Psychotherapy notes are the one category of mental health documentation that HIPAA protects more tightly than the rest of the chart. Your private session notes are only private if you store them apart from the chart. Here is the test, and who can see what.
Every rule below comes from the HIPAA Privacy Rule and is cited where it appears. State law can be stricter, and where it is, this page says so. Nothing here is legal advice. The primary sources are:
- The definition at 45 CFR 164.501
- The authorization rule at 45 CFR 164.508
- The access rule at 45 CFR 164.524
- The HHS Office for Civil Rights FAQ on mental health information
| HIPAA psychotherapy notes at a glance | Rule |
|---|---|
| Definition | Separate notes on session content by a mental health professional, 45 CFR 164.501 |
| Excluded content | Medication, session times, modality and frequency, test results, and summaries of diagnosis, status, plan, symptoms, prognosis and progress |
| Disclosure | Authorization required for almost every use or disclosure, 164.508(a)(2) |
| Other treating providers | Authorization required, per HHS FAQ 2088 |
| Patient access | Excluded from the HIPAA right of access, 164.524(a)(1)(i) |
| State law | A more stringent state law still applies, 160.203(b) |
| Required to keep them | No |
What are psychotherapy notes?
Under 45 CFR 164.501, psychotherapy notes are notes recorded in any medium by a mental health professional. They document or analyze the contents of conversation during a counseling session. The session can be private, group, joint or family. The notes must be separated from the rest of the individual's medical record. All four parts of that definition have to be true at once.
| Part of the definition | What it means in practice |
|---|---|
| Recorded in any medium | Paper, a separate EHR module, a locked document. The format does not matter. |
| By a mental health professional | The author is the treating clinician. A note by billing or front desk staff cannot qualify. |
| Documenting or analyzing the conversation | The content is what was said in session and the clinician's reflection on it. |
| Private, group, joint or family session | All counseling formats are covered, including couples and family work. |
| Separated from the rest of the record | Stored apart from the chart. A note kept inside the progress note is part of the record. |
- The separation requirement decides whether the extra protection applies at all.
- A note typed into the same field as the progress note is part of the medical record.
- HHS adds that psychotherapy notes do not include any information maintained in the patient's medical record.
- Psychotherapy notes are still protected health information, so every other Privacy Rule duty applies too.
- Nothing in HIPAA requires a clinician to keep psychotherapy notes at all.
What is not a psychotherapy note under HIPAA?
The same definition lists what psychotherapy notes exclude. Each item below belongs in the medical record, whatever the clinician calls the document it is written in.
| Excluded item (45 CFR 164.501) | Where it belongs | Example |
|---|---|---|
| Medication prescription and monitoring | Medical record | Started sertraline 50 mg; side effects reviewed |
| Counseling session start and stop times | Progress note | Session 2:02 pm to 2:55 pm, 53 minutes |
| Modalities and frequencies of treatment | Progress note and treatment plan | Weekly individual CBT |
| Results of clinical tests | Medical record | PHQ-9 score 14 today, 18 at intake |
| Summary of diagnosis | Progress note and treatment plan | Major depressive disorder, recurrent, moderate |
| Summary of functional status | Progress note | Returned to work three days this week |
| Summary of the treatment plan | Treatment plan | Objective 2 of 3 in progress |
| Summary of symptoms | Progress note | Early waking and low mood most days |
| Summary of prognosis | Progress note | Good with continued weekly sessions |
| Summary of progress to date | Progress note | PHQ-9 down four points over six weeks |
Read the list the other way round and it becomes a working rule. If a payer, a covering clinician or an auditor needs a piece of information to understand the treatment, it goes in the record. What is left for a psychotherapy note is the clinician's own working material about the conversation.
What is the difference between psychotherapy notes and progress notes?
