Module 6 · Check it

Compliance: the rules, the notices, and the re-check calendar

This is the one lesson in the course that states rules. Every earlier lesson pointed here. It is long because it is your reference: read it once through, then come back to the sections your practice needs. By the end you will have the guardrail block in your kit’s CLAUDE.md, a compliance check run on your site, a compliance-log.md with today’s date, a dated archive of every page, and the dates to check again.

Three sets of rules, stacked

A lawyer’s website mostly answers to one rulebook. Yours answers to three, and one can forbid what another allows.

That last point has teeth. Illinois adopts the 2017 APA Ethics Code by reference for psychologists, and Texas writes the ban on soliciting testimonials directly into its psychology rules. In those states an ethics breach is also a licensing matter.

You own every word, including the words an AI wrote

APA Standard 5.02(a) says psychologists “retain professional responsibility” for promotional statements they have others create; the ACA and NASW codes require your public representations to be accurate. Either way, copy an AI wrote for your site is your statement.

APA Standard 5.01(a) lists “directory listings” and “comments for use in media such as print or electronic transmission” among public statements, so your website and your directory profile both count.

Is HIPAA even on for you?

HIPAA is the federal health-privacy law. It does not apply to every therapist. It applies to a “covered entity”, and for a clinician the definition turns on billing:

In plain words: if you, or a billing service working for you, send insurance claims or check benefits electronically, you are a covered entity. A strictly private-pay clinician who never sends an electronic claim, and hands clients a superbill to submit themselves, may genuinely not be. Your kickoff question about electronic claims in Module 1 exists for this reason.

Why this course builds as though HIPAA applies anyway

• The day you send your first electronic claim, HIPAA attaches.
• State privacy laws apply whether or not HIPAA does, and some are stricter.
• Your ethics code carries confidentiality duties of its own.
• The FTC acts against health businesses that break their privacy promises, HIPAA or not. The cases are in the tracking section below.

A stranger’s contact form can hold protected information

The federal definition of individually identifiable health information includes “demographic information collected from an individual” that relates to a person’s mental health or care and could identify them. Nothing in it requires an existing client relationship. A stranger who types “I’ve been having panic attacks” into your form, with a name and email address, has just given your practice exactly that. This is why the Module 5 form asks only logistics.

Tracking pixels and analytics

A tracking pixel is a small piece of code from an advertising or analytics company that reports what visitors do on your pages. Every generic website playbook installs one in step one. On a therapy site it is the most likely way to get into trouble.

HHS’s Office for Civil Rights published guidance on this, usually called the tracking Bulletin. Its own example is almost exactly a therapy contact page: a tracking tool that collects someone’s email address or reason for seeking care as they make an appointment, which HHS says is a disclosure of protected information to the vendor. If HIPAA applies to you, these three sentences from the Bulletin are the ones to remember:

Two more sentences from the same page: "A tracking technology vendor is a business associate if it meets the definition of a business associate, regardless of whether the required BAA is in place." And: "Therefore, OCR is prioritizing compliance with the HIPAA Security Rule in investigations into the use of online tracking technologies."

What the court case did, and did not, change

HHS issued the original Bulletin in December 2022 and a revised one on 18 March 2024. On 20 June 2024, a federal court in Texas, in American Hospital Association v. Becerra, vacated one proposition in it: that HIPAA is triggered simply when an online tool connects a visitor’s IP address with a visit to a public webpage about health conditions or providers. HHS’s appeal was dismissed on 4 September 2024, on HHS’s own motion. The rest of the Bulletin is still on HHS’s website, still marked “Content last reviewed June 26, 2024”, and still says HHS "is evaluating its next steps in light of that order."

So a headline saying the pixel guidance was “thrown out” is wrong. One narrow proposition went. The three sentences above did not.

Google Analytics, in Google’s own words

"Google makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service." Google also says HIPAA-regulated customers "may only use Google Analytics on pages that are not HIPAA-covered." This course’s default is simpler: no Google Analytics, no advertising pixel, no session recording and no chat widget anywhere on the site. Module 5 covers the privacy-first alternatives if you want visitor counts.

