Yes. Even though you don’t bill insurance, your intake questionnaires, good-faith exams, e-sign consents, and telehealth sessions create protected health information. That PHI has to be stored, transmitted, and backed up under HIPAA safeguards, so your forms, charts, and telehealth tools all need proper security and access controls.