What a Therapist's Privacy Notice Needs That a Medical One Doesn't

What must the notice say about psychotherapy notes?

One required element covers it. The notice must describe the types of uses and disclosures that require an authorization under 45 CFR 164.508(a)(2) through (a)(4), the paragraphs where psychotherapy notes sit alongside marketing and the sale of protected health information, and it must state that uses and disclosures the notice does not describe will be made only with the client's written authorization, which the client may revoke 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).45 CFR 164.520 - Notice of privacy practices for protected health information.The notice elements a therapy practice must carry: the prescribed header statement at (b)(1)(i), the description of uses and disclosures requiring an authorization under 164.508(a)(2)-(a)(4) with the revocation statement at (b)(1)(ii)(E), the requirement at (b)(1)(ii)(C) that a description reflect a more stringent other law such as 42 CFR part 2, the rights, complaints, contact and effective-date elements, and provision at first service delivery plus the good faith written acknowledgment at (c)(2)..

The rule prescribes the element and leaves the sentence to the practice. There is no model paragraph in the regulation and no approved wording to copy. What matters is that a reader can tell from the clause which categories need their own signature and that a signature already given can be withdrawn.

This is where a generic medical template tends to leave a therapy practice short. A notice written for a primary care office may carry the marketing and sale language and stop there, since a practice that keeps no counseling notes has no third category to name. The NPP a therapist hands out at intake has one.

The authorization rule the clause points at

A separate authorization, for almost everything. A covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, with a closed set of exceptions: the originator using them for treatment, the practice using them in its own mental health training programs, defending itself in a legal action or other proceeding brought by the client, and a short list of uses required or permitted elsewhere in the rule 2Ref 2U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The authorization requirement the notice clause points at: 164.508(a)(2)'s rule that a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes and its closed list of exceptions, and 164.508(b)(3)(ii)'s bar on combining a psychotherapy-notes authorization with any other kind of authorization..

The form matters as much as the rule. An authorization for a use or disclosure of psychotherapy notes may only be combined with another psychotherapy-notes authorization 2Ref 2U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The authorization requirement the notice clause points at: 164.508(a)(2)'s rule that a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes and its closed list of exceptions, and 164.508(b)(3)(ii)'s bar on combining a psychotherapy-notes authorization with any other kind of authorization.. So a practice running one all-purpose release that covers the chart, the billing file and anything else a client might want sent cannot stretch it to reach the notes. That is a second document, signed on its own.

But nothing on the exception list covers handing the notes to whoever asks for the whole file, which is why psychotherapy notes in a subpoena is a separate problem with a separate answer.

Describing the category in the notice is also how a practice sets the expectation early, months before a client signs a release at a new prescriber's office and assumes it reached everything the therapist wrote.

What counts as a psychotherapy note

Two conditions, both required. Psychotherapy notes are notes recorded in any medium by a mental health professional documenting or analyzing the contents of conversation during a counseling session, and separated from the rest of the individual's medical record 3Ref 3U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The federal definition of psychotherapy notes at 45 CFR 164.501: notes by a mental health professional documenting or analyzing the contents of a counseling session and separated from the rest of the record, plus the named exclusions (medication prescription and monitoring, session start and stop times, modalities and frequencies, clinical test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress).. Content that stays in the chart carries the ordinary protections whatever it is about, so the separation is what carries the legal weight.

The definition then excludes a list of things by name: medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date 3Ref 3U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The federal definition of psychotherapy notes at 45 CFR 164.501: notes by a mental health professional documenting or analyzing the contents of a counseling session and separated from the rest of the record, plus the named exclusions (medication prescription and monitoring, session start and stop times, modalities and frequencies, clinical test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress).. Those items belong in the record a client can request and a payer can audit. They are also the spine of the defensible note, and moving them into a private file gives them no extra lock.

So the psychotherapy notes separate-file test sits underneath the notice clause as a practical matter: does the practice keep such a file, and does the system of record hold it apart from the chart, or only as a tab inside it? The element itself is written around the rule's categories rather than around any one practice's filing habits, so the clause is worth carrying either way.

The header, the handout and the acknowledgment

Three mechanics with nothing to do with content, and all three are checkable in a minute. The notice must carry a prescribed statement as a header or otherwise prominently displayed, a direct treatment provider must give the notice no later than the date of first service delivery including service delivered electronically, and, except in an emergency treatment situation, must make a good faith effort to obtain a written acknowledgment of receipt 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).45 CFR 164.520 - Notice of privacy practices for protected health information.The notice elements a therapy practice must carry: the prescribed header statement at (b)(1)(i), the description of uses and disclosures requiring an authorization under 164.508(a)(2)-(a)(4) with the revocation statement at (b)(1)(ii)(E), the requirement at (b)(1)(ii)(C) that a description reflect a more stringent other law such as 42 CFR part 2, the rights, complaints, contact and effective-date elements, and provision at first service delivery plus the good faith written acknowledgment at (c)(2)..

The header wording is fixed, and it is the cheapest item on this page to fix: "THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY." A notice that paraphrases that sentence is missing a required element 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).45 CFR 164.520 - Notice of privacy practices for protected health information.The notice elements a therapy practice must carry: the prescribed header statement at (b)(1)(i), the description of uses and disclosures requiring an authorization under 164.508(a)(2)-(a)(4) with the revocation statement at (b)(1)(ii)(E), the requirement at (b)(1)(ii)(C) that a description reflect a more stringent other law such as 42 CFR part 2, the rights, complaints, contact and effective-date elements, and provision at first service delivery plus the good faith written acknowledgment at (c)(2)..