The three FTC cases worth knowing

None of these is about a small practice. Each shows that what a website promises about privacy is an advertising claim, and that tracking code can make the promise false without anyone intending it.

You will also see reports of private lawsuits against hospitals and health systems over tracking pixels. This research could not confirm individual cases or amounts from court records, so none are named here.

The contact form and the inbox

Once a form has a box asking what brings someone in, every script on that page is in a position to read what they type, often before they press Send. HHS’s Bulletin names “session replay scripts” among the tracking technologies it means. That is the whole reason the Module 5 form asks only logistics and the site runs no scripts.

Business associates and BAAs

A business associate is a vendor that creates, receives, keeps or sends protected health information for a covered practice. A business associate agreement (BAA) is the contract where that vendor promises to protect it. Two things surprise people. A vendor that meets the definition is a business associate whether or not you signed anything. And a signed BAA does not make an otherwise-impermissible disclosure allowed: HHS says "signing an agreement containing the elements of a BAA does not make a tracking technology vendor a business associate if the tracking technology vendor does not meet the business associate definition." A BAA is necessary where it applies. It is never sufficient on its own.

• Does this tool ever receive anything a visitor types, or anything tied to a named person who contacted a therapy practice? If yes, it needs a BAA before it goes near the site, and the vendor must actually offer one on your plan.
• Where do form notifications land? The notification email is the most common leak. Module 5’s Stack A keeps clinical content out of it entirely.
• Does anything on a page with the form load a script from another company? If you can’t name what it does and why it needs to be there, remove it.
• Is anything asking a real client for information? Nothing on this site should.

Email is not banned

HHS’s own FAQ says: "The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so." If a client emails first, the provider "can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable to the individual." Warning them about the risks is something you can do, not a precondition. What the FAQ does not bless is a website that funnels health details into a plain inbox by design.

One more line that belongs here: if HIPAA applies to you, using a client’s information for marketing needs their written authorization under 45 CFR § 164.508(a)(3). Never add a client to a newsletter list because they are a client.

Testimonials and reviews

This is the sharpest break from every other profession. Read the verb in each code: the act they restrict is soliciting. The codes differ on who you may not ask, and the differences matter.

Marriage and family therapists: this research could not read the AAMFT Code of Ethics, which sits behind a member login. This lesson does not say what it requires. Read your own association’s code.

State rules on top of the codes

• Texas psychologists: the state’s psychology rules say "Licensees do not solicit testimonials from current clients or patients or from other persons who are vulnerable to undue influence."
• New York: a testimonial needs the client’s express written authorization, and fictional client testimonials are not permitted. That state rule does not override your ethics code, which still stops you asking.

Reviews that already exist

In 2023 HHS settled with Manasa Health Center, a New Jersey psychiatric practice, which it said "impermissibly disclosed the protected health information of a patient when the entity posted a response to the patient's negative online review." The investigation covered replies to Google reviews affecting four patients. The practice paid $30,000 and agreed to a corrective action plan. It did not lose a laptop. It replied to reviews, which is what every generic marketing guide tells a business to do.

The practice guidance that follows, and that a counselor writing in ACA’s own magazine reached in 2015, is this: respond to reviews without confirming anyone is a client, or don’t respond. That is guidance drawn from the codes and the HHS case, not a rule any code spells out in those words. A warm reply to a five-star review confirms the relationship just as surely as a defensive reply to a one-star one. If you do reply, use one sentence that reads the same whether or not the person was ever your client.

Our practice takes all feedback seriously. Because of the confidentiality rules that govern mental-health care, we can't discuss whether anyone is or was a client, or respond to the details of any review. If you have a concern about our practice, please call us at [number].

What to check: treat that as a starting draft. Read it against your own code and, if you are unsure, ask your association’s ethics consultation service before you post it anywhere.