Progress notes are part of the medical record and support treatment, billing and coordination. Psychotherapy notes are the clinician's separate notes on the conversation. The two carry different rules on access, disclosure and authorization.
| Progress notes | Psychotherapy notes | |
|---|---|---|
| Legal status | Part of the medical record and the designated record set | Separate from the medical record by definition |
| Purpose | Document care delivered, support billing and coordination | The clinician's own analysis of session content |
| Typical content | Times, modality, diagnosis, symptoms, interventions, response, plan | Impressions, hypotheses, detailed session content, process observations |
| Required for billing | Yes. Payers read them to confirm the service | No. Medicare billing article A59723 says documentation is not to include privileged information |
| Patient right of access | Yes, under 45 CFR 164.524 | Excluded from the HIPAA right of access by 164.524(a)(1)(i) |
| Disclosure for treatment | Permitted to other providers without authorization | Authorization required, including to another treating provider |
| Disclosure for payment | Permitted without authorization | Authorization required |
| Who can use it for treatment | The treatment team | The originator of the notes |
| Authorization can be combined | With other authorizations | Only with another psychotherapy notes authorization, per 164.508(b)(3)(ii) |
| Health plan can condition enrollment | In limited cases under 164.508(b)(4)(ii) | No. The exception excludes psychotherapy notes |
| Storage | Main chart | A separate, access-controlled location |
| Required to exist | Expected by payers for every billed session | Optional. HIPAA does not require them |
- Every billed session needs a progress note. A psychotherapy note is optional.
- The progress note has to stand on its own for an audit.
- The psychotherapy note must never be the only place a billable fact is written down.
- Moving a note to a separate folder later does not undo a disclosure that already happened.
Emma drafts the progress note from your session, in your template, for your review
START FREE TRIAL →What are process notes, and are they the same as psychotherapy notes?
Process notes is the clinical name many training programs use for a clinician's reflective notes on session content. HIPAA does not use the term. A process note is a psychotherapy note under HIPAA only if it meets the 164.501 definition, including being kept separate from the record.
| Term | Where it comes from | HIPAA status |
|---|---|---|
| Psychotherapy notes | 45 CFR 164.501 | Defined term with special protection when all conditions are met |
| Process notes | Clinical training and supervision | Treated as psychotherapy notes only if they meet the definition |
| Progress notes | Clinical and billing practice | Part of the medical record |
| Psychotherapy records | Common usage for the whole mental health chart | Part of the medical record; no special HIPAA category |
| Session notes | Informal | Depends entirely on content and where they are stored |
What does HIPAA require for psychotherapy notes?
The Privacy Rule attaches four specific requirements to psychotherapy notes. HHS gives two reasons. The notes are particularly sensitive. They are also the therapist's personal notes, typically not needed by anyone else for treatment or payment.
| Requirement | What the rule says | Source |
|---|---|---|
| Authorization for use or disclosure | A covered entity must obtain an authorization for any use or disclosure, with a short list of exceptions | 45 CFR 164.508(a)(2) |
| Authorization kept separate | A psychotherapy notes authorization may only be combined with another psychotherapy notes authorization | 45 CFR 164.508(b)(3)(ii) |
| No conditioning by health plans | The enrollment and eligibility exception to the conditioning ban does not extend to psychotherapy notes | 45 CFR 164.508(b)(4)(ii)(B) |
| Excluded from right of access | The individual's right to inspect and copy does not extend to psychotherapy notes | 45 CFR 164.524(a)(1)(i) |
| Stricter state law applies | A state privacy law that is more stringent than the Privacy Rule is not preempted | 45 CFR 160.203(b) |
- The authorization rule applies to other treating providers too. HHS states this directly in its FAQ.
- All the usual safeguards for protected health information still apply: access controls, minimum necessary, breach rules.
What must a psychotherapy notes authorization contain?
A psychotherapy notes authorization is a HIPAA authorization with one extra rule. It can only be combined with another psychotherapy notes authorization, under 164.508(b)(3)(ii). Everything else follows the core elements and required statements in 45 CFR 164.508(c).
| Element | What 164.508(c) requires |
|---|---|
| Description of the information | Identifies the information in a specific and meaningful fashion, so name psychotherapy notes and the date range |
| Who may disclose | The name or specific identification of the person or class of persons authorized to disclose |
| Who may receive | The name or specific identification of the recipient |
| Purpose | A description of each purpose; at the request of the individual is sufficient when the patient initiates it |
| Expiration | An expiration date or an expiration event |
| Signature and date | Signed and dated by the individual, or by a personal representative with a description of their authority |
| Right to revoke | A statement of the right to revoke in writing, with the exceptions and how to revoke |
| Conditioning | A statement on whether treatment, payment, enrollment or eligibility can be conditioned on signing |
| Redisclosure | A statement that disclosed information may be redisclosed by the recipient and lose Privacy Rule protection |
| Plain language | The authorization must be written in plain language, under 164.508(c)(3) |
| Copy to the patient | When the covered entity seeks the authorization, it gives the patient a copy, under 164.508(c)(4) |
- Keep the psychotherapy notes authorization as its own form.
