What Makes a Superbill HIPAA-Compliant? (Free Checklist)

A HIPAA-compliant superbill is a detailed itemized receipt you give clients so they can seek reimbursement from their out-of-network insurer. To be compliant and actually processable, it must include your NPI, a valid ICD-10 diagnosis code, the correct CPT procedure code, date and place of service, and your practice’s tax ID — all tied to the specific client encounter. Miss any one of these and the claim will likely be denied.

The good news: the checklist is short, the fields are standardized, and once you have a solid template you can generate a compliant superbill in under two minutes per session.

---

What a Superbill Actually Is (and Isn’t)

A superbill is not the same as a CMS-1500 claim form. The CMS-1500 is a government-standardized form providers file directly with insurers when billing in-network. A superbill is a provider-generated receipt you hand to the client — the client then submits it to their insurer to recover their out-of-network benefits.

The key practical difference: with a CMS-1500 the insurer pays you; with a superbill the insurer reimburses the client, who already paid you. This makes superbills the standard document for cash-pay and hybrid practices. For more context on how this fits into your business model, see Do Therapists Have to Take Insurance? Cash-Pay vs. Insurance Panels.

---

Does HIPAA Actually Apply to Your Superbill?

Yes — if you submit any electronic transactions to insurers (eligibility checks, remittance advice, ERA), you are a HIPAA covered entity and the Privacy and Security Rules apply to every document in your practice, including superbills. A solo practitioner is still a covered entity; practice size is irrelevant.

Even cash-pay-only therapists who have never filed a single electronic claim are handling Protected Health Information (PHI) when they put a diagnosis code and a client’s name on the same document. The HIPAA Privacy Rule’s minimum-necessary standard requires that you disclose only the PHI needed to accomplish the purpose — in this case, the purpose is enabling insurance reimbursement.

Practically, this means:

• Include the diagnosis code the insurer needs — but not your full clinical notes.
• Do not include sensitive categories of information (substance use disorder treatment records, psychotherapy notes) on a superbill unless the client has signed a specific written authorization.
• Store completed superbills with the same physical and electronic safeguards you apply to the rest of the medical record.

---

The Complete HIPAA-Compliant Superbill Checklist

Every field below must be present and accurate. A single missing or mismatched item is enough for a payer to reject the claim.

Provider Information

Field	Why It Matters
Full legal name + credentials (LCSW, LPC, etc.)	Identifies the licensed provider
Practice / clinic name	Must match your billing address
Practice address (street, city, state, ZIP)	Determines jurisdiction and payer routing
Phone number	Required for payer follow-up
NPI (National Provider Identifier)	10-digit number; mandatory on all HIPAA standard transactions since 2008
Tax ID / EIN	Payers need this to issue EOBs and 1099s
State license number	Many payers require this to credential-check before processing

If you have not yet obtained your NPI, it is free and takes about 10 minutes through the NPPES NPI Registry. You cannot legally submit billing documents without one.

Client Information

Field	Notes
Client full legal name	Must match the name on the insurance policy exactly
Date of birth	Payers use DOB to match the claim to the member record
Insurance member ID	From the client’s insurance card
Insurance plan name	E.g., “Aetna Choice POS II”
Subscriber name (if different from client)	Required when the client is a dependent on another person’s plan

Encounter / Service Information

Field	Notes
Date of service	One line per session date
Place of service code	11 = office; 02 = telehealth (provider site); 10 = patient’s home for telehealth
CPT procedure code	See common therapy codes below
Telehealth modifier	Add modifier -95 (or -GT for Medicare) when the session was delivered via video
Session duration / units	Required for time-based CPT codes
ICD-10-CM diagnosis code	Must be specific (e.g., F41.1) — not a “billable” parent code
Fee charged	Your full rate, not the amount the client paid
Amount paid by client	Documents what the client is seeking to recover
Provider signature (or attestation)	Some payers require a wet or digital signature

---

Common Therapy CPT Codes for Superbills

These are the most-used psychotherapy codes. CPT codes are maintained by the American Medical Association:

CPT Code	Service
90837	Individual psychotherapy, 53+ minutes
90834	Individual psychotherapy, 38–52 minutes
90832	Individual psychotherapy, 16–37 minutes
90847	Family/couples therapy with patient present, 50 min
90846	Family therapy without patient present, 50 min
90791	Psychiatric diagnostic evaluation (intake)
90839	Psychotherapy for crisis, first 30–74 minutes

Use the code that accurately reflects the time documented in your session note — these are time-based codes and auditors do check.

---

The ICD-10 Diagnosis Code: The Field That Kills the Most Claims

A missing, vague, or mismatched ICD-10 code is the single most common reason a superbill gets rejected. The ICD-10-CM code set for mental, behavioral, and neurodevelopmental disorders spans F01–F99. You must use the most specific code available — for example, F32.1 (major depressive disorder, single episode, moderate) rather than F32 alone.

Rules to follow:

• The diagnosis code on the superbill must match the diagnosis documented in your clinical record for that date of service. Inconsistency is an audit flag.
• Do not list a diagnosis you have not assessed and documented.
• If a client has multiple diagnoses, list the primary condition first.
• Update the code if the diagnosis changes — do not carry a stale code from six months ago to avoid paperwork.

For related documentation requirements, see How to Write Audit-Proof Therapy Progress Notes.

---

Three Mistakes That Get Superbills Rejected

1. Telehealth session, no modifier. If you delivered the session by video and you do not add the -95 modifier to the CPT code, payers will either deny the claim or reimburse at the lower in-person rate. Every telehealth session needs the modifier and the correct place of service code (02 or 10).

2. Client name mismatch. The name on the superbill must exactly match the name on the insurance policy. A client who goes by a nickname, a hyphenated last name used inconsistently, or a legal name change creates mismatches. Verify the policyholder name against the insurance card at intake.

3. Filing past the timely-filing deadline. Most payers impose a 90- to 180-day timely-filing limit measured from the date of service. Superbills submitted after this window will be denied with no recourse. Issue the superbill promptly — ideally at or shortly after each session — and remind clients not to sit on them.

---

Superbills and Psychotherapy Notes: Know the Difference

HIPAA draws a hard line between the billing record (which includes the diagnosis, CPT code, date, and session summary) and psychotherapy notes (the therapist’s private process notes kept separately from the medical record). HHS guidance gives psychotherapy notes heightened protection — a client’s authorization is required before you can disclose them, even for payment purposes.

This means: your superbill should never reproduce the contents of your psychotherapy notes. The diagnosis code, session type, and date are appropriate. Your clinical impressions, the client’s statements during session, and your treatment hypotheses are not.

---

Frequently Asked Questions

Do I need a superbill if I’m fully cash-pay and never deal with insurance?

Not automatically — but many clients will ask for one so they can submit it themselves for out-of-network reimbursement. Whether you provide superbills is a business decision. If you do provide them, everything above applies: HIPAA’s minimum-necessary standard still governs how you handle the PHI on that document. See Do Therapists Have to Take Insurance? for a fuller breakdown of cash-pay vs. panel tradeoffs.

Can a client use a superbill even if I’m not credentialed with their insurer?

Yes. Out-of-network benefits exist precisely for this scenario. The client submits the superbill to their insurer, the insurer applies any out-of-network deductible, and reimburses the client (not you) at whatever percentage their plan covers. The limiting factor is the client’s specific plan — some plans have no OON benefit at all. This is worth explaining at intake. For background on the credentialing process, see Insurance Credentialing for Therapists: A Step-by-Step CAQH Walkthrough.

What’s the difference between a superbill and an invoice?

An invoice is a request for payment. A superbill is a post-payment itemized receipt that also functions as a billing document for insurance purposes. The superbill requires the clinical coding fields (CPT, ICD-10, NPI, place of service) that a plain invoice does not. Some practice management systems conflate the two, which creates problems — make sure whatever you hand to clients for insurance purposes includes every field in the checklist above.

Does the superbill have to be on official letterhead?

No specific format is mandated by HIPAA or CMS, but it should clearly identify your practice and include all required fields. A ready-made template formatted to include every required field by default is the lowest-friction way to stay consistent across all clients and sessions. Using a consistent format also makes it easier to spot omissions before the document leaves your hands.

---

Getting the Document Right from Day One

A superbill error is usually invisible until a client calls you weeks later to say their insurance denied the claim. Building a template that has every required field — and validating the ICD-10 and CPT codes against your session notes before you generate it — eliminates most of that downstream friction.

The superbill sits at the intersection of your clinical record, your billing practice, and your clients’ financial experience. Get it right and clients trust you with their paperwork; get it wrong and you’re the reason they didn’t get reimbursed.

For the full administrative setup around this document, the documents every new therapy practice needs piece covers how the superbill fits alongside your intake forms, informed consent, and treatment plan. And if you’re still mapping out the broader infrastructure of going independent, the complete guide to starting a private therapy practice is the right starting point.