The FTC’s rule on reviews applies to every business

Separately from your code, the Federal Trade Commission’s Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, took effect on 21 October 2024. Your code restricts asking. The FTC rule restricts deceiving.

The maximum civil penalty is $53,088 per violation, the amount in force since 17 January 2025 and still the figure on 12 September 2026. It is normally adjusted each January. A penalty requires that the business acted with actual knowledge, or knowledge fairly implied from the circumstances.

The FTC’s Endorsement Guides (16 CFR Part 255) are a different kind of document: they call themselves "administrative interpretations" that "provide the basis for voluntary compliance with the law". Breaking them is not automatically a violation, but they show how the FTC reads deception. Three lines from them matter here. "Consumer endorsements themselves are not competent and reliable scientific evidence." A disclaimer next to a testimonial works only if it changes the overall impression: "To be effective, such disclosure must alter the net impression of the advertisement so that it is not misleading." And "Material connections can include a business, family, or personal relationship."

So “results may vary” under a glowing quote fixes nothing. In the FTC’s own worked example, a fine-print disclaimer under a true weight-loss testimonial failed: "The vague disclosure doesn't adequately convey to consumers that their weight loss is likely to be much less."

Is the FTC enforcing this? No Part 465 case against a mental-health practice was found through September 2026. The FTC did send warning letters to 10 companies under the rule on 22 December 2025, and on 3 December 2025 approved a final order against a weight-loss telehealth company over fake testimonials and distorted reviews.

What to build instead

• An About page in your own voice, specific about who you work with and what an hour is like.
• A short video introduction, so people can see and hear you.
• Your credentials and training, stated accurately.
• Endorsements from colleagues or referral sources, with the relationship stated beside them. A Counseling Today article (2015) suggests this route; it is one practitioner’s commentary, not the Code.
• An honest FAQ: fees, insurance, session length, what a first session is actually like.

Claims: what your copy may say about you

Most problem copy is not a lie. It is a true statement shaped to imply something bigger. Search your site for each row.

Titles and licenses: six states, six answers

“Put your license number on your website” is a California rule, not a national one. The six states below were read at primary sources for this course. They show how far apart states sit. They are not a substitute for reading your own board’s rules, and the other 44 states were not read: call your board.

Telehealth: where the client is sitting

HHS’s telehealth site puts the rule in one sentence: "Health professionals must meet the licensure requirements of the state where they are located and be licensed or legally permitted to practice in the state where the patient is located." “Legally permitted” is what leaves room for compacts. The practical consequence: a regular client on vacation in another state is a licensure question that day.

PSYPACT — psychologists only

PSYPACT lets a psychologist with a full license based on a doctoral degree, in a participating state, apply for an Authority to Practice Interjurisdictional Telepsychology (APIT). It is an authorization, not a license. The home state rule is strict: "you must ALWAYS be physically located in this state while providing telepsychology using your PSYPACT authorization." Counselors, social workers and MFTs are not eligible.

The participating list changes, so this lesson prints no count. Alaska becomes effective on 20 September 2026. As of September 2026, Iowa and Louisiana had passed the compact but do not become effective until 1 July 2027 and 1 January 2028, and California and New York were not participating. Check the current map at psypact.gov and look up any psychologist at verifypsypact.org.

The Counseling Compact

Privileges have been issuing since 30 September 2025. As of 12 September 2026 the compact’s homepage said it was live for licensees in Arkansas, Arizona, Georgia, Indiana, Louisiana, Minnesota, Ohio, Tennessee and Wyoming, with Pennsylvania joining “later this year”. A counselor benefits only if their home state is live, and can then reach only other live states. LMFTs, LCSWs and pre-licensed counselors are not eligible. Use the homepage: the compact’s own map and FAQ pages have lagged behind it. Look up privileges at app.compactconnect.org/Search.

And the compact answers the advertising question itself: "The Counseling Compact does not regulate advertising in the member states. Privilege holders should review the applicable law in each state to ensure their compliance with state law and regulation". Holding a privilege does not settle what you may advertise there.