When no acknowledgment comes back, the rule wants the attempt documented along with the reason it failed 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).45 CFR 164.520 - Notice of privacy practices for protected health information.The notice elements a therapy practice must carry: the prescribed header statement at (b)(1)(i), the description of uses and disclosures requiring an authorization under 164.508(a)(2)-(a)(4) with the revocation statement at (b)(1)(ii)(E), the requirement at (b)(1)(ii)(C) that a description reflect a more stringent other law such as 42 CFR part 2, the rights, complaints, contact and effective-date elements, and provision at first service delivery plus the good faith written acknowledgment at (c)(2).. For a solo practice running intake electronically, that is one field in the intake record and one line in the file on the day a client signs nothing.

All of this presumes the practice is a covered entity, which is the covered-entity test and a question worth settling before drafting a word of the notice.

When other law is stricter than the federal floor

The notice bends to the stricter law rather than restating the federal minimum. Where a use or disclosure the notice describes is prohibited or materially limited by other applicable law, such as 42 CFR part 2, the description of that use or disclosure must reflect the more stringent law 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).45 CFR 164.520 - Notice of privacy practices for protected health information.The notice elements a therapy practice must carry: the prescribed header statement at (b)(1)(i), the description of uses and disclosures requiring an authorization under 164.508(a)(2)-(a)(4) with the revocation statement at (b)(1)(ii)(E), the requirement at (b)(1)(ii)(C) that a description reflect a more stringent other law such as 42 CFR part 2, the rights, complaints, contact and effective-date elements, and provision at first service delivery plus the good faith written acknowledgment at (c)(2).. HIPAA preempts contrary state law as a general rule, with an exception for a state privacy provision more stringent than the federal standard 4Ref 4U.S. Department of Health and Human Services, Office for Civil Rights (2002).45 CFR 160.203 - General rule and exceptions.The direction of the preemption rule only: HIPAA preempts contrary State law as a general rule except where the State provision relates to the privacy of individually identifiable health information and is more stringent. No state's own statute is characterized..

Two things follow for a therapy practice. The state question is real and it is not answered on this page: no state's mental health confidentiality statute is named here, and 45 CFR 160.203 supplies the direction of the preemption rule rather than the content of any state's law. Read your own state's confidentiality and release-of-records provisions against each clause of the notice before you print it.

The part 2 question is different, because part 2 carries its own notice on top of the HIPAA one. At the time of admission, a part 2 program must inform the patient that Federal law protects the confidentiality of substance use disorder patient records, and must also give a written notice in plain language with its own header block, its own account of how information may be used, patient rights, and how to file a complaint 5Ref 5U.S. Department of Health and Human Services (SAMHSA / Office for Civil Rights) (2024).42 CFR 2.22 - Notice to patients of Federal confidentiality requirements.The separate Part 2 patient notice a part 2 program owes: the oral notice at admission, the written plain-language notice and its header block, the content covering uses, patient rights and complaints, and the statement that records or testimony relaying their content will not be used or disclosed in civil, administrative, criminal or legislative proceedings against the patient absent consent or a court order.. That notice must also state that the records, or testimony relaying their content, will not be used or disclosed in civil, administrative, criminal or legislative proceedings against the patient without specific written consent or a court order 5Ref 5U.S. Department of Health and Human Services (SAMHSA / Office for Civil Rights) (2024).42 CFR 2.22 - Notice to patients of Federal confidentiality requirements.The separate Part 2 patient notice a part 2 program owes: the oral notice at admission, the written plain-language notice and its header block, the content covering uses, patient rights and complaints, and the statement that records or testimony relaying their content will not be used or disclosed in civil, administrative, criminal or legislative proceedings against the patient absent consent or a court order..

Whether a given therapy practice is a part 2 program at all is a separate test with its own definitions, and nothing here answers it.

What to check on the notice you are using now

Check the date first, then the clauses. The modified requirements for the notice of privacy practices carried a compliance date of February 16, 2026 6Ref 6U.S. Department of Health and Human Services, Office for Civil Rights (2024).HIPAA Privacy Rule To Support Reproductive Health Care Privacy.The dated compliance deadline for the modified Notice of Privacy Practices requirements at 45 CFR 164.520: February 16, 2026. Cited for that date alone.. It was set alongside the 2024 Part 2 rule, which took effect on April 16, 2024 and required compliance by that same February date, so a practice owing both notices could revise them in one pass 7Ref 7Substance Abuse and Mental Health Services Administration (2024).Confidentiality of Substance Use Disorder (SUD) Patient Records.The 2024 Part 2 final rule's effective date of April 16, 2024, its February 16, 2026 compliance date, and the deliberate alignment of the HIPAA notice and Part 2 patient notice changes so both could be revised at once.. A notice drafted before that work is worth reading line by line against the current text.

Every row there comes from one section of the rule 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2024).45 CFR 164.520 - Notice of privacy practices for protected health information.The notice elements a therapy practice must carry: the prescribed header statement at (b)(1)(i), the description of uses and disclosures requiring an authorization under 164.508(a)(2)-(a)(4) with the revocation statement at (b)(1)(ii)(E), the requirement at (b)(1)(ii)(C) that a description reflect a more stringent other law such as 42 CFR part 2, the rights, complaints, contact and effective-date elements, and provision at first service delivery plus the good faith written acknowledgment at (c)(2)., which makes the review a single read rather than a research project.

Then put the release form next to the notice. A practice whose notice names the psychotherapy-notes category while its paperwork offers one combined release for everything is describing a rule its own forms do not follow, and the form is the easier of the two to redraft.