Keep Psychotherapy Notes or Not: The Separate-File Test in an EHR

Do you have to keep psychotherapy notes at all?

No. The Privacy Rule defines psychotherapy notes and attaches conditions to a note that meets the definition. It describes a document. Nothing in it tells a clinician to create one 1Ref 1U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The federal definition of psychotherapy notes, including the closing condition that they be separated from the rest of the individual's medical record, the content types the definition excludes (medication prescription and monitoring, session start and stop times, modalities and frequencies, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date), and the definition of the designated record set.. A solo practice that writes one progress note per session and files nothing else breaks no federal recordkeeping rule, and the question on the table is whether to open a second file.

The professional codes sit in about the same place. For counselors, the 2014 ACA Code of Ethics puts the floor at records and documentation necessary for rendering professional services 2Ref 2American Counseling Association (2014).2014 ACA Code of Ethics.The counseling profession's documentation floor at B.6.a (records and documentation necessary for rendering professional services), and the B.6.e limit on withholding records from a competent client to compelling evidence of harm with the request and rationale documented. Cited as binding on counselors only, not on other disciplines.. That is a standard about sufficiency, and it says nothing about separation. Social workers, marriage and family therapists and psychologists answer to their own codes, which the ACA code does not speak for.

So the two kinds of notes are a choice about who can later require you to hand over what you wrote.

What counts as a psychotherapy note under HIPAA

The definition is narrow, and it ends in a filing instruction. Psychotherapy notes are a mental health professional's own notes documenting or analyzing the conversation in a counseling session, individual or group, and the last clause requires that they be separated from the rest of the individual's medical record 1Ref 1U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The federal definition of psychotherapy notes, including the closing condition that they be separated from the rest of the individual's medical record, the content types the definition excludes (medication prescription and monitoring, session start and stop times, modalities and frequencies, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date), and the definition of the designated record set.. Separateness is part of what makes a note a psychotherapy note: a condition of the definition rather than a label applied to a note in the chart.

The same section then carves content out. Medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date are all excluded from the term 1Ref 1U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The federal definition of psychotherapy notes, including the closing condition that they be separated from the rest of the individual's medical record, the content types the definition excludes (medication prescription and monitoring, session start and stop times, modalities and frequencies, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date), and the definition of the designated record set.. Those categories are the chart, wherever they are typed. Moving them into a file labelled psychotherapy notes gives them no extra protection, and it buries material that belongs in the record a client can ask to see.

What is left is thin by design: the working hypothesis, the impression that has not earned a diagnosis yet, the clinician's own reaction to the hour. Read the definition once with your last ten notes open beside it.

What the separate file buys, and where it stops

Two protections, both real, both narrower than their reputation. A covered entity must obtain a separate authorization for any use or disclosure of psychotherapy notes, subject to a closed list of exceptions that includes the originator's own treatment use, the entity's own mental-health training programs, and defending itself in a legal action brought by the individual 3Ref 3U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The separate-authorization requirement for any use or disclosure of psychotherapy notes and its closed list of exceptions at (a)(2), the specific 164.512 paragraphs named in (a)(2)(ii) and the absence of 164.512(e) from that list, and the anti-bundling rule at (b)(3)(ii).. That authorization cannot be bundled: it may be combined only with another psychotherapy-notes authorization 3Ref 3U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The separate-authorization requirement for any use or disclosure of psychotherapy notes and its closed list of exceptions at (a)(2), the specific 164.512 paragraphs named in (a)(2)(ii) and the absence of 164.512(e) from that list, and the anti-bundling rule at (b)(3)(ii).. A general release-of-information form cannot reach them.

The second protection is access. The individual's right to inspect and copy protected health information runs to the designated record set and excludes psychotherapy notes, and the rule makes that an unreviewable ground for denial 4Ref 4U.S. Department of Health and Human Services (2026).45 CFR 164.524 - Access of individuals to protected health information.The individual right of access to protected health information in a designated record set, the exclusion of psychotherapy notes from it and its status as an unreviewable ground for denial, and the 30-day action clock with one extension of no more than 30 days.. Most denials of access carry an internal review. This one does not.

But the exception list is also where the protection stops.

The paragraph permitting disclosure without authorization in a judicial or administrative proceeding is 164.512(e). It is absent from the exceptions named in 164.508(a)(2)(ii), where the only 164.512 routes are 164.512(a), 164.512(d) as to oversight of the originator, 164.512(g)(1) and 164.512(j)(1)(i) 3Ref 3U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The separate-authorization requirement for any use or disclosure of psychotherapy notes and its closed list of exceptions at (a)(2), the specific 164.512 paragraphs named in (a)(2)(ii) and the absence of 164.512(e) from that list, and the anti-bundling rule at (b)(3)(ii).. Under 164.512(e) a court order supports disclosure of only the information the order expressly authorizes, while a bare subpoena or discovery request instead requires satisfactory assurance that the individual was notified or that a qualified protective order was sought 5Ref 5U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.Paragraph (e) only: that a disclosure in a judicial or administrative proceeding made in response to a court order is limited to the information the order expressly authorizes, and that a bare subpoena or discovery request instead requires satisfactory assurance of notice to the individual or of efforts to secure a qualified protective order.. What happens to psychotherapy notes in a subpoena from there is a privilege question decided under the law of the forum, and it is the point where a solo practice calls counsel instead of reasoning from the regulation.

