How to Build a Therapy Client Onboarding Packet (Welcome Packet Guide)

The first session starts before the client walks in the door. A well-built onboarding packet handles the administrative and legal groundwork — consent, privacy disclosures, financial terms — so session one can be used for clinical work. A poorly built one creates gaps: unsigned consents, clients who don’t know your cancellation policy, and HIPAA obligations you haven’t technically met.

This article covers what belongs in a therapy client onboarding packet, in what order, and how to get it to clients in a way they will actually complete before the first appointment.

---

What an Onboarding Packet Is (and Isn’t)

A client onboarding packet is the set of forms and disclosures a new client receives before or at the first session. It is not a marketing welcome kit — it is an administrative and legal document set that establishes the therapeutic relationship on the right footing.

The packet serves three simultaneous purposes: it collects the clinical information you need to do your job, it documents compliance with legal and ethical requirements, and it establishes the policies clients agree to before any disputes arise. A missing document is not a minor inconvenience — an unsigned HIPAA acknowledgment or an absent Good Faith Estimate can constitute a compliance failure.

For context on the full document stack a private practice needs, see The 7 Documents Every New Therapy Practice Needs. The onboarding packet is the client-facing portion of that stack — what gets sent to clients as opposed to what lives only in your files.

---

The Six Documents Every Onboarding Packet Needs

1. Welcome Letter

A welcome letter is not legally required, but it reduces no-shows and incomplete form submissions. A one-page letter that covers your name and credentials, your office address and telehealth platform, how to reach you (and what not to use for urgent matters), what to expect at the first appointment, and a brief note on what the enclosed forms cover — all of that reduces the friction of completing the packet and answers the questions clients otherwise email you about.

Keep it short. The welcome letter is not a second consent form. Its job is to orient the client so they approach the rest of the packet with context.

2. Client Intake Form

The intake form is your baseline clinical record for the client. It should be completed before the first session so you are not gathering history while simultaneously trying to establish a therapeutic relationship.

At minimum, capture: full legal name and preferred name, date of birth, contact information and emergency contact, referring provider or referral source, insurance information if applicable, presenting concerns in the client’s own words, relevant medical history (medications, chronic conditions, surgeries), mental health history (prior diagnoses, previous therapy, hospitalizations), and substance use history.

The intake form is part of the permanent clinical record. It should be dated and clearly associated with the client by name and chart number. Going Paperless: Fillable Intake & Consent Forms for Therapists covers the format and delivery specifics in detail.

3. Informed Consent to Treatment

This is the most legally and ethically significant document in the packet. Under APA Ethics Code Standard 10.01, psychologists must inform clients about the nature and anticipated course of therapy, fees, involvement of third parties, and limits of confidentiality as early as feasible in the therapeutic relationship. Parallel requirements exist under NASW and ACA codes for social workers and licensed counselors.

A compliant informed consent form must address:

• The nature of therapy: what clients can expect, the voluntary nature of participation, and their right to discontinue at any time
• Confidentiality and its limits: mandatory reporting obligations, duty-to-warn provisions, and what happens if records are subpoenaed
• Fee and billing terms: your session rate, payment timing, and what happens with unpaid balances — cross-reference your financial policy rather than duplicating it
• After-hours and crisis contact: how to reach you between sessions and what constitutes a clinical emergency
• Communication policies: what platforms you use, what you will not respond to on social media, and whether you use a HIPAA-compliant messaging system
• Supervision disclosure if applicable: that a supervisor may review records if you are under supervision

The signed consent form belongs in the client’s chart and should be retained for the full records retention period — typically seven years from the last date of service for adult clients, longer for minors in most states.

4. HIPAA Notice of Privacy Practices and Acknowledgment

If you transmit protected health information (PHI) electronically in connection with billing or treatment, you are a HIPAA covered entity and must provide a Notice of Privacy Practices (NPP) at or before the first appointment. The HHS Privacy Rule requires that you make a good-faith effort to obtain a signed acknowledgment of receipt.

The NPP discloses how you use and share PHI, what rights clients have over their records (access, amendment, restriction requests, accounting of disclosures), your legal duties regarding PHI, and how to file a complaint with HHS. The HHS model NPP is a reliable starting template you can adapt with your practice information.

2026 update: As of February 16, 2026, NPPs must include language about substance use disorder (SUD) patient record protections reflecting the 2024 HIPAA and Part 2 regulatory changes. If you are still using an NPP drafted before that date, update it. HHS guidance on the SUD patient record update covers what the new language must contain.

The acknowledgment can be a separate signature page or a signature line at the bottom of the NPP itself. Keep the signed acknowledgment separately identifiable in the chart — it is the document you produce if a payer or licensing board asks whether you delivered the NPP.

5. Good Faith Estimate (for Self-Pay and Uninsured Clients)

Under the No Surprises Act, providers must give uninsured or self-pay clients a Good Faith Estimate (GFE) of expected charges when they schedule a service at least three days in advance or request one. Per CMS guidance, the GFE must be provided within one business day of scheduling if the appointment is at least three days out, or within three days if the appointment is at least ten days out.

For a private practice therapist, the GFE for a therapy client typically includes: your name and NPI, the expected service (e.g., individual psychotherapy 90837), the expected cost per session, and an estimated total based on the anticipated number of sessions. Because therapy is ongoing and the number of sessions is inherently uncertain, a reasonable practice is to provide an estimated cost per session and note that the total will depend on the treatment course.

The GFE applies to self-pay and uninsured clients. It is not required if the client is using insurance for the session. Keep a copy of the delivered GFE in the client’s file.

6. Practice Policies and Financial Agreement

Your practice policies document establishes the rules of the professional relationship — and it needs to be signed before the first session, not handed to the client on the way out. The policies that matter most:

• Cancellation and no-show terms: the notice period required, the fee for late cancels and no-shows, and any exceptions. A policy the client has not signed cannot be enforced. See No-Show and Cancellation Policies for Therapists for what these clauses need to say.
• Fee schedule: your session rate, accepted payment methods, card-on-file authorization, and what happens to unpaid balances. For the full billing-side setup, see Setting Up a Fee Schedule and Billing Workflow for Your Therapy Practice.
• After-hours contact terms: when and how clients can reach you, what does not constitute emergency contact, and what to do in a crisis.
• Social media policy: your approach to social media contact with clients and why.

Some practices fold these into the informed consent form; others keep them as a standalone addendum. Either approach works — what matters is that the client signs and dates it and the signed copy is in the file.

---

How to Sequence and Format the Packet

Send the packet as a single delivery — one portal invite, one link, or one email with all documents attached — rather than multiple separate sends. Multiple emails have a much lower completion rate. The order that works well for most practices:

1. Welcome letter (opens the packet, provides orientation)
2. Client intake form (longest to complete; put it early while attention is high)
3. Informed consent to treatment
4. HIPAA Notice of Privacy Practices + acknowledgment
5. Good Faith Estimate (if self-pay/uninsured)
6. Practice policies and financial agreement

If you deliver forms through a client portal (SimplePractice, TherapyNotes, Jane App), the portal handles signatures, timestamps, and storage in the chart automatically — the most efficient setup for HIPAA-compliant delivery. If you use fillable PDFs, pair them with a HIPAA-compliant delivery method that has a signed Business Associate Agreement in place. Standard consumer email is not sufficient for transmitting PHI.

---

Timing: When to Send the Packet

Send the onboarding packet 48 to 72 hours before the first appointment. Same-day sends get ignored or rushed. A week out is too far in advance — clients forget. Two to three days strikes the balance: enough lead time to complete and return the forms, close enough that the appointment feels real.

Include a brief note on what to do if something is confusing. Clients who understand why they are signing something complete the forms at higher rates than clients who receive a stack of forms with no context.

---

When a Client Doesn’t Return Forms Before the First Session

Have a fallback plan. Keep a printed packet or a tablet in the office. Do not begin the first session without signed informed consent and a signed HIPAA acknowledgment — those two documents are not optional. The intake form can be completed during the session if needed; the legal and HIPAA documents cannot be deferred.

If a client refuses to sign the HIPAA NPP acknowledgment, document the refusal in writing — date, that you presented the NPP, and that the client declined — and keep that note in the chart. You can still treat the client. You cannot refuse service solely on the basis of an unsigned acknowledgment.

---

When to Update the Packet

Your onboarding packet is a living set of documents, not a one-time build. Review and update it when:

• Your fee schedule changes (give existing clients 30 days’ written notice)
• You add or change telehealth services (add or update telehealth consent)
• Your cancellation policy changes
• Federal or state regulatory changes affect your NPP (as happened in February 2026 with the SUD update)
• You move to a new EHR or form delivery platform
• A client returns after a gap of 12 months or more — get fresh signatures on consent and financial policy

Keep a note of the version date on each document so you can confirm which version a client signed when a dispute arises.

---

Frequently Asked Questions

Do I need a welcome packet if I use an EHR with built-in intake forms?

Your EHR handles delivery and storage, but it does not write the forms. You still need to build or customize each document — the intake questions, the consent language, the policy terms — to your practice. The EHR is the delivery and recordkeeping mechanism, not the compliance document itself.

Can the informed consent and the HIPAA NPP be combined into one document?

Operationally, yes — many practices combine them into a single multi-part document with separate signature lines for each section. The requirement is that each disclosure is present and separately acknowledged. If you combine them, make sure each section is clearly labeled and each has its own dated signature line.

Is a Good Faith Estimate required if I only take insurance?

No. The Good Faith Estimate requirement under the No Surprises Act applies to uninsured and self-pay clients. If a client is using their insurance for the session, the GFE requirement does not apply — their insurer provides its own cost-sharing information. If a client is seeing you out-of-network and paying out-of-pocket, even if they have insurance, they are considered self-pay for GFE purposes.

How long should I keep signed onboarding documents?

Signed intake and consent documents are part of the clinical record. General guidance is to retain adult client records for at least seven years from the last date of service. For minor clients, most state standards require retention until the client reaches the age of majority plus the standard retention period — which in many states means until the former minor client is 25 or older. Check your state licensing board’s recordkeeping rules for the specific requirement in your jurisdiction.