Social workers and MFTs

The Social Work Licensure Compact had passed in 35 states as of July 2026, and multistate licenses were not yet being issued as of 12 September 2026. No social worker can claim compact-based multistate practice today. This research found no operational licensure compact for marriage and family therapists as of September 2026; check with your board before assuming one exists.

How to say where you can work

Where I can work
I am licensed in [State]. I can also see clients located in [State], [State] and [State] through [PSYPACT / the Counseling Compact].
You'll need to be physically located in one of these states at the time of our session. If you'll be traveling, please tell me beforehand so we can plan.
Last updated [Month Year].

What to check: check every state against your own license and any authorization actually granted to you, not one you have applied for, and set the date to this month.

The notices, and where each one goes

Your practice-profile.md flags decide which of these your site needs. The table gives the trigger. If a flag says “unsure”, keep the page planned and confirm with your billing adviser or a healthcare lawyer.

Good Faith Estimate

Under the No Surprises Act, you must tell uninsured and self-pay clients that a good faith estimate of expected charges is available. On the website the information must be "prominently displayed (and easily searchable from a public search engine) on the convening provider's or convening facility's website" (45 CFR § 149.610(b)(1)(iii)(A)), in force since 1 January 2022. “Easily searchable” is why the notice goes on the page as real text, never only in a PDF.

Self-pay includes a client who has insurance but "does not seek to have a claim for such item or service submitted to such plan or coverage" (§ 149.610(a)(2)(xiii)(B)). So an out-of-network practice is not exempt. And a cost question is a request: you "shall consider any discussion or inquiry regarding the potential costs of items or services under consideration as a request for a good faith estimate" (§ 149.610(b)(1)(iv)). A “how much do you charge?” message through your form starts the clock.

• Timing: scheduled at least 3 business days ahead, the estimate is due within 1 business day of scheduling; scheduled at least 10 business days ahead, within 3 business days; requested but not scheduled, within 3 business days of the request.
• Ongoing therapy: one estimate can cover recurring sessions, and it must not cover more than 12 months.
• In writing: on paper or electronically, in a form the client can save and print. Saying a number on the phone is not enough.
• Record: the estimate becomes part of the client’s record, kept for 6 years.

CMS publishes a model notice, and "HHS considers use of the model notice to be good faith compliance with the good faith estimate requirements to inform an individual of their rights to receive such a notice." Its heading reads "You have the right to receive a 'Good Faith Estimate' explaining how much your health care will cost". Paste the model text into your fees page unchanged; Module 5 showed where. The requirements that involve a client’s insurer (estimates sent to the plan, the Advanced Explanation of Benefits) were still not being enforced as of September 2026.

Notice of Privacy Practices

If you are a covered entity: "A covered entity that maintains a web site that provides information about the covered entity's customer services or benefits must prominently post its notice on the web site and make the notice available electronically through the web site." The notice must carry this header, word for word, and no AI tool may reword it:

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

What to check: check your notice’s header against this one character by character: all capitals, both sentences, nothing added or softened.

Section 1557: nondiscrimination and language assistance

If your practice receives federal financial assistance from HHS, two notices must appear "At a conspicuous location on the covered entity's health program or activity website, if it has one": a notice of nondiscrimination (45 CFR § 92.10) and a notice that language assistance and auxiliary aids are available (§ 92.11). The language notice is given in English and at least the 15 languages most commonly spoken by people with limited English proficiency in your state or states. It also belongs in your Notice of Privacy Practices, your intake forms and your good faith estimates. The compliance dates passed in November 2024 and July 2025.

Who is covered: in its 2024 rule, HHS concluded that Medicare Part B payments count as federal financial assistance, and counselors and MFTs can now bill Part B. Medicaid is the clearer case. A purely private-pay practice with no HHS funding is not covered on that reading. HHS stated this in a rule preamble, which can change, so date anything you rely on. There is no small-practice exemption for the notices: practices under 15 employees skip only the coordinator and the written grievance procedure. A court in October 2025 vacated the rule’s gender-identity provisions; HHS says "The other provisions of the Section 1557 Rule remain in force." Read §§ 92.10 and 92.11 on ecfr.gov. HHS’s older FAQ page for this rule no longer loads.