The federal rule is a floor. HIPAA leaves a contrary state privacy provision standing where that provision is more stringent 6Ref 6U.S. Department of Health and Human Services, Office for Civil Rights (2002).45 CFR 160.203 - General rule and exceptions.The existence and direction of the preemption rule only: HIPAA preempts contrary state law except where the state provision relates to the privacy of individually identifiable health information and is more stringent. Cited for the frame that a state law can be stricter, never for the content of any state's statute., so a state mental-health confidentiality statute can hand a client access the federal carve-out withholds. Look up your own state's statute before telling a client what they can and cannot see.

The separate-file test, run against your own chart

Run one test before deciding: if a full record request arrived tomorrow, would these notes come out with everything else? The condition in the definition is separation from the rest of the individual's medical record 1Ref 1U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The federal definition of psychotherapy notes, including the closing condition that they be separated from the rest of the individual's medical record, the content types the definition excludes (medication prescription and monitoring, session start and stop times, modalities and frequencies, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date), and the definition of the designated record set., and separation is a property of how the notes are stored rather than of the field they were typed into. That is the psychotherapy notes separate-file test, and no federal source rates any product against it. Configuration answers it.

Five questions settle it for a given setup, and a vendor's support desk can answer all five in writing:

• Does a full chart export or a release-of-information packet include the psychotherapy notes by default, and can that be switched off?
• Can a covering clinician, a biller or an auditor be given the chart without also being given the notes?
• Does the audit trail record access to the two files separately?
• When the chart is printed for a client, does the note print with it?
• If the practice leaves the platform, do the notes come out as their own file?

A separate encrypted document kept outside the chart is one arrangement that answers all five. It carries its own problems: continuity when someone covers your caseload, backup, and a second retention clock to remember.

Passing it once does not settle it: any change to how the chart exports re-opens the test.

What goes in which file

Sort by the definition and most of the filing decides itself. Anything the rule excludes belongs in the progress note whatever else you do, and the residue is what a psychotherapy note can legitimately hold. The sorting matters most for the categories clinicians assume are private, in particular the treatment plan and progress to date, both excluded from the definition by name 1Ref 1U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The federal definition of psychotherapy notes, including the closing condition that they be separated from the rest of the individual's medical record, the content types the definition excludes (medication prescription and monitoring, session start and stop times, modalities and frequencies, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date), and the definition of the designated record set..

The progress note carries the weight either way. A payer, an auditor, a client, a future treating clinician and a records request all land on the same document, which is why the defensible note is the one worth spending the extra minutes on.

If you keep only progress notes

Then write the progress note for the reader who will eventually see it, because that reader exists. It sits in the designated record set, a client can request a copy, and the access rule gives a covered entity 30 days to act, extendable once by no more than 30 days 4Ref 4U.S. Department of Health and Human Services (2026).45 CFR 164.524 - Access of individuals to protected health information.The individual right of access to protected health information in a designated record set, the exclusion of psychotherapy notes from it and its status as an unreviewable ground for denial, and the 30-day action clock with one extension of no more than 30 days.. A note written with that in mind can still be clinically complete, and it is the note most solo practices end up keeping.

For counselors there is a second standard sitting on top of the federal one. ACA B.6.e limits withholding records from a competent client to cases of compelling evidence that access would cause harm, and it requires the request and the rationale both be documented 2Ref 2American Counseling Association (2014).2014 ACA Code of Ethics.The counseling profession's documentation floor at B.6.a (records and documentation necessary for rendering professional services), and the B.6.e limit on withholding records from a competent client to compelling evidence of harm with the request and rationale documented. Cited as binding on counselors only, not on other disciplines.. That is narrower than the federal carve-out, and it binds counselors alongside it.

Retention is the question that follows, and the six-year figure most clinicians have heard is the wrong clock for it. 45 CFR 164.530(j) requires a covered entity to keep the documentation the Privacy Rule itself demands, meaning its policies, procedures and required writings, for six years from the date of its creation or the date when it last was in effect, whichever is later 7Ref 7U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR § 164.530 — Administrative requirements.Paragraph (j) only: the six-year retention period for the documentation the Privacy Rule itself requires, measured from creation or from the date the document was last in effect, whichever is later. Cited expressly as a documentation clock and not as a clinical-record retention period.. That is a Privacy Rule documentation period. How long the clinical chart is kept comes from state law and your licensing board's rules, and that is the page to look up.

Decide once, then make the paperwork match: a therapist's notice of privacy practices handed out at intake should describe the files you actually keep.