Oregon private practice counselors face more compliance complexity in 2026 than at any point in recent history. A major Medicaid billing rule takes effect October 1, 2026 — a deadline that will end OHP billing privileges for behavioral health associates working in private practice. Separately, biennial license renewals are still new enough that many practitioners are tracking the wrong timeline, and HIPAA enforcement against solo providers has tightened significantly. This guide covers what Oregon LPCs, LMFTs, and LCSWs working in private practice need to know — and what needs to happen before the end of this year.
Oregon counselor licensing: what the biennial renewal cycle actually requires
Oregon moved to biennial (every two years) license renewals effective January 1, 2024. Licenses renew on the last day of your birth month. The change sounds administrative, but it has caught many practitioners off guard on CE requirements and renewal timing.
LPCs and LMFTs must complete 40 continuing education hours every 24 months to renew. Those hours have specific composition requirements set by the Oregon Board of Licensed Professional Counselors and Therapists (OBLPCT):
- 6 hours in ethics
- 4 hours in cultural competency
- 2 hours in suicide risk assessment, treatment, and management
- Remaining 28 hours in any approved continuing education
There is no grace period. CE hours must be completed before or during renewal — not after. Late renewal carries fees, and practicing on an expired license is a Board compliance issue, not just an administrative one. The first renewal under the new biennial cycle was due April 30, 2025 for many practitioners. If you are unsure of your renewal date or CE status, log in to the OBLPCT Licensee Portal to confirm.
LCSWs are licensed by the Oregon Board of Licensed Social Workers (BLSW) under a separate renewal structure — confirm your specific deadlines directly with that board.
The October 1, 2026 deadline that will disrupt private practices relying on associate billing
This is the most consequential compliance change Oregon private practice counselors are facing in 2026. Starting October 1, 2026, board-registered behavioral health associates and interns can no longer bill Oregon Health Plan (OHP/Medicaid) in private practice settings.
After that date, associates working in private practice have two options:
- Obtain full licensure (LPC, LMFT, LCSW, or another qualifying credential)
- Move to an organization that holds an OHA-issued Certificate of Approval (COA)
OHA finalized the rule changes by July 2026. The stated rationale is that this ensures Medicaid members with complex behavioral health conditions receive care from fully licensed providers, and supports workforce capacity in community mental health programs. Whatever the rationale, the operational impact for private practices is significant: any practice currently billing OHP for services delivered by a behavioral health associate needs an immediate plan.
If you supervise behavioral health associates who are billing OHP, the questions to answer before October 1 are: Which associates are on track for licensure before the deadline? Which will not be licensed in time? What happens to your caseload capacity and revenue if associate OHP billing stops? Practices that have not started planning are already behind.
OHP enrollment for private practice counselors: what the timeline actually looks like
Enrolling as an Oregon Health Plan provider as a private practice counselor is a two-step process that takes longer than most practitioners expect. Enrolling with OHA directly is only the first step — you must also credential separately with the Coordinated Care Organization (CCO) serving your region before you can actually bill.
Plan for 90 to 180 days total from initial application to first billable claim. The timeline depends on documentation completeness, practice structure (individual versus group), and how quickly the relevant CCO moves credentialing applications. Starting the process the week you want to accept OHP clients is not realistic.
Common errors that delay or disrupt OHP billing include:
- Missing prior authorization when required for specific service codes
- Incomplete documentation submitted with claims
- Failure to verify client OHP eligibility before each service date
- Incorrect third-party liability (TPL) handling — OHP is the payer of last resort, meaning other coverage must be billed first
For questions about enrollment, OHA's provider enrollment line is 503-378-3074. Enrollment forms are available on the OHA OHP provider enrollment page.
HIPAA compliance for solo and small private practice
HIPAA applies to any counselor who handles protected health information (PHI) electronically — including through EHR software, scheduling platforms, telehealth systems, or electronic billing. It does not matter whether you accept insurance. A cash-pay solo practice using electronic records is a HIPAA covered entity and must comply.
As the solo practitioner, you are also the designated HIPAA compliance officer for your practice. The four core compliance areas are:
- Administrative safeguards — written policies and procedures for handling PHI, staff training documentation, and a designated compliance owner
- Physical safeguards — facility and device security, access controls, and proper disposal of PHI
- Technical safeguards — encryption of electronic data at rest and in transit, access controls, and audit logging
- Organizational requirements — Business Associate Agreements (BAAs) with any vendor that handles PHI, and a current Notice of Privacy Practices (NPP)
The Office for Civil Rights (OCR) is now strictly enforcing the Security Risk Analysis (SRA) requirement even for solo providers. An SRA is a documented inventory of your systems, data flows, and the risks to your PHI — plus a mitigation plan. If you have not completed one and documented it, you are out of compliance regardless of how careful you are in practice.
Vendors that require a Business Associate Agreement
A BAA is required any time a vendor or contractor has access to your clients' PHI. That includes your EHR system, scheduling software, telehealth platform, billing service, and any administrative contractor or bookkeeper who touches client records. Signing up for a popular EHR without executing a BAA with that vendor is a HIPAA violation. Most reputable vendors have a standard BAA ready to execute — if a vendor does not offer one, that is a significant red flag.