Section 504: a web accessibility deadline

HHS’s Section 504 rule requires recipients of its federal financial assistance to make web content meet WCAG 2.1 levels A and AA: beginning 11 May 2027 for practices with 15 or more employees, and 10 May 2028 for fewer than 15 (45 CFR § 84.84). Those are already extended dates, moved back a year by an interim rule in May 2026; any source dated before then shows the old ones. The comment period closed on 6 July 2026, so a further change is possible. The trigger is the same federal-funding question as Section 1557. This lesson gives the trigger; it cannot tell you whether you are a recipient.

Counselors have an ethical duty regardless of funding. 2014 ACA Code H.5.d: "Counselors who maintain websites provide accessibility to persons with disabilities. They provide translation capabilities for clients who have a different primary language, when feasible." Translation is expected only when feasible. The audit you just finished is most of the work.

Washington’s My Health My Data Act

Washington’s law covers “consumer health data”, which includes information that identifies a person’s mental health status, even when HIPAA doesn’t apply to it. A covered business must publish a consumer health data privacy policy and "prominently publish a link to its consumer health data privacy policy on its homepage." It also requires consent before collecting or sharing that data. Being a small business is not an exemption.

There are two gates, and both must be met. The person must be a Washington consumer: "a natural person who is a Washington resident; or (b) a natural person whose consumer health data is collected in Washington." And your practice must be a regulated entity: one that "Conducts business in Washington, or produces or provides products or services that are targeted to consumers in Washington". A practice that neither does business in Washington nor targets Washington is not caught just because a Washington resident reads its site. A practice that sees clients located in Washington, or advertises there, should assume it applies.

A violation is treated as an unfair or deceptive act under Washington’s Consumer Protection Act, which lets an injured person sue. The court may increase damages up to three times, but for this kind of claim the increase "may not exceed twenty-five thousand dollars", and the person must be injured "in his or her business or property". Nevada has a similar consumer-health-data law (effective 31 March 2024) that requires a privacy policy but expressly creates no private right of action.

Part 2: if you advertise addiction treatment

The federal addiction-records rule, 42 CFR Part 2, is stricter than HIPAA and reaches a narrower group. Two conditions must both be true. First, you are a “program”: a person who "holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment". The rule names "private practitioners who hold themselves out as providing, and provide" those services. Second, you are federally assisted, which includes being a Medicare participating provider, holding a DEA registration used in that treatment, receiving federal financial assistance in any form, or being tax-exempt.

“Holds itself out” is a marketing test, and the rule tells investigators to check "a provider's publicly available website". For a Part 2 program, a person who submits your contact form has "applied for" treatment, so they are a patient and their message, including emails, voicemails and texts, is a protected record from the moment it arrives. A Part 2 program with a website "must prominently post its notice on the website and make the notice available electronically through the website" (§ 2.22(c)(3)(i)). The 2024 rule’s compliance date, 16 February 2026, has passed. Part 2 also restricts disclosing that someone is or was a patient, so a success story that identifies a real person is out. Violations now carry civil money penalties, not only criminal ones. If you think Part 2 may apply to you, talk to a healthcare lawyer before you publish.

Counselors: link to your boards

2014 ACA Code H.5.b: "Counselors who offer distance counseling services and/or maintain a professional website provide electronic links to relevant licensure and professional certification boards to protect consumer and client rights and address ethical concerns." And H.5.c: "Counselors regularly ensure that electronic links are working and are professionally appropriate." That is a footer item and a quarterly check. It is the ACA Code, not state law: it binds ACA members and counselors whose boards adopt the Code.

