Liability fear vs liability fact: what protects you

Fear is not a risk model — here is what liability actually is

Most liability anxiety attaches to rare catastrophes while the real exposure is mundane: a consent the client never understood, a note written weeks late, care continued past your competence, a termination handled as abandonment. Liability is measured against the standard of care, and your professional record is the evidence of whether you met it. Spend your worry budget on the habits that build that record, not on the horror stories.

• The catastrophes you fear — a client suicide, a board complaint out of nowhere — are real but rare, and often survivable on a good record.
• The exposures that actually recur — sloppy consent, late notes, scope creep, a botched termination — are entirely within your control.

Entity choice is not clinical protection: the PLLC shield guards your personal assets from business debts, not from your own clinical negligence, which follows you regardless of structure.

Your ethics code is the standard you are measured against

The single most protective document you already have is your profession's ethics code, because a malpractice or board case is judged against it. The APA, NASW, and ACA codes each set the operative rules for informed consent, the limits of confidentiality, competence, and termination and abandonment 1Ref 1American Psychological Association (2017).Ethical Principles of Psychologists and Code of Conduct.That informed consent, the limits of confidentiality, competence, and termination and abandonment are the ethics-code standards psychologists are measured against.2Ref 2National Association of Social Workers (2021).NASW Code of Ethics.The same consent, confidentiality, and termination-of-services standards for social workers.3Ref 3American Counseling Association (2014).ACA Code of Ethics.The same consent, confidentiality, and termination-and-referral standards for counselors.. Read your own code's sections on these directly rather than a summary, and let its language shape your consent form, your notes, and how you end care.

Two clauses do outsized work. Informed consent that the client demonstrably understood — not a signature on an unread form — defeats a surprising share of complaints. And termination done right, with notice, referrals, and a documented reason, is the difference between firing a patient responsibly and an abandonment claim.

Documentation is the shield — write it like it will be read aloud

Contemporaneous, honest documentation protects you more than any single policy, because the record is what a reviewer actually sees. Note your clinical reasoning, not just what happened: why you chose this intervention, what risks you weighed, what you told the client and what they decided. When a session involves risk, record the assessment, the safety plan, and the resources you gave — including that you handed the client 988, the national crisis line, for use between visits 4Ref 4Substance Abuse and Mental Health Services Administration (2026).988 Suicide & Crisis Lifeline.That 988 is the national crisis line, documented in the safety plan and record as a between-visit resource..

If you are ever deposed, the deposition is only as good as the chart it rests on — you will testify from your notes, so write them for that reading.

The HIPAA record: your risk analysis is the load-bearing piece

A HIPAA breach is one of the most common ways a solo practice ends up in a government file, and the Security Rule's foundation is a documented risk analysis you are required to perform and keep current. ONC and OCR publish a free Security Risk Assessment tool sized for small practices, so the analysis is a completed worksheet, not a consultant's invoice 5Ref 5Office of the National Coordinator / ASTP (2026).Security Risk Assessment Tool.The free Security Risk Assessment tool a small practice uses to perform the risk analysis the Security Rule requires.. Do it, date it, and redo it when your setup changes.

The risk analysis is also what a regulator asks for first after an incident. Having a dated one on file — even an imperfect one — reads very differently than having none.

When something does go wrong: ransomware and breaches

If ePHI is encrypted by ransomware, HIPAA presumes a reportable breach unless a documented risk assessment shows a low probability that the information was compromised 6Ref 6HHS Office for Civil Rights (2016).FACT SHEET: Ransomware and HIPAA.That a ransomware encryption of ePHI is a presumed reportable breach absent a documented low-probability risk assessment.. That single rule reframes your backups and your incident notes as liability protection, not IT housekeeping. Keep offline backups you have actually tested, log your security decisions, and know before an incident who you would call and what your breach-notification clock looks like.

The practice that survives an incident well is the one that decided its response in advance, not the one that never had an incident.

The overlooked protections: consultation, coverage, and a professional will

Two protections solos skip are cheap and disproportionately effective. A standing consultation group turns lonely high-stakes calls into documented, defensible decisions, and the mere note that you consulted signals reasonable care. A professional will names who closes your practice and secures records if you are suddenly unavailable — an operations norm your professional body's practice resources describe, and one that protects clients and your estate alike 7Ref 7APA Services, Inc. (2026).Practice — APA Services.Practice-operations norms for closing a practice and professional wills, as a professional-body anchor.. Carry your own malpractice policy on top of both.

• The consultation group — a recurring peer group is the cheapest liability protection most solos never set up.
• Coverage for going away — arrange who covers your clients before a vacation or an emergency, and tell clients how to reach help in the gap.
• A professional will — name your custodian and where the records and passwords live.