- A general release of information signed at intake does not reach psychotherapy notes.
- Record the revocation date on the form if the patient revokes.
- File the signed authorization with the disclosure record so the audit trail is complete.
When can psychotherapy notes be disclosed without authorization?
45 CFR 164.508(a)(2) lists the only exceptions. Anything not on this list needs a signed psychotherapy notes authorization.
| Exception | What it allows | Cite |
|---|---|---|
| Originator's own treatment use | The clinician who wrote the notes uses them to treat the patient | 164.508(a)(2)(i)(A) |
| Supervised training programs | The covered entity's own programs where mental health students, trainees or practitioners learn under supervision | 164.508(a)(2)(i)(B) |
| Defending a legal action by the patient | The covered entity defends itself in a legal action or proceeding brought by the individual | 164.508(a)(2)(i)(C) |
| HHS compliance investigation | Disclosure required by the Secretary to investigate compliance | 164.508(a)(2)(ii) and 164.502(a)(2)(ii) |
| Required by law | Disclosure required by law and limited to what that law requires, such as mandatory abuse reporting | 164.512(a) |
| Oversight of the originator | A health oversight agency overseeing the clinician who wrote the notes | 164.512(d) |
| Coroners and medical examiners | Identifying a deceased person, determining cause of death, or other authorized duties | 164.512(g)(1) |
| Serious and imminent threat | Preventing or lessening a serious and imminent threat to a person or the public | 164.512(j)(1)(i) |
Two of these exceptions depend on state law. Mandatory reporting falls under required by law. Duty-to-warn situations fall under the serious threat exception, and HHS notes that state laws vary on whether a warning is mandatory or only permitted.
Can patients access their psychotherapy notes?
The HIPAA right of access excludes psychotherapy notes. Under 45 CFR 164.524(a)(1)(i), a patient can inspect and copy their designated record set, except psychotherapy notes. That exclusion is a floor. A state law that gives patients more access is more stringent and still applies under 160.203(b).
| Patient request | Under HIPAA alone | What to check |
|---|---|---|
| Copy of my progress notes | Right of access applies | Respond within the HIPAA timeframe |
| Copy of my psychotherapy notes | Excluded from the right of access | State law may grant access; check before denying |
| Send my records to a new therapist | Progress notes can be sent | Psychotherapy notes need a separate authorization |
| Send my records to my attorney | Progress notes on a valid request | Psychotherapy notes need a psychotherapy notes authorization |
| Parent asking about a minor's therapy | Depends on personal representative status and state law | HHS decision chart for parents; state minor consent law |
Can insurers or auditors ask for psychotherapy notes?
A disclosure for payment purposes needs an authorization under 164.508(a)(2). A health plan cannot make enrollment or eligibility conditional on a psychotherapy notes authorization, under 164.508(b)(4)(ii)(B). Medicare billing article A59723, Billing and Coding: Outpatient Psychotherapy, states that documentation is not to include privileged information. It is a Palmetto GBA article in the CMS Medicare Coverage Database. Payers audit the medical record, which is why the progress note has to carry everything the claim depends on.
- A payer records request is answered from the progress notes, treatment plan and assessment.
- If a payer asks for psychotherapy notes, ask for the authority it is relying on in writing.
- An audit that finds billable facts only in a psychotherapy note is a documentation failure in the progress note.
- Health oversight agencies overseeing the clinician are an exception under 164.512(d). Route those to compliance.
What happens when psychotherapy notes are subpoenaed?
An attorney's subpoena on its own is not enough. Call counsel before anything leaves. The exception list in 164.508(a)(2)(ii) names 164.512(a), disclosures required by law. Under 45 CFR 164.103, required by law includes court orders, court-ordered warrants, and subpoenas issued by a court, grand jury or authorized body. The list does not name 164.512(e), which covers subpoenas and discovery requests with no court order. State privilege law also applies. Whether a specific demand compels disclosure is a question for counsel.
| Demand | Where it sits in the rule | First step |
|---|---|---|
| Court order | Required by law, 164.103 and 164.512(a) | Disclose only what the order expressly requires; involve counsel |
| Subpoena issued by a court or grand jury | Required by law, 164.103 | Confirm the issuer and scope with counsel |
| Attorney-issued subpoena with no court order | 164.512(e)(1)(ii), which 164.508(a)(2) does not list | Do not release psychotherapy notes without authorization or counsel's advice |
| Patient's own lawsuit against the clinic | Defense exception, 164.508(a)(2)(i)(C) | Involve counsel and the malpractice carrier |
| Signed psychotherapy notes authorization | 164.508(a)(2) satisfied | Check the authorization is valid and specific to psychotherapy notes |
What should go in a psychotherapy note, and what should not?
The test is simple. Could someone else need this fact to treat the patient, bill the session or keep the patient safe? If so, it goes in the record.
| Content | Psychotherapy note | Progress note |
|---|---|---|
| Clinician's hypotheses about the patient's dynamics | Yes | No |
| Detailed content of what the patient disclosed | Yes | A summary only |
| Transference and countertransference observations | Yes | No |
| Questions to raise in supervision | Yes | No |
| Session start and stop times | No | Yes |
| Diagnosis and symptom summary | No | Yes |
| Interventions delivered and the patient's response | No | Yes |
| Test results and scale scores | No | Yes |
| Risk assessment and safety plan | No | Yes |
| Medication changes | No | Yes |
| Progress toward treatment plan objectives | No | Yes |
| Mandatory reporting actions taken | No | Yes |
What does a psychotherapy note look like next to a progress note?
The same fictional session, written twice. Every detail is illustrative.
| Field | Progress note (medical record) | Psychotherapy note (separate) |
|---|---|---|
| Session | Individual psychotherapy, 2:02 pm to 2:55 pm, 53 minutes | Not recorded here |
| Diagnosis | Generalized anxiety disorder | Not recorded here |
| Measures | GAD-7 12, down from 15 at intake | Not recorded here |
| Content | Discussed work stress and avoidance of meetings | Patient described a conflict with her father that sounded like the conflict with her manager. Explore next week. |
| Intervention | Cognitive restructuring; exposure step 3 assigned | I noticed I rushed the exposure discussion. Raise in supervision. |
| Response | Engaged, completed thought record in session | Seemed relieved when the topic changed. Possible avoidance. |
| Risk | Denies suicidal ideation; no change to safety plan | Not recorded here |
| Plan | Weekly CBT; continue exposure hierarchy; review at 90 days | Hypothesis: approval-seeking drives the avoidance. Test over the next three sessions. |
An auditor, a covering clinician or a new provider can work from the left column alone. The right column is useful only to its author, which is the situation the Privacy Rule was written for.
See Emma draft a progress note in a group practice workflow
BOOK A FREE DEMO →Do psychotherapy notes apply to group, family and telehealth sessions?
The 164.501 definition names private, group, joint and family counseling sessions, and notes recorded in any medium. The session format does not change the test.
| Session format | Covered by the definition? | What to watch |
|---|---|---|
| Individual | Yes, a private counseling session | The standard case |
| Group | Yes, named in 164.501 | Notes can hold other members' disclosures; keep them out of each member's record |
| Couples or joint | Yes, joint sessions are named | Record whose chart the progress note sits in |
| Family | Yes, named in 164.501 | Parent and minor access rules depend on state law |
| Telehealth | Yes; the definition does not depend on the setting | Recordings and transcripts are protected health information with their own policy |
| Medication management visit | No; medication prescription and monitoring is excluded | Everything goes in the record |
| Supervision session about a patient | Use within the clinic's own training program is an exception | Keep supervision notes out of the chart unless intended for it |
How do psychotherapy notes work in a group practice?
In a group practice, the originator rule matters every day. HHS states that authorization is required even to disclose psychotherapy notes for treatment to a provider other than the originator. A colleague covering a caseload is another provider.
| Scenario | Can they see the psychotherapy notes? | Basis |
|---|---|---|
| Treating clinician who wrote them | Yes, for treatment | 164.508(a)(2)(i)(A) |
| Colleague covering during leave | Only with a psychotherapy notes authorization | 164.508(a)(2); HHS FAQ 2088 |
| Clinical supervisor in the clinic's own training program | Yes, within that program | 164.508(a)(2)(i)(B) |
| Trainee or intern under supervision | Yes, within the clinic's own training program | 164.508(a)(2)(i)(B) |
| Billing staff | No. Billing works from the record | 164.508(a)(2) |
| Clinical director reviewing quality | Only with authorization or another listed exception | 164.508(a)(2) |
| Clinician who has left the practice | No. Close access at exit | 164.508(a)(2) |
| New provider after a transfer of care | Only with a psychotherapy notes authorization | 164.508(a)(2); HHS FAQ 2088 |
| Patient's own request | Excluded from HIPAA access; state law may differ | 164.524(a)(1)(i); 160.203(b) |
| HHS investigating compliance | Yes, when required | 164.502(a)(2)(ii) |
What should a group practice's psychotherapy notes policy include?
- A definition that quotes 45 CFR 164.501, so every clinician uses the same test.
- Whether the practice permits psychotherapy notes at all, and in which system they are kept.
- A storage rule: separate module or location, with access limited to the originator.
- A rule that every billable and safety-relevant fact goes in the progress note first.
- A dedicated psychotherapy notes authorization form, separate from the general release.
- A records-request workflow that separates psychotherapy notes before anything is sent.
- How covering clinicians and transfers of care are handled.
- How supervision and training use of the notes is documented.
- What happens to a departing clinician's notes and access.
- The state law position on patient access, reviewed by counsel.
- A subpoena and court order route that always goes through counsel.
- Retention and destruction periods consistent with state law and your malpractice carrier.
How should a practice handle a records request that could include psychotherapy notes?
- Log the request, the requester, the date received and the stated purpose.
- Identify the requester: the patient, a personal representative, a provider, a payer, an attorney or an agency.
- Pull the designated record set and, separately, check whether psychotherapy notes exist.
- Remove psychotherapy notes from the package unless a listed exception or a psychotherapy notes authorization applies.
- Check state law on patient access and minors before responding to a patient or parent.
- Send any subpoena, court order or attorney letter to counsel before anything leaves the practice.
- Release the minimum necessary where that standard applies.
- Record what was sent, to whom, when and under what authority.
- Tell the originating clinician when their psychotherapy notes are part of any request.
What psychotherapy notes mistakes should a practice avoid?
| Mistake | Why it is a problem | Fix |
|---|---|---|
| Writing process content inside the progress note field | It is part of the record, so the extra protection never applied | Keep a separate, access-controlled location |
| Putting session times or scores only in the psychotherapy note | 164.501 excludes them, and the claim loses its support | Record them in the progress note first |
| Keeping the risk assessment only in the psychotherapy note | A covering clinician cannot see it | Risk and safety plans go in the record |
| Sharing notes with a covering colleague without authorization | HHS states authorization is required for another provider | Get a psychotherapy notes authorization or share the record only |
| Answering an attorney subpoena directly | 164.512(e) is not on the psychotherapy notes exception list | Route every legal demand to counsel |
| Letting billing staff open the notes | Payment use needs an authorization | Restrict access to the originator |
| Leaving a departed clinician's access active | The originator rule stops protecting the notes when others can open them | Close access at exit |
| No written policy | Every clinician applies a different test | Adopt a policy that quotes 164.501 |
| Pasting the psychotherapy note into the progress note | The pasted text becomes part of the record | Write the progress note first, from the session |
| No psychotherapy notes form ready at the front desk | Staff reach for the general release instead | Keep the dedicated authorization form with the intake packet |
| Keeping session recordings next to the notes indefinitely | A retained recording is protected health information | Set a retention and deletion rule for recordings |
Do AI scribes create psychotherapy notes?
An AI draft saved in the chart is part of the record, however much session detail it holds. An ambient AI scribe that drafts into the chart is drafting a progress note. To keep something as a psychotherapy note, the clinician has to store it separately.
| Question to ask about any documentation tool | Why it matters |
|---|---|
| Does a records export include the separate notes? | Exports must separate psychotherapy notes before release |
| Is there a business associate agreement in place? | Any vendor handling protected health information needs one |
- Configure the draft to produce a progress note that stands on its own.
- Keep reflective or hypothesis content out of the drafted note unless you intend it for the record.
- Write anything you want protected as a psychotherapy note yourself, in the separate location.
- For the wider picture, see our page on AI clinical documentation in behavioral health.
What should you check before saving a psychotherapy note?
- The progress note for the session is complete on its own.
- Times, modality, diagnosis, symptoms, interventions, response and risk are in the progress note.
- No test results or scale scores are in the psychotherapy note only.
- No medication information is in the psychotherapy note only.
- The psychotherapy note is saved in the separate, access-controlled location.
- Nothing in the psychotherapy note is needed by a covering clinician to treat safely.
- Any mandatory reporting action is documented in the record.
- The note is written in terms you would be comfortable having read aloud, since state law or a court may reach it.
Psychotherapy notes FAQ
What are psychotherapy notes under HIPAA?
Notes recorded by a mental health professional documenting or analyzing the contents of conversation during a private, group, joint or family counseling session. They must be separated from the rest of the medical record. The definition is at 45 CFR 164.501.
What is the difference between psychotherapy notes and progress notes?
Progress notes are part of the medical record and carry the times, diagnosis, interventions and progress that support treatment and billing. Psychotherapy notes are the clinician's separate notes on session content. They need authorization for almost any disclosure and are excluded from the HIPAA right of access.
Can you provide an example of a psychotherapy note?
A clinician's hypothesis about why a patient avoids a topic, a detailed account of a disclosure, or a note to raise a reaction in supervision. Session times, test scores, diagnosis and progress are excluded by 45 CFR 164.501 and belong in the progress note.
What should be documented in a psychotherapy note?
Only material that is useful to the author and not needed by anyone else to treat, bill or keep the patient safe. Anything in the 164.501 exclusion list goes in the record.
Are psychotherapy notes part of the medical record?
No. The definition requires them to be separated from the rest of the record. HHS adds that they do not include any information maintained in the medical record.
Can a patient get a copy of their psychotherapy notes?
The HIPAA right of access excludes them under 45 CFR 164.524(a)(1)(i). A more stringent state law still applies under 45 CFR 160.203(b).
Can psychotherapy notes be shared with another provider?
Only with a psychotherapy notes authorization, apart from the listed exceptions. HHS states that authorization is required even for treatment disclosures to a provider other than the originator.
Do insurance companies get psychotherapy notes?
Disclosure for payment needs an authorization, and a health plan cannot condition enrollment on one under 45 CFR 164.508(b)(4)(ii)(B). Medicare billing article A59723 states that documentation is not to include privileged information.
Do therapists have to keep psychotherapy notes?
No. HIPAA defines and protects them but does not require them. A clinician can keep none and put everything clinically relevant in the progress note.
Is there an AI tool that can write therapy notes for me?
Yes. mdhub's Emma drafts the progress note from your session in your template for you to review. Write any psychotherapy note yourself and store it separately.
Can psychotherapy notes be kept in the EHR?
Yes, if they are separated from the rest of the record. The definition covers notes recorded in any medium. A separate, access-controlled module meets the separation test. A note in the same field as the progress note does not.
Are psychotherapy notes protected health information?
Yes. They are a category of protected health information with extra rules on authorization and access, so every other Privacy Rule safeguard applies as well.
Can group therapy notes be psychotherapy notes?
Yes. 45 CFR 164.501 names group, joint and family counseling sessions alongside private sessions.
Can psychotherapy notes be used in supervision?
Yes, within the covered entity's own training programs where students, trainees or practitioners learn under supervision. That is an exception under 45 CFR 164.508(a)(2)(i)(B).
For the notes that do belong in the record, see our guides to DAP notes, BIRP notes and the SOAP note example. For the plan those notes report against, see the treatment plan template. For how session time is billed, see 90837.
Where mdhub Fits
Emma drafts the progress note from your session, in your template. You review and sign. Your psychotherapy notes stay yours to write. Start a free trial on your next session, or book a demo to see it in a group practice workflow.