Florida: the free-consultation statement

If your practice is in Florida and advertises a free, discounted or reduced-fee service, such as a free 15-minute call, Fla. Stat. § 456.062 requires this statement "in capital letters clearly distinguishable from the rest of the text":

THE PATIENT AND ANY OTHER PERSON RESPONSIBLE FOR PAYMENT HAS A RIGHT TO REFUSE TO PAY, CANCEL PAYMENT, OR BE REIMBURSED FOR PAYMENT FOR ANY OTHER SERVICE, EXAMINATION, OR TREATMENT THAT IS PERFORMED AS A RESULT OF AND WITHIN 72 HOURS OF RESPONDING TO THE ADVERTISEMENT FOR THE FREE, DISCOUNTED FEE, OR REDUCED FEE SERVICE, EXAMINATION, OR TREATMENT.

What to check: check that the statement is in capitals, unchanged, and sits beside the offer itself rather than on a separate page.

The crisis block

No general law or ethics code was found that requires crisis resources on a public practice website. The duties that exist sit in informed consent: the 2014 ACA Code, for example, lists “emergency procedures to follow when the counselor is not available” among what distance-counseling informed consent covers. APA revised its telepsychology guidelines in August 2024; check that text yourself rather than relying on quotes from the 2013 version. Publish the crisis block anyway. It costs nothing, and someone in distress will land on your site at 2 a.m.

AI on your site and in your practice

The principle, which holds in every state: never let site copy, or any tool on the site, say or imply that an AI provides therapy or that an AI’s output comes from a licensed person. This course ships no chatbot. A wave of state laws now puts that principle into statute, and the list is growing.

Utah regulated mental-health chatbots from 7 May 2025 without banning them. New York had no therapy-specific AI rule found. Florida, Washington, Oregon, New Jersey, Pennsylvania and Massachusetts were not checked before the research budget ran out, so an absence there proves nothing.

AI note-takers: a practice rule, not a website rule

If you ever use an AI tool that records or transcribes sessions, get written consent first in Illinois, Colorado and Maine, and from 1 January 2027 disclose it on Arizona counselors’, social workers’ and MFTs’ consent forms. That is about your practice, not your website, and nothing in this course asks you to use one.

If you prescribe

The DEA’s temporary flexibilities for prescribing controlled medications by telemedicine run through 31 December 2026, and the permanent rule had not been published as of 12 September 2026. Do not hard-code a promise such as prescribing a controlled medication entirely online. Put your medication rules on a dated /medication-policies page that says federal telehealth prescribing rules change at the end of 2026.

Run the check

The Build Kit’s compliance-check skill carries the rules in this lesson as a checklist Claude runs against your site. It has two parts: a guardrail block that prevents problems before copy is written, and a check that finds what got through.

1. The guardrail block

Your kit’s CLAUDE.md has a section 8 called “Guardrail block”, and the block comes already in place. Stage 1 should already have filled in its MY FACTS list from your profile. Open the file and check. If the block is missing, paste this block into section 8, fill in the facts from practice-profile.md, and keep it there for every session that writes words for the site.

CONTEXT AND HARD CONSTRAINTS — READ BEFORE WRITING ANYTHING

I am a mental-health clinician and you are writing content for my practice's website.
Everything you write is a public statement about me and my services. My licensing board,
my ethics code and federal law all apply to it, and I am responsible for every word.
Treat these as absolute constraints, not preferences.

No client information ever goes into this conversation. If you need an example, make one
up and label it made up.

