously.

The 90837 CPT code is often understood to be the standard of a therapy session among providers. Generally speaking, it’s a code used to bill for an hour-long session of psychotherapy (i.e. talk therapy). However, insurers have a tendency to flag 90837 more frequently than other codes. This can result in payment delays, requests for clinical documentation to support the use of the 90837, and other confusion for what seems like a typical billing selection. As a reminder, please ensure that diagnosis codes are documented at the highest level of specificity, and avoid unspecified codes when a more precise option is available.

Read our full article on using 90837.

Providers use CPT codes when confirming sessions in our system. These codes correspond with things like the type of care provided (i.e., psychotherapy) and the length of time for the session.

E/M (Evaluation and Management) codes are a specific range of CPT codes used primarily by a certain kind of provider—typically physicians, psychiatrists, and nurse practitioners—who evaluate and manage a client’s health.

Read our full article on E/M codes with add-ons.

Navigating insurance compliance doesn’t have to be overwhelming. Headway makes it easy and ensures you’re never navigating it alone. With audit-ready documentation and compliance resources, Headway provides compliance support you can rely on. 

Learn more about Headway’s HIPAA compliant software.