Who's Asking for the Therapy Record: What Each Requester Gets

Who is asking decides what you give

Who is asking, and what instrument they bring, decides what you hand over. Each requester gets what the law lets that requester receive, and no more. The client gets the record on request. Another treating provider gets what treatment needs, with no release. A payer gets what the claim needs. An attorney, an employer, a school or an investigator gets nothing without a signed authorization. A court gets what its order names. That is the federal baseline; your state can raise it.

But the federal rule is a floor, and for a behavioral health record the state layer is usually the part that bites. The privacy rule says so itself: on a minor's records it defers to state or other law, including case law, in either direction, and where a state has said nothing it hands the call to the licensed professional's judgment 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.502 Uses and disclosures of protected health information: General rules..The personal-representative rule at 164.502(g)(1), the deference to state or other law in both directions on an unemancipated minor's records at (g)(3)(ii), the abuse, neglect and endangerment election at (g)(5), and the minimum-necessary standard at (b) with its exception for disclosures to a provider for treatment.. States also write their own rules on withholding mental health records from an adult.

Find your state's rule before you answer anyone. Three lookups cover most of it: the patient-records section of your state's health code (in California, Health and Safety Code 123100 and following), your licensing board's practice act and its records rules, and your state's minor-consent statute for behavioral health. Search the legislature's own code site rather than a summary, which is where a neighboring state's rule sneaks in.

What the record is, and what psychotherapy notes are

The record a requester can reach is the designated record set: the medical and billing records you keep about the client, and anything else you use to make decisions about them 2Ref 2U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The definition of designated record set, including billing, enrollment and case-management records, and the definition of psychotherapy notes with its list of excluded content (medication, session times, modalities and frequencies, test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress).. Psychotherapy notes sit outside it. Federal law defines them narrowly: notes a mental health professional records, in any medium, documenting or analyzing the contents of a conversation in a counseling session, and kept separate from the rest of the record 2Ref 2U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The definition of designated record set, including billing, enrollment and case-management records, and the definition of psychotherapy notes with its list of excluded content (medication, session times, modalities and frequencies, test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress)..

A note that sits in the chart is not a psychotherapy note, whatever it contains. The definition also lists what they are not, excluding medication prescription and monitoring, session start and stop times, the modalities and frequencies of treatment, results of clinical tests, and any summary of diagnosis, functional status, the treatment plan, symptoms, prognosis and progress to date 2Ref 2U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The definition of designated record set, including billing, enrollment and case-management records, and the definition of psychotherapy notes with its list of excluded content (medication, session times, modalities and frequencies, test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress).. That excluded list is, roughly, a progress note. So the progress note is in the designated record set and reachable by most requesters in the table; separately kept process notes are not.

What the separation buys is a second lock. A covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, with a short list of exceptions that includes your own use of them to treat the client, your own training programs, and defending yourself in a legal action the client brought 3Ref 3U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The general rule that disclosure needs a valid authorization unless a specific permission applies; the separate authorization required for psychotherapy notes at (a)(2) and its listed exceptions; the rule at (b)(3)(ii) that such an authorization combines only with another psychotherapy-notes authorization; the six core elements at (c)(1), the three required statements at (c)(2), and the five defects at (b)(2).. That authorization cannot be folded into a general release; it can be combined only with another psychotherapy-notes authorization 3Ref 3U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The general rule that disclosure needs a valid authorization unless a specific permission applies; the separate authorization required for psychotherapy notes at (a)(2) and its listed exceptions; the rule at (b)(3)(ii) that such an authorization combines only with another psychotherapy-notes authorization; the six core elements at (c)(1), the three required statements at (c)(2), and the five defects at (b)(2).. Nothing in the definition lets you move a diagnosis or a plan into the notes to shield it; both are excluded by name, wherever you write them.