MY FACTS (from practice-profile.md — use only these; do not add, embellish or infer):
- Name as my board lists it:
- License type, full title and letters:
- License stage (fully licensed / pre-licensed), and my exact title if pre-licensed:
- Supervisor name and credential (pre-licensed only):
- States I am licensed in, with license numbers:
- PSYPACT or Counseling Compact authorization actually granted (or "none"):
- Ethics code I follow:
- Highest earned degree, its field, and the school:
- Certifications I actually hold, with the full name of each certifying board (or "none"):
- Office city and state, and the states where online clients may be located:
- Fee, payment options, and in-network plans today:

NEVER WRITE:
1. Any testimonial, review, client quote, client story, case example or star rating,
   real or invented. If a layout calls for one, remove that section.
2. Any promise or prediction of results: no "cure," "fix," "eliminate," "guaranteed,"
   "you will feel," "fast relief."
3. "Specialist," "expert," "leading," "best," or any title I did not give you.
   Describe what most of my work is instead.
4. "Board certified" or any certification unless I gave you the full name of the
   certifying board, and then write that full name beside it.
5. "Licensed" for anyone who is pre-licensed; "Dr." unless I told you my doctorate is
   in my clinical field; "ABD" ever.
6. Any number I did not give you: years in practice, clients seen, success rates,
   reimbursement amounts or percentages.
7. Any state count or reach: no "nationwide," "anywhere," "all 50 states," "all PSYPACT
   states." Name only the states above, say "located," and add a "Last updated" date.
8. "HIPAA compliant," "100% confidential," or any other privacy promise I have not
   confirmed.
9. "We accept insurance" if I am out-of-network, "we'll get you reimbursed," "as low
   as," or "and up."
10. Anything that says or implies an AI provides or delivers therapy. No chatbot.
11. Any crisis option other than the crisis block in the copywriting skill, and nothing
    that suggests I respond to emergencies.
12. Any contact form field asking why someone wants help, symptoms, diagnosis,
    medications, history, date of birth or insurance member ID.
13. Any analytics, advertising pixel, session recording, heatmap or chat script, or a
    cookie banner presented as permission for one.
14. Any change to the wording of the Notice of Privacy Practices header, the CMS Good
    Faith Estimate model notice, the Florida free-service statement or the crisis block.

ALWAYS DO:
- Write in the first person. Describe what I do and what clients commonly experience,
  never what the reader will get.
- Put [VERIFY] beside anything about me you are not certain of.
- Put my license line in the footer and on the About page.
- Put TODO-COMPLIANCE wherever practice-profile.md marks a flag "confirm" or "unsure."

BEFORE YOU FINISH:
List every claim about me you made that I have not confirmed in this conversation. If
that list is not empty, fix it.

What to check: read the block after pasting it and check the facts against your own records, not against memory. The block is deliberately stricter than some of the rules in this lesson. If your board clearly allows something it forbids, loosen it on purpose and write down why.

2. The check itself

Run the compliance-check skill against my finished site. This is the closing step of
Stage 5. Read practice-profile.md first and use its flags.

Go page by page through the running site in the preview and report, in plain sentences:
1. Every phrase that breaks the guardrail block's NEVER WRITE list, quoted, with its
   page and a suggested replacement.
2. Every testimonial, review, star, rating or client story, and any Review or
   AggregateRating structured data.
3. Every credential, title, degree, certification and number, so I can check each one
   against my own records.
4. Every place the site says where I work or where clients can be located, compared
   with practice-profile.md.
5. Which notices my flags require, whether each one is present, where it sits, and
   whether its fixed wording is unchanged.
6. Every third-party script, pixel, tag, iframe and cookie banner on every page.
7. The contact form's fields and helper text, compared with the field list in the
   frontend-design skill.
8. The crisis block on every page, and anything that covers it at phone width.
9. Anything that is a question for my licensing board, my association's ethics
   consultation service or a healthcare lawyer rather than for you.

Report first and change nothing until I say so. Be explicit about what you cannot check.
After I approve the fixes, write compliance-log.md with today's date, each finding, what
was done, and anything still open.

What to check: read the report line by line. For item 3, check every number and credential against your license and your own records. For item 5, compare any fixed wording against this lesson, character by character. A clean report means the predictable problems are gone. It does not mean anyone has cleared your site.

3. Date everything that goes stale

Read every page of my site without changing anything. List each place it states a fee,
an opening or availability, a state, a license or credential, a phone number, or a link
to a licensing board or verification site. For each, give the page, the exact words, and
the "Last updated" date shown near it. Flag anything with no date and anything older than
90 days.

What to check: check that Claude changed nothing, then fix each flagged item yourself or ask for the fix separately. Every date on the list should be one you can defend today.

4. Save a dated archive

New York requires an exact copy of each advertisement to be kept for one year after it last appears. Everyone else benefits too: an archive is the only way to show later what your site said on a given day.

1. Ask Claude to save a snapshot of the site as it stands.
2. Open each page in your browser and use Print → Save as PDF: home, about, fees, contact, every specialty page, every notice page, and each team bio.
3. Put the PDFs in one folder named with today’s date first, in the format 2026-09-12-site-archive, so the folders sort themselves.
4. Keep a copy somewhere other than the laptop you built on.
5. Repeat whenever the site changes, and at least once a quarter.

The re-check calendar

Several things in this lesson have a date on them. Put these in your calendar now.

1. 20 Sept 2026

   PSYPACT: Alaska becomes effective

   Re-read the map at psypact.gov if you are a psychologist.
2. Fall 2026

   ACA Code of Ethics revision

   Counselors: check counseling.org for the adopted code, and confirm C.3.b's number and wording.
3. 31 Dec 2026

   DEA telemedicine prescribing flexibilities end

   Prescribers: check whether they were extended and update your medication-policies page.
4. Every January

   FTC civil penalty figure

   It is normally adjusted each year.
5. 1 Jan 2027

   Arizona AI consent-form rule; Illinois psychology and MFT acts scheduled for sunset

   Check the new text if you practice there.
6. 11 May 2027

   Section 504 web accessibility, practices with 15+ employees

   If you receive HHS federal financial assistance. Check first for any further extension.
7. 1 July 2027

   Idaho and Nebraska AI laws; Iowa joins PSYPACT

   Re-check the state AI list and the PSYPACT map.
8. Early 2028

   Louisiana joins PSYPACT (1 Jan); Illinois counseling and social work acts scheduled for sunset (1 Jan); Section 504 for practices under 15 employees (10 May)

   Re-check the PSYPACT map, the Illinois acts and the Section 504 dates.
9. 1 Sept 2029

   Colorado's Mental Health Practice Act scheduled for repeal

   Check the new text if you practice there. The last of the dated items in this lesson.

And before you publish, and again at every refresh, work through this list:

• ACA 2026 Code of Ethics — adoption was targeted for September 2026; confirm C.3.b’s number and wording.
• PSYPACT — Alaska effective 20 Sept 2026; re-read the map at psypact.gov.
• Section 504 web-accessibility dates — comments closed 6 July 2026; a further change is possible.
• DEA telemedicine flexibilities — end 31 Dec 2026 unless extended.
• Counseling Compact — live-state list on the homepage (the map and FAQ pages are stale).
• HIPAA Security Rule — still proposed; do not teach proposed requirements as law.
• State AI-in-therapy laws — seven states enacted laws between March and June 2026; more will follow.
• Every crisis number and 988 routing option — at the operator’s own page.
• FTC civil-penalty figure — adjusted each January.
• Directory prices — on the vendor’s page, shown on screen with “as of”.
• Claude plans and prices, Vercel labels, domain TLD list — on the vendor’s page.

And: the ACA quotations in this lesson are from the 2014 ACA Code, current as of 12 September 2026.

Watch this step

Four background videos, each with a limit to keep in mind. The testimonials episode deliberately stays away from the law and speaks to health professions in several countries, not to US mental-health codes; the agency behind it sells social media and ad management. The tracking-pixel clip is about hospitals, and the figures in its description were not checked for this course. The multi-state licensing video does not cover the Counseling Compact, which has been issuing privileges since September 2025, and it has a sponsor. The AI ethics episode runs 69 minutes and is sold as paid continuing education; check anything it says a code requires against the code's own text. It’s from an independent creator — credited below, so go give them a follow.

15:27

2:11

14:22

1:09:00