The payer wants notes: send progress notes, shield psychotherapy notes

What to send when a payer asks for therapy records

When a payer requests therapy records — for a claims review, a medical-necessity check, or a routine chart request — send the progress notes: the content documenting each date of service, the intervention delivered, and the plan. Do not send psychotherapy notes, the separate file HIPAA treats as a second, more heavily guarded record, unless the client has signed a specific authorization naming that disclosure 1Ref 1HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are a separate, more heavily protected file requiring specific authorization, distinct from the general mental-health record a routine request reaches..

The distinction is not a technicality you can skip because keeping two files takes extra effort. Payers and their auditors know the two-kinds-of-notes rule; a chart response that includes private process notes without authorization is a privacy exposure you created, not one they asked for.

If you have never kept a separate psychotherapy-notes file, everything you hold is, by definition, part of the general record and reachable under a standard disclosure — the strongest argument for starting the separation now, before the next request arrives.

Progress notes: the part of the record a payer request reaches

Progress notes are the operative record for payer purposes: date of service, presenting concern, intervention delivered, response, and plan, tied to the CPT code billed for that visit. This is the file HIPAA's treatment-payment-operations permission covers without a separate patient authorization, subject to the minimum-necessary standard — send what answers the request, not the entire chart by default 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits treatment-payment-operations disclosures without separate authorization, subject to the minimum-necessary standard..

A payer's records request is usually anchored to a specific claim or date range, and your response should track that scope rather than forwarding everything on file out of caution. Sending more than requested does not make you more compliant; it just expands what left your practice.

If a note in that date range reads like it was copied forward from the prior visit with only the date changed, expect a reviewer to notice — copy-forward in therapy notes is one of the fastest ways an ordinary records request turns into an audit finding, because the note reads as though it was not actually written to that day's session.

Psychotherapy notes: the part it doesn't

Psychotherapy notes are HIPAA's narrower category: your own process notes, kept separate from the rest of the record, documenting session content and your private analysis, and excluded from the routine disclosures that reach the rest of the chart 1Ref 1HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are a separate, more heavily protected file requiring specific authorization, distinct from the general mental-health record a routine request reaches.. A payer cannot compel these with the request that reaches your progress notes — HIPAA's second lock on psychotherapy notes requires its own specific authorization, naming the disclosure, before you may release them.

What qualifies is narrower than most clinicians assume: medication prescription and monitoring, session start and stop times, treatment modalities and frequency, test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress are explicitly carved out of the definition — they belong in the progress note a payer can reach, not the shielded file, even if you also happen to keep them in a separate binder.

If you have been storing content that actually qualifies as psychotherapy notes inside the same file as your progress notes, a payer's request is the moment that mixing becomes a problem: you cannot selectively withhold pages from one undifferentiated file the way you can decline to produce a separately maintained one.

Substance use records: the extra layer of Part 2

If the record involves treatment at, or by, a federally assisted substance use disorder program, 42 CFR Part 2 layers extra protection on top of HIPAA: redisclosure stays restricted even after you release records with consent, and a payer's standard request does not automatically satisfy Part 2's own consent requirements 3Ref 3Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.That Part 2 restricts redisclosure of covered substance use disorder records even after consent-based release, layering on top of HIPAA.. The 2024 update aligned much of Part 2 with HIPAA's treatment-payment-operations consent model, but the alignment is not total, and Part 2 information still carries a redisclosure notice obligation HIPAA-only records do not 4Ref 4U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.That the 2024 final rule aligned much, but not all, of Part 2 with HIPAA's TPO consent model, while keeping a distinct redisclosure notice obligation..

The practical trigger is whether your practice or program falls within Part 2's federal-assistance definition — many solo behavioral health practices do not, and an ordinary mention of substance use inside a general mental-health record is not automatically Part 2-protected on its own. When in doubt about whether Part 2 attaches to a specific record, resolve that question before a payer request forces the answer, not during it.

Minimum necessary: sending only what supports the ask

HIPAA's minimum-necessary standard applies to what you send a payer just as it applies to any other disclosure: match your response to the scope of the request — the claim, the date range, the specific service — rather than attaching the full chart as a matter of habit. Payers and the chart is a relationship of scoped requests, not open access; an audit letter asking about three sessions is not an invitation to send the whole treatment history.

This discipline also protects you: the less you send beyond what was asked, the less there is for a reviewer to flag that was never part of the original question. If a group session note is part of what's requested, confirm it is individualized to the client named in the request before it goes out — group notes that read identically for every member are exactly the kind of finding a minimum-necessary review surfaces, whether or not the reviewer went looking for it.

When a request is vague — "all records for this client" — it is reasonable to ask the payer to specify the date range or claim at issue before you respond, rather than guessing at scope on your own.

When it's not really a payer request: subpoenas and audits

Not every document demanding records is the same kind of request, and the response track differs by which one arrives. A payer's routine records request for a claims review runs through HIPAA's treatment-payment-operations permission; a subpoena without an accompanying court order does not automatically authorize disclosure and instead requires satisfactory assurances of notice to the patient, or a qualifying protective order, before you produce anything 5Ref 5HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That a subpoena without a court order does not by itself authorize disclosure, requiring satisfactory assurances of notice or a protective order first..

If a chart audit turns up an overpayment finding, the next document you may see is a formal takeback letter rather than a simple request for more records — a different process with its own appeal clock, not a continuation of the records request itself. Confusing the two can cost you the window to challenge a finding you might otherwise have contested.

When you are not sure which category a document falls into — payer request, subpoena, or a program-integrity audit — treat the uncertainty itself as the reason to slow down and confirm before releasing anything, rather than defaulting to full disclosure to avoid conflict.

Getting the mechanics right: signatures, format, and turnaround

Whatever you send must be authenticated the way Medicare and most payers expect: a legible signature or a compliant electronic signature on each note, with an attestation statement available if a signature was missed on an older entry 6Ref 6Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.That records sent to Medicare and payers must carry a compliant signature or attestation, and what counts as adequate authentication.. An unsigned note is a documentation defect a payer's reviewer will flag regardless of how sound the clinical content is.

Format matters less than authentication and scope, but keep a consistent, exportable version of your notes so a records request does not become its own project — a dated, paginated PDF or your EHR's native export is normally sufficient. Track the turnaround deadline the payer's letter states, and calendar it the day the request arrives rather than the day before it is due.

A disorganized response — records out of order, some notes missing signatures, no cover letter identifying what is and is not included — invites more scrutiny than the underlying clinical care ever would. Treat the response itself as a work product, not an afterthought.