If the client came through a platform, the record may live in two places, since the definition covers billing and case-management records as well as the chart 2Ref 2U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The definition of designated record set, including billing, enrollment and case-management records, and the definition of psychotherapy notes with its list of excluded content (medication, session times, modalities and frequencies, test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress).. Which entity answers the request is a contract question, the same one that surfaces at the platform exit.

The client asks for their own record

Give the client the designated record set, and act on the request within 30 days. The federal right of access lets an individual inspect and obtain a copy of protected health information about themselves in a designated record set, and the client can direct you to send that copy to a third party by a signed, written request that names the recipient 4Ref 4U.S. Department of Health and Human Services (2026).45 CFR 164.524 - Access of individuals to protected health information.The client's right to inspect and obtain a copy of PHI in a designated record set, the two exclusions (psychotherapy notes; information compiled in reasonable anticipation of litigation), the right to direct a copy to a named third party by signed written request, the 30-day deadline with a single extension of up to 30 days, and the reasonable cost-based fee limited to its listed components..

Two things fall outside the right: psychotherapy notes, and information compiled in reasonable anticipation of a civil, criminal or administrative proceeding 4Ref 4U.S. Department of Health and Human Services (2026).45 CFR 164.524 - Access of individuals to protected health information.The client's right to inspect and obtain a copy of PHI in a designated record set, the two exclusions (psychotherapy notes; information compiled in reasonable anticipation of litigation), the right to direct a copy to a named third party by signed written request, the 30-day deadline with a single extension of up to 30 days, and the reasonable cost-based fee limited to its listed components.. The clock is 30 days from receipt, with one extension of up to 30 more days if you tell the client in writing why and when 4Ref 4U.S. Department of Health and Human Services (2026).45 CFR 164.524 - Access of individuals to protected health information.The client's right to inspect and obtain a copy of PHI in a designated record set, the two exclusions (psychotherapy notes; information compiled in reasonable anticipation of litigation), the right to direct a copy to a named third party by signed written request, the 30-day deadline with a single extension of up to 30 days, and the reasonable cost-based fee limited to its listed components.. A fee, if you charge one, must be reasonable and cost-based, and it may include only the labor of copying, the supplies, the postage, and the preparation of a summary or explanation the client agreed to in advance 4Ref 4U.S. Department of Health and Human Services (2026).45 CFR 164.524 - Access of individuals to protected health information.The client's right to inspect and obtain a copy of PHI in a designated record set, the two exclusions (psychotherapy notes; information compiled in reasonable anticipation of litigation), the right to direct a copy to a named third party by signed written request, the 30-day deadline with a single extension of up to 30 days, and the reasonable cost-based fee limited to its listed components.. The list is closed. A retrieval charge is not on it.

But here the state layer can cut the other way, toward withholding. California's records statute lets a provider decline to give an adult patient their own mental health records where the provider determines there is a substantial risk of significant adverse or detrimental consequences to the patient, on condition that the provider makes a written record of the decision and its reason, and permits inspection by a licensed professional the patient designates 5Ref 5California State Legislature (2022).California Health and Safety Code Section 123115.California only, as a worked example of the state layer: the three circumstances at (a) in which a minor's representative is not entitled to inspect or copy the minor's records including clinical notes, and the substantial-risk route at (b) by which a provider may decline to give an adult patient their own mental health records, with the written-record and designated-licensee conditions.. That is one state's rule. Others have their own versions, or none, and the federal right controls where the state is silent.

Seeing the record is different from changing or erasing it. Amendment has its own process, and a client's request to destroy records runs into your board's retention floor first. When the client wants everything, the answer is the designated record set, psychotherapy notes excepted, inside the deadline.