The Notice of Privacy Practices update that already had a deadline
The HIPAA deadline to update your Notice of Privacy Practices to reflect substance use record protections under 42 CFR Part 2 was February 16, 2026. If you treat clients with substance use disorders and have not updated your NPP, that update is overdue. The required changes address consent for SUD treatment disclosures, redisclosure restrictions, and notification of heightened state-level protections. Oregon state law (ORS 192.553 to 192.581) imposes stricter privacy requirements than federal HIPAA for behavioral health records, reproductive and gender-affirming care information, and records of minors — your NPP and consent forms should reflect both layers.
Oregon record-keeping requirements
Oregon requires licensed counselors to retain client records for a minimum of 7 years from the date of last service. LPC and LMFT records are governed by OAR 833-075-0070; LCSW records by OAR 877-030-0100. Progress notes must be recorded concurrently — during or immediately after each session, not reconstructed later.
Practitioners using electronic health records also have HIPAA obligations around data backup and disaster recovery. Your client records must be accessible even in the event of device failure, ransomware, or a physical office disaster. If your entire practice record lives on a single laptop without a cloud backup or encrypted offsite copy, that is both a HIPAA gap and a practical liability.
If client records are destroyed or lost, you are required to notify the OBLPCT or BLSW. Build this into any practice transition plan.
The compliance mistakes Oregon private practice counselors make most often
Letting a license or registration lapse. Hours accrued under an expired registration do not count toward licensure requirements. The Board is explicit: this can constitute unlicensed practice, with civil penalties and potential registration revocation. Set calendar reminders well ahead of your renewal date.
Supervision documentation failures. For registered associates, supervisor evaluation reports must be signed by both supervisor and supervisee and uploaded through the OBLPCT Licensee Portal at each renewal. Hours not submitted through the portal do not count. If you change supervisors or practice location, board approval must be obtained before starting — not after. Any supervision interruption must be explained to the board within 14 days.
Assuming OHP credentialing is just one application. OHA enrollment and CCO credentialing are separate processes with separate timelines. Many practitioners complete OHA enrollment and then wait months to actually bill because they did not initiate CCO credentialing at the same time.
Outdated or missing HIPAA documentation. The four gaps OCR consistently finds in private practice audits are: no current Notice of Privacy Practices, no Business Associate Agreements with vendors, no documented Security Risk Analysis, and no evidence of annual HIPAA training. None of these are complex to address — but none of them fix themselves.
Not planning for the October 1, 2026 behavioral health associate change. This is the most operationally significant deadline for private practices serving OHP clients. Practices that have not mapped which associates are on a path to licensure — and what happens to revenue and caseload if that path fails — are taking on avoidable risk.
When to bring in outside help
Most solo and small private practice counselors can manage licensing renewals and routine compliance in-house with good systems and calendar discipline. The situations where outside consultation adds real value are:
- You are transitioning from solo to group practice and need to build compliance infrastructure from scratch
- You are adding OHP billing or navigating the October 2026 associate billing change
- You have received a Board compliance inquiry or a credentialing denial
- Your practice has grown to the point where you have staff with access to PHI and no documented HIPAA program
- You are unsure whether your supervision structure, documentation, or billing practices meet current standards
The value of a short consultation engagement is usually less than the cost of a single compliance failure, a delayed OHP enrollment, or a Board corrective action. Saint Health is listed as a verified consulting partner on the Oregon Counselor Directory, a resource for behavioral health providers across Oregon.
Frequently asked questions
How many CE hours do Oregon LPCs and LMFTs need to renew their license?
Oregon LPCs and LMFTs must complete 40 continuing education hours every 24 months to renew. The 40 hours must include 6 hours in ethics, 4 hours in cultural competency, and 2 hours in suicide risk assessment. Oregon moved to biennial renewals effective January 1, 2024.
Can behavioral health associates bill Oregon Medicaid in private practice after October 2026?
No. Starting October 1, 2026, board-registered behavioral health associates and interns can no longer bill OHP in private practice settings. Associates must either obtain full licensure or move to an organization with an OHA-issued Certificate of Approval. Practices relying on associate billing need to plan now — the deadline is firm.
How long does OHP enrollment take for a private practice counselor?
Typically 90 to 180 days from application to first billable claim. OHA enrollment is only the first step — you must also credential with the Coordinated Care Organization serving your area, which is a separate process with its own timeline.
How long must Oregon counselors keep client records?
Oregon requires a minimum of 7 years from the date of last service. LPC and LMFT records are governed by OAR 833-075-0070; LCSW records by OAR 877-030-0100. Progress notes must be made concurrently, not reconstructed later.
Does HIPAA apply to solo private practice counselors?
Yes. Any counselor handling PHI electronically — through an EHR, scheduling software, telehealth platform, or billing system — is a HIPAA covered entity. Cash-pay practices using electronic records must comply. Solo practitioners are also their own HIPAA compliance officer, and OCR is now strictly enforcing the Security Risk Analysis requirement for individual providers.
What are the most common HIPAA gaps in Oregon private practice?
The four gaps OCR most commonly finds: no current Notice of Privacy Practices (or one that does not address substance use record protections under 42 CFR Part 2), missing Business Associate Agreements with vendors, no documented Security Risk Analysis, and no evidence of annual HIPAA training. Oregon state law adds additional privacy obligations beyond federal HIPAA for behavioral health records, minor records, and sensitive health categories.
Saint Health Group supports Oregon behavioral health practitioners and organizations navigating licensing, compliance, credentialing, and operational transitions. If your practice is working through the October 2026 deadline, OHP enrollment, or HIPAA compliance infrastructure, contact us to discuss what that looks like in practice, or explore our compliance and risk services and licensing and accreditation services.