Menu

HIPAA Psychotherapy Notes vs Progress Notes, With Examples

What HIPAA counts as psychotherapy notes, how they differ from progress notes, when they can be disclosed or subpoenaed, and invented examples of each.

Updated 12 min read

Psychotherapy notes have a narrower meaning than most therapists expect. If you searched for psychotherapy notes HIPAA rules, here is the short version: HIPAA gives extra protection only to notes that document or analyze what was said in a session and are kept apart from the client's record. Session times, symptoms, diagnosis, test results, the treatment plan and progress stay in the record, whatever you call the document they're written in.

Below you'll find the exact definition from the regulation, the comparison of psychotherapy notes vs progress notes as a list, the extra protections and every exception to them, what happens when a subpoena or court order arrives, how to keep the two kinds of notes apart, where state law changes the picture, and three invented sessions with both notes written out, plus a template you can copy.

Every client in this article is invented. This is general information, not legal advice. Where the answer turns on your state or your facts, the article says so, and those are questions for a health care lawyer in your state.

What HIPAA counts as psychotherapy notes

HIPAA's Privacy Rule defines the term in one paragraph (45 CFR 164.501):

"Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date."

A note is a psychotherapy note only when all three of these are true:

  1. A mental health professional wrote it. The protection follows the author, so a note written by a front desk worker or a billing service isn't one.
  2. It documents or analyzes the conversation in a session, whether individual, group, joint (couples) or family.
  3. It is kept separate from the rest of the record. A note kept in the chart isn't a psychotherapy note, however personal it feels.

HHS adds a sentence that settles most arguments: "Psychotherapy notes also do not include any information that is maintained in a patient's medical record" (HHS, Does HIPAA provide extra protections for mental health information?). Medicare's review manual makes the same point from the other side: "Physically integrating information excluded from the definition of psychotherapy notes and protected information into one document or record does not transform the non-protected information into protected psychotherapy notes" (CMS Medicare Program Integrity Manual, chapter 3, section 3.3.2.6). Labeling a progress note "private" doesn't change what it is.

Many therapists call these process notes or personal notes. HIPAA doesn't require you to keep them. HHS describes them as "the personal notes of the therapist that typically are not required or useful for treatment, payment, or health care operations purposes, other than by the mental health professional who created the notes." Progress notes are different: your license, your payers and your ethics code expect one for every session.

All of this is HIPAA, and HIPAA binds covered entities and their business associates. If you're not sure your practice is covered, read who HIPAA applies to first. State law and your ethics code protect session content either way.

What psychotherapy notes exclude, and where each item goes

The second sentence of the definition lists what can never be a psychotherapy note. Each item belongs in the record, usually in the progress note:

  • Medication prescription and monitoring:what the client takes, changes and side effects they report, and any coordination with the prescriber.
  • Session start and stop times:the progress note header, next to the date and who attended.
  • Modalities and frequencies of treatment:for example, "individual CBT, weekly, by video."
  • Results of clinical tests:PHQ-9 and GAD-7 totals and any other measure you give.
  • Any summary of diagnosis, functional status, the treatment plan, symptoms, prognosis and progress to date:the clinical core of every progress note.

The word "summary" matters. Your clinical conclusions belong in the record. What can sit in psychotherapy notes is the material under them: your analysis of the conversation, detail you don't need in order to treat the client, and your own process.

Psychotherapy notes vs progress notes

Here is the comparison, point by point:

  • What it is.Progress note: the record of a session. Psychotherapy note: your own analysis of the conversation, kept apart from the record.
  • Who reads it.Progress note: you, other treating clinicians, payers, auditors and usually the client. Psychotherapy note: you.
  • What's in it.Progress note: date, times, who attended, modality, symptoms, risk, interventions, response, test results, diagnosis, plan and progress. Psychotherapy note: process observations, hypotheses, your reactions, sensitive detail beyond what care needs, questions for supervision.
  • Is it required?Progress note: yes, for every session. Psychotherapy note: no, it's optional.
  • Format.Progress note: usually a structured format such as SOAP, DAP or BIRP. Psychotherapy note: any format, often unstructured.
  • Where it's kept.Progress note: in the client's record. Psychotherapy note: separately, or it isn't one.
  • Client access under HIPAA.Progress note: part of the client's right of access. Psychotherapy note: excluded from it, though you may choose to share.
  • Sharing with another provider for treatment.Progress note: HIPAA permits it without an authorization (45 CFR 164.506), though state law may be stricter. Psychotherapy note: needs the client's authorization.
  • Insurers.Progress note: payers can review it to decide a claim. Psychotherapy note: a health plan can't make an authorization a condition of enrollment, and Medicare's reviewers may not ask for them.
  • Subpoenas and court orders.Both can be demanded, and privilege can protect both. Psychotherapy notes add HIPAA's authorization rule unless an exception applies, such as a court order.

A progress note has to stand on its own. If a reviewer, a covering clinician or the client read only the record, they should find everything care requires. The progress notes cheat sheet has the clinical wording for each part.

The extra protections HIPAA gives psychotherapy notes

An authorization for almost any use or disclosure

The rule is blunt: "a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes," with a short list of exceptions (45 CFR 164.508(a)(2)). HHS spells out what that means for treatment: an authorization is needed "for any reason, including a disclosure for treatment purposes to a health care provider other than the originator of the notes." Progress notes can go to a client's psychiatrist for treatment without an authorization; psychotherapy notes can't.

Its own form

An authorization for psychotherapy notes "may only be combined with another authorization for a use or disclosure of psychotherapy notes" (164.508(b)(3)(ii)). A general release that says "all records" doesn't cover them. The release of information form article includes a separate psychotherapy notes authorization you can copy.

Not a condition of insurance

A health plan may ask for some authorizations before enrollment, but not one for psychotherapy notes (164.508(b)(4)(ii)(B)). Medicare's manual tells its reviewers: "Under no circumstances shall the MACs, CERT, RACs, SMRC, or UPICs request that a provider submit psychotherapy notes," and "The refusal of a provider to submit such information shall not result in the automatic denial of a claim." The same section adds that a claim is denied if the provider doesn't submit enough to show the services were medically necessary. Your progress notes carry the claim.

Outside the client's right of access

Clients have a right to see and copy their record, "except for: (i) Psychotherapy notes" (45 CFR 164.524(a)(1)). A denial on that ground isn't reviewable (164.524(a)(2)(i)). That's a permission to say no, not a duty: HHS says "HIPAA generally gives providers discretion to disclose the individual's own protected health information (including psychotherapy notes) directly to the individual or the individual's personal representative," and tells providers to check state law first (HHS, HIPAA Privacy Rule and Sharing Information Related to Mental Health). The same guidance says a parent has no HIPAA right to a child's psychotherapy notes, though parents can generally see the child's record.

When psychotherapy notes can be disclosed without authorization

These are all the exceptions in 45 CFR 164.508(a)(2), in plain words:

  1. Your own use to treat the client: "Use by the originator of the psychotherapy notes for treatment." It covers your use only; sending them to another provider still needs an authorization.
  2. Supervised training in your own practice: the practice's "own training programs in which students, trainees, or practitioners in mental health learn under supervision."
  3. Defending yourself against the client: use or disclosure "to defend itself in a legal action or other proceeding brought by the individual."
  4. An HHS compliance investigation: when the Secretary of HHS requires it to check compliance (164.502(a)(2)(ii)).
  5. When another law requires it: disclosures "required by law," limited to what that law requires (45 CFR 164.512(a)). HHS's examples are "mandatory reporting of abuse, and mandatory 'duty to warn' situations," and it notes that "State laws vary as to whether such a warning is mandatory or permissible." Court orders also fall under required by law; see the next section.
  6. Oversight of you: a health oversight agency's oversight "of the originator of the psychotherapy notes" (164.512(d)). Oversight activities include "licensure or disciplinary actions."
  7. A coroner or medical examiner: to identify a person who has died or find the cause of death (164.512(g)(1)).
  8. A serious and imminent threat: in good faith and "consistent with applicable law and standards of ethical conduct," to prevent or lessen "a serious and imminent threat to the health or safety of a person or the public," disclosed to someone reasonably able to prevent it (164.512(j)(1)(i)).

Most of these allow a disclosure; they don't require one. Share only what the purpose needs, and check your state's law, which can be stricter and then applies. Sharing with the client themselves is the separate case covered above: generally your choice under HIPAA, subject to state law.

Can psychotherapy notes be subpoenaed?

Yes: a subpoena can ask for them, and so can a court order. Whether you may or must hand them over is a separate question, answered by HIPAA, privilege law and state law together. Two points hold almost everywhere. Responding to a subpoena is not the same as disclosing records. And an order signed by a judge carries more weight than a subpoena signed by a lawyer.

Authorization, court order and subpoena are different things

  • An authorization is the client's signed permission. For psychotherapy notes it must be a psychotherapy notes authorization. With one, HIPAA allows the disclosure.
  • A court order is signed by a judge or an administrative tribunal. HIPAA allows disclosure "in response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order" (164.512(e)(1)(i)). HIPAA's definition of "required by law" includes "court orders and court-ordered warrants" (45 CFR 164.103), which is how a court order can reach psychotherapy notes without the client's authorization.
  • A subpoena issued by someone other than a judge, such as a court clerk or an attorney in the case, "is different from a court order," in HHS's words (HHS, Court Orders and Subpoenas). For records in general, HIPAA lets you respond only after you receive "satisfactory assurance" that the client was given notice and a chance to object, or that a qualified protective order was sought (164.512(e)(1)(ii)).

Whether a subpoena alone can reach psychotherapy notes without the client's authorization is a question for a lawyer. HIPAA's definition of required by law names subpoenas "issued by a court," the subpoena rules in 164.512(e) still apply, and state privilege law usually adds its own barrier. The American Psychological Association's Committee on Legal Issues puts the usual position this way: the clinical record and "any separately kept psychotherapy notes" "usually may be turned over to the court with appropriate authorization by the Client/Patient or with a court order" (APA, Strategies for Private Practitioners Coping With Subpoenas).

Privilege: Jaffee v. Redmond and state law

HIPAA governs what a covered provider may disclose. Privilege governs what a court can make you reveal. In Jaffee v. Redmond, 518 U.S. 1 (1996), the Supreme Court held "that confidential communications between a licensed psychotherapist and her patients in the course of diagnosis or treatment are protected from compelled disclosure under Rule 501 of the Federal Rules of Evidence" (Jaffee v. Redmond, opinion of the Court). The case turned on a licensed clinical social worker's session notes, and the Court extended the privilege to "licensed social workers in the course of psychotherapy." It rejected a privilege that a judge weighs case by case, and said in a footnote that "there are situations in which the privilege must give way, for example, if a serious threat of harm to the patient or to others can be averted only by means of a disclosure by the therapist."

Read the case narrowly:

  • It sets the federal rule.Jaffee applies in federal court. Rule 501 itself says that "in a civil case, state law governs privilege regarding a claim or defense for which state law supplies the rule of decision" (Federal Rules of Evidence, Rule 501). Most cases where therapy records come up, such as divorce, custody and personal injury, are in state court under state privilege law.
  • Every state has a version, and they differ.The Court noted that "all 50 States and the District of Columbia have enacted into law some form of psychotherapist privilege." States differ on which professions are covered, when a client waives it (for example, by putting their own mental health at issue in a lawsuit), how custody cases are handled, and whether a judge may balance need against privacy, which the Court said in 1996 "a small number of States" did.
  • It protects communications, not a type of document.Privilege can cover progress notes as well as psychotherapy notes. HIPAA's psychotherapy notes rules don't create a privilege, and a privilege doesn't depend on how you filed the note.
  • It usually belongs to the client."In most jurisdictions, the privilege belongs to the Client/Patient, not to the therapist," the APA committee writes, and the rules "often allow the psychologist to assert privilege on behalf of the Client/Patient in the absence of a specific release or court order."

What to do when a subpoena arrives

  1. Don't ignore it, and don't send anything yet. Note the deadline. As the APA committee puts it, "Responding to the subpoena, however, does not necessarily entail disclosing confidential information."
  2. Read what it is. Signed by a judge, or by an attorney or clerk? Which court, in which state? Records, testimony or both? The APA committee notes that a subpoena may not bind you if the court lacks jurisdiction over you or it wasn't properly served.
  3. Call your malpractice insurer's risk line or a health care lawyer. Some malpractice carriers cover a legal consultation for this.
  4. Contact the client. Ask whether they will sign an authorization or want to object. Courts are "generally more receptive" to a motion to quash or a motion for a protective order filed by the client than one filed by the therapist, according to the APA committee.
  5. Without an authorization or a court order, assert the privilege where your state's rules allow it, and send nothing confidential.
  6. Offer less if it meets the need. With the client's agreement, a treatment summary may do instead of full notes. The APA committee also mentions handing over only nonconfidential material, or an affidavit limited to nonconfidential information.
  7. If a court orders release, send only what the order expressly covers. Ask your lawyer whether the court will review the notes privately first or seal them.
  8. Keep a record of the request, who you spoke to, what you sent, to whom and when.

Keeping psychotherapy notes separate in practice

HIPAA doesn't say how to separate them. These habits follow from the definition and HHS's guidance:

  • Decide whether you need them at all.Many clinical needs are met by a good progress note and supervision. Every page you keep is a page that can be requested.
  • Keep them out of the chart.Not in the session note, not attached to it, not in the billing record, not in the folder your practice uses for records.
  • Electronic is fine.The definition says "in any medium." The separation has to be real: a separate, access-controlled place only you can open.
  • Protect them like any other PHI.HIPAA requires safeguards "for whatever period such information is maintained by a covered entity, including through disposal" (HHS FAQ 580).
  • Write the clinical summary in the progress note first.If something in your private notes changes the diagnosis, the risk picture or the plan, the summary goes in the record. Risk never lives only in psychotherapy notes.
  • Keep the excluded items out.No session times, diagnoses, scores, medication or plan summaries.
  • Write them as if they could be read.An authorization, a court order, a licensing board or a state access law can put them in front of someone else.
  • De-identify before outside consultation.Supervision inside your own practice's training program is an exception; sharing with a consultant outside it isn't. Strip the details in the 18 HIPAA identifiers list before you talk a case through.
  • Tell clients in your informed consent.The informed consent example has a line for whether you keep separate personal notes.
  • Set a retention period and a disposal method.HHS says the Privacy Rule "does not include medical record retention requirements" and that "State laws generally govern how long medical records are to be retained."

State laws that differ

HIPAA is a floor, not a ceiling. A state law that "relates to the privacy of individually identifiable health information and is more stringent" than HIPAA survives (45 CFR 160.203(b)). "More stringent" includes a state law that "permits greater rights of access" for the client, and one that "prohibits or restricts a use or disclosure" HIPAA would allow (45 CFR 160.202). So a state can give clients access to notes HIPAA excludes, require consent where HIPAA doesn't, or define its own category of protected notes.

Illinois is an example of the last. Its Mental Health and Developmental Disabilities Confidentiality Act defines "personal notes" as "(i) information disclosed to the therapist in confidence by other persons on condition that such information would never be disclosed to the recipient or other persons; (ii) information disclosed to the therapist by the recipient which would be injurious to the recipient's relationships to other persons, and (iii) the therapist's speculations, impressions, hunches, and reminders." They stay out of the record only "if such notes are kept in the therapist's sole possession for his own personal use and are not disclosed to any other person, except the therapist's supervisor, consulting therapist or attorney," and "If at any time such notes are disclosed, they shall be considered part of the recipient's record" (740 ILCS 110/2). That is a different test from HIPAA's, and a therapist in Illinois has to meet both.

Other places states commonly differ:

  • Minors and parents:who can see a minor's records, and from what age the minor controls them.
  • Duty to warn:mandatory in some states, permitted in others.
  • Privilege and subpoenas:which professions are covered, the exceptions, and what notice or court order a request for mental health records needs.
  • Retention:how long you keep records after the last session, often with separate rules for minors.
  • Board rules:what your licensing board says a record must contain.

One federal rule sits beside HIPAA. A federally assisted substance use disorder program under 42 CFR Part 2 has a parallel category, "SUD counseling notes" (42 CFR 2.11), which needs its own consent for most uses and disclosures (42 CFR 2.31(b)).

Questions to take to a health care lawyer in your state:

  • Can my clients see my psychotherapy notes under state law?
  • Does an attorney's subpoena reach mental health records here, and what notice or court order has to come with it?
  • For a couples or family session, who holds the privilege and who can authorize release?
  • Is a duty to warn mandatory or permitted here, and what does it allow me to share?
  • How long must I keep records and any separate notes?
  • In a group practice, can a covering clinician read my notes?

What to put in each: psychotherapy notes examples

Three invented sessions follow, each with the progress note and the psychotherapy note written the same day. The progress notes are short DAP notes; the DAP notes examples article has full-length ones.

Example 1: an individual session

Invented client: a 29-year-old software tester we'll call Rafael, in his sixth session of weekly CBT for social anxiety.

Progress note (in the record)

  • Date of service: 10/14, 4:00 to 4:50 PM, session 6
  • Individual psychotherapy by video; client at home in Ohio, private room confirmed
  • Treatment plan goal 1: speak up in team meetings at least twice a week

Data: Client reported speaking once in a team meeting this week, up from none, and said, "My voice shook but nobody noticed." Rated distress 70/100 before and 40/100 after a rehearsed role play of asking a question in a meeting. Completed the thought record twice; main thought: "They'll think I'm incompetent." Denied thoughts of harming himself or others when asked.

Assessment: Early progress toward goal 1. Distress fell within the session with rehearsal, which supports continued graded exposure. Strong predictions of negative evaluation still drive avoidance. Continued weekly therapy is needed.

Plan: Speak up in two meetings before the next session, with one prepared question each. Thought record on three days. Next session 10/21 by video.

Psychotherapy note (kept separately)

Wording to copy15 lines
Psychotherapy note: keep separate from the recordClient code: R-06Session date: 10/14
Process:Apologized four times in the first ten minutes,each time after I paused to think.Hypothesis: my silences may read as disapproval,like the silences he describes growing up.Next time: say out loud when I'm pausing to think.
My reactions:Felt pulled to reassure him, and did, twice.Reassurance in session may feed the avoidance.
For supervision:Name the pattern in the room now, or waituntil exposure is further along?

What went where: the meeting count, distress ratings, homework, risk screen and plan are symptoms, test results, progress and the plan, so they are in the record. The private note holds analysis that isn't yet part of the formulation. If the pattern becomes a treatment target, a one-line summary moves into the progress note's Assessment.

Example 2: a couples session

Invented clients: a married couple we'll call Priya and Tom, in their seventh session, working on conflict about money.

Progress note (in the record)

  • Date of service: 10/15, 6:00 to 6:50 PM, session 7
  • Couples psychotherapy in person; both partners attended
  • Treatment plan goal 1: discuss money without an argument that ends the conversation

Data: Both reported two arguments about spending this week; one ended with Tom leaving the house for an hour. Each was asked privately at the start of the session about fear or physical aggression at home; both denied any. Practiced a structured speaker-listener exercise on one disagreement; each partner summarized the other's view accurately on the second attempt.

Assessment: A pursue-withdraw cycle drives the money arguments: Priya presses when she feels unheard and Tom leaves when he feels criticized. Both can use the structure with coaching. Progress on goal 1 has begun.

Plan: One 20-minute structured talk at home this week, using the speaker-listener steps. Next session 10/22 in person.

Psychotherapy note (kept separately)

Wording to copy11 lines
Psychotherapy note: keep separate from the recordClients: couple P-TSession date: 10/15
Process:I sided with Tom in the second half;Priya went quiet after that.Repair this at the start of next session.Tom's "fine" closes every hard topic.
For consultation:Is the money conflict standing in for theundecided question of having children?

The private-screening answers are in the record because they bear on safety and on whether couples work is appropriate. Whose consent a couples note needs before release is a state-law question for your lawyer.

Example 3: a risk disclosure, the note that can't stay private

Invented client: a 58-year-old retired teacher we'll call June, grieving her husband's death eight months ago, in her fourth session.

The mistake to avoid is writing this only in private notes: "She said some nights she'd rather not wake up. Worried." That leaves the record silent about risk. A covering clinician, an emergency team or a reviewer would never see it. Risk is a symptom and part of treatment, so it belongs in the record.

Progress note (in the record, risk portion)

Data: Client said, "Some nights I'd rather not wake up." When asked directly, she denied any thoughts of acting on it, any plan, intent or past attempts. Confirmed no firearms at home. Talks with her sister daily and attends a weekly church group. PHQ-9 item 9 answered "several days."

Assessment: Passive wish to be dead, new since the last session, in the context of grief, without plan or intent, and with protective factors present. Risk judged low at this time; needs monitoring at each session.

Plan: Wrote a safety plan together, including warning signs, people to call and the 988 Suicide and Crisis Lifeline; client kept a copy. Client agreed to call her sister or 988 if the thoughts change. Ask about risk at the start of every session. Next session in one week.

Psychotherapy note (kept separately)

Wording to copy10 lines
Psychotherapy note: keep separate from the recordClient code: J-04Session date: 10/16
My reactions:Her words hit hard; a relative of mine saidnearly the same after a death in the family.Check I'm not over- or under-reacting to it.
For consultation:Talk through my risk reading with a colleaguethis week, de-identified.

The safety plan template has the six steps in full.

Progress note or psychotherapy note? 16 items sorted

  • Session date, start and stop time, who attended: progress note.
  • Modality and frequency: progress note.
  • Diagnosis, or a change to it: progress note.
  • PHQ-9, GAD-7 and other scores: progress note. They are "results of clinical tests."
  • Symptoms, functioning and progress toward goals: progress note.
  • Risk questions, the client's answers, your reading and the safety steps: progress note, always.
  • Interventions and how the client responded: progress note.
  • Medication and any change to it: progress note.
  • The plan and the next session: progress note.
  • Releases signed, and who you spoke to outside the session: the record.
  • A hunch you're not ready to act on: psychotherapy notes, or the progress note's Assessment worded as a working hypothesis.
  • Your own reactions and countertransference: psychotherapy notes or supervision.
  • Questions for supervision or consultation: psychotherapy notes.
  • Verbatim detail of sensitive material beyond what care needs, such as a dream or a sexual history detail: psychotherapy notes, with the theme in the progress note.
  • Details about other people that care doesn't need: psychotherapy notes, or nowhere.
  • Something the client asked you not to write down: the record still needs what care requires. Tell the client what goes in the record, and remember that psychotherapy notes are not a secret file.

A psychotherapy notes template you can copy

Keep it short. Fill in only what is useful to you, and save it somewhere separate from the client's record.

Psychotherapy noteTemplate · 8 parts to fill in
PSYCHOTHERAPY NOTEKeep separate from the client's record.Not for the chart, billing or records requests.
Client code: [code, not full name]Session date: [MM/DD/YYYY]Progress note written: [yes / no]
What I noticed in the conversation:[process, patterns, what was said between the lines]
Working hypotheses:[ideas not yet part of the formulation]
My reactions:[what I felt, what pulled at me]
For supervision or consultation:[questions; de-identify before sharing outside]
To come back to:[themes to explore later]
Check before saving:No session times, diagnosis, scores or medication.No plan or progress summary.Anything about risk is in the progress note.Anything that changes the plan is summarizedin the progress note.

How this works in TranqBay

  • Notes live with the session.The note you write after a session sits with that session, in BIRP, DAP, SOAP or GIRP format or as a blank note. Structured formats are part of the advanced note templates, which some plans include.
  • Treat a session note as a progress note.A note kept with the session is part of the client's record. Write symptoms, risk, interventions and the plan there, and leave psychotherapy note material out: under HIPAA's definition, notes kept with the record are not psychotherapy notes. If you keep psychotherapy notes, keep them somewhere separate from your session notes.
  • Release of information.The form library has ready-made templates you send a client for a session, including a release of information form the client fills in online; the answers wait with the session. On it the client chooses what you may share: attendance, diagnosis, the treatment plan, progress updates and risk information. Psychotherapy notes aren't on that list, and they need their own authorization, like the one in the release of information form article.
  • Video sessions are end-to-end encrypted.TranqBay's Business Associate Agreement applies when you accept the Terms, with no separate document to sign.

practice.tranqbay.health shows a session's page with its note, so you can see where your progress notes would sit before you set up a practice website and booking.

Frequently asked questions about psychotherapy notes and HIPAA

What are psychotherapy notes under HIPAA?

Notes a mental health professional writes that document or analyze the conversation in a session and are kept separate from the rest of the record (45 CFR 164.501). They exclude session times, modality and frequency, medication, test results and any summary of diagnosis, functional status, the treatment plan, symptoms, prognosis and progress.

What is the difference between psychotherapy notes and progress notes?

A progress note is the record of a session: required, structured, and readable by payers, other clinicians and usually the client. A psychotherapy note is your optional, separate analysis of the conversation. HIPAA protects it more: most uses and disclosures need the client's authorization, and it is outside the client's right of access.

Can clients see their psychotherapy notes?

Not as a HIPAA right: the right of access excludes them (45 CFR 164.524). HHS says you generally have discretion to share them with the client. A state law that gives clients broader access applies instead.

Can psychotherapy notes be subpoenaed?

A subpoena can ask for them. Before you release anything, you generally need the client's psychotherapy notes authorization or a court order, and state privilege law may protect them either way. Call the client and a lawyer before you respond.

When can psychotherapy notes be disclosed without authorization?

Only in the exceptions in 164.508(a)(2): your own use for treatment, your practice's supervised training, your defense in a proceeding the client brings, an HHS investigation, disclosures required by law (including court orders and mandatory reports), oversight of you, a coroner or medical examiner, and a serious and imminent threat.

Do I have to keep psychotherapy notes?

No. Nothing in HIPAA requires them, and HHS describes them as notes that "typically are not required or useful" for treatment, payment or operations beyond the therapist who wrote them. Progress notes are required.

Can insurance companies ask for psychotherapy notes?

A health plan can't make a psychotherapy notes authorization a condition of enrollment or eligibility (164.508(b)(4)), and Medicare's reviewers may not request them. Payers can review your progress notes, which have to show the service was medically necessary.

Can parents see their child's psychotherapy notes?

HHS says a parent has no HIPAA right of access to them, though parents generally can see the child's record as the child's personal representative. State law on minors varies a great deal; check yours.

Can psychotherapy notes be kept electronically?

Yes. The definition covers notes "recorded (in any medium)." They must still be kept separate from the record, with access limited to you.

How long should I keep psychotherapy notes?

HIPAA doesn't set a retention period; state law generally governs records, and your board may add rules. Protect the notes for as long as you keep them, and dispose of them securely.

Can I share psychotherapy notes with another therapist?

Not without the client's authorization, even for treatment. You can share progress note information for treatment, and you can discuss a de-identified case in consultation.

Before you write your next note

Write the progress note first, every session, complete enough to stand on its own. If you keep psychotherapy notes, keep them short, separate, and without anything the record needs. When a request arrives, check what it is before you send anything.

If you want booking, video sessions and session notes in one place, see how TranqBay works for private practice: you can look at a practice website design and the booking page your clients would use. If you're deciding whether to join, this page explains how joining TranqBay works.

Sources

18 sources

Regulations 10HHS 4CMS 1Associations 1States 1988 Lifeline 1

Updated October 25, 2026. Found it useful? Send it to a colleague.

Run your practice in one place.

Your own website, online booking and video sessions.

  • Your own website
  • Online booking
  • Video sessions
See how it workspractice.tranqbay.health

More guides for therapists

All guides

In crisis? Don't use this site. Get immediate help or call emergency services.