Another provider or the client's insurer asks

Another treating provider gets what treatment needs, and needs no release to get it. Federal law lets a covered entity disclose protected health information for the treatment activities of a health care provider, and it lets you disclose to another covered entity or provider for that recipient's payment activities 6Ref 6U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.506 Uses and disclosures to carry out treatment, payment, or health care operations..Disclosure without an authorization for another provider's treatment activities and for the payment activities of the receiving covered entity, and the carve-out at (a) that excepts disclosures requiring an authorization under 164.508(a)(2) through (4), which is where psychotherapy notes sit.. So a psychiatrist coordinating medication or a hospital admitting the client can receive the progress notes, the diagnosis and the plan on a request you document in the chart.

Two limits ride along. The treatment permission does not reach psychotherapy notes, because the section excepts any disclosure that needs an authorization under the psychotherapy-notes rule 6Ref 6U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.506 Uses and disclosures to carry out treatment, payment, or health care operations..Disclosure without an authorization for another provider's treatment activities and for the payment activities of the receiving covered entity, and the carve-out at (a) that excepts disclosures requiring an authorization under 164.508(a)(2) through (4), which is where psychotherapy notes sit.. And the minimum-necessary standard requires reasonable efforts to limit a disclosure to what the purpose needs 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.502 Uses and disclosures of protected health information: General rules..The personal-representative rule at 164.502(g)(1), the deference to state or other law in both directions on an unemancipated minor's records at (g)(3)(ii), the abuse, neglect and endangerment election at (g)(5), and the minimum-necessary standard at (b) with its exception for disclosures to a provider for treatment.. That standard does not apply to a disclosure to a provider for treatment, and it does apply to a disclosure for payment 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.502 Uses and disclosures of protected health information: General rules..The personal-representative rule at 164.502(g)(1), the deference to state or other law in both directions on an unemancipated minor's records at (g)(3)(ii), the abuse, neglect and endangerment election at (g)(5), and the minimum-necessary standard at (b) with its exception for disclosures to a provider for treatment..

A health plan reviewing a claim or deciding medical necessity is doing payment, and payment is permitted without an authorization 6Ref 6U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.506 Uses and disclosures to carry out treatment, payment, or health care operations..Disclosure without an authorization for another provider's treatment activities and for the payment activities of the receiving covered entity, and the carve-out at (a) that excepts disclosures requiring an authorization under 164.508(a)(2) through (4), which is where psychotherapy notes sit.. But the minimum-necessary duty applies, so the plan gets the dates of service, the codes, the diagnosis, and whatever documentation its review requires, and not the whole chart by default. Psychotherapy notes are excepted from the payment permission as well; a plan that asks for them needs the client's separate authorization.

An attorney, an employer, or anyone else with a signed release

Anyone outside the treatment and payment relationship gets exactly what a valid authorization describes, and nothing without one. That covers the client's own attorney, opposing counsel without process, an employer, a school, and a family member of an adult client. The general rule is that a covered entity may not disclose protected health information without a valid authorization unless a specific permission applies 3Ref 3U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The general rule that disclosure needs a valid authorization unless a specific permission applies; the separate authorization required for psychotherapy notes at (a)(2) and its listed exceptions; the rule at (b)(3)(ii) that such an authorization combines only with another psychotherapy-notes authorization; the six core elements at (c)(1), the three required statements at (c)(2), and the five defects at (b)(2).. For this group, none does.

Check the release before you honor it. A valid authorization contains at least six elements: a specific and meaningful description of the information, who may disclose it, who may receive it, each purpose of the disclosure, an expiration date or event, and the individual's signature with the date 3Ref 3U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The general rule that disclosure needs a valid authorization unless a specific permission applies; the separate authorization required for psychotherapy notes at (a)(2) and its listed exceptions; the rule at (b)(3)(ii) that such an authorization combines only with another psychotherapy-notes authorization; the six core elements at (c)(1), the three required statements at (c)(2), and the five defects at (b)(2).. It must also carry three statements: that the client may revoke it, whether treatment or payment is conditioned on it, and that the recipient may redisclose the information 3Ref 3U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The general rule that disclosure needs a valid authorization unless a specific permission applies; the separate authorization required for psychotherapy notes at (a)(2) and its listed exceptions; the rule at (b)(3)(ii) that such an authorization combines only with another psychotherapy-notes authorization; the six core elements at (c)(1), the three required statements at (c)(2), and the five defects at (b)(2)..

Five defects void it: an expiration that has passed, required fields left incomplete, a revocation you know about, an improper combination with another document, and material information you know to be false 3Ref 3U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The general rule that disclosure needs a valid authorization unless a specific permission applies; the separate authorization required for psychotherapy notes at (a)(2) and its listed exceptions; the rule at (b)(3)(ii) that such an authorization combines only with another psychotherapy-notes authorization; the six core elements at (c)(1), the three required statements at (c)(2), and the five defects at (b)(2)..

Read the description clause slowly. A release for records from January through March does not cover April, and a release for a treatment summary does not cover the notes. If the request names psychotherapy notes, that requires its own authorization, combinable only with another authorization for psychotherapy notes 3Ref 3U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The general rule that disclosure needs a valid authorization unless a specific permission applies; the separate authorization required for psychotherapy notes at (a)(2) and its listed exceptions; the rule at (b)(3)(ii) that such an authorization combines only with another psychotherapy-notes authorization; the six core elements at (c)(1), the three required statements at (c)(2), and the five defects at (b)(2).. A general release with a checkbox for process notes does not meet that rule.

Nothing in the federal rule speaks to employers or schools by name; they are third parties, and the route is the authorization. Where a requester says the client already signed something, ask for the document and read it first.

A subpoena, a court order, or a police request

A court order gets what it names, and a subpoena without an order gets nothing until the requesting party shows it protected the client. Under a court or administrative tribunal order you may disclose, and disclose only, the protected health information the order expressly authorizes 7Ref 7U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The court-order rule at (e)(1)(i) limiting disclosure to what the order expressly authorizes; the satisfactory-assurance routes at (e)(1)(ii) through (iv) for a subpoena with no order, the qualified-protective-order requirements at (e)(1)(v), and the covered entity's own-efforts route at (e)(1)(vi); the law-enforcement instruments at (f)(1)(ii); the child-abuse report channel at (b)(1)(ii) and the abuse, neglect and domestic-violence victim disclosures at (c) with the duty to inform.. A judge who orders the treatment summary has not ordered the file.

A subpoena, discovery request or other lawful process with no court order behind it is the harder case. Disclosure is permitted only on satisfactory assurance from the requesting party that it made reasonable efforts either to give the client written notice with enough information and time to object, or to secure a qualified protective order 7Ref 7U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The court-order rule at (e)(1)(i) limiting disclosure to what the order expressly authorizes; the satisfactory-assurance routes at (e)(1)(ii) through (iv) for a subpoena with no order, the qualified-protective-order requirements at (e)(1)(v), and the covered entity's own-efforts route at (e)(1)(vi); the law-enforcement instruments at (f)(1)(ii); the child-abuse report channel at (b)(1)(ii) and the abuse, neglect and domestic-violence victim disclosures at (c) with the duty to inform.. Notice counts once the time to object has run with no objection filed, or the court has resolved every objection raised. A qualified protective order must bar use of the record outside the litigation and require its return or destruction when the case ends 7Ref 7U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The court-order rule at (e)(1)(i) limiting disclosure to what the order expressly authorizes; the satisfactory-assurance routes at (e)(1)(ii) through (iv) for a subpoena with no order, the qualified-protective-order requirements at (e)(1)(v), and the covered entity's own-efforts route at (e)(1)(vi); the law-enforcement instruments at (f)(1)(ii); the child-abuse report channel at (b)(1)(ii) and the abuse, neglect and domestic-violence victim disclosures at (c) with the duty to inform..

Absent that assurance, you may make the efforts yourself, giving the client notice or seeking the protective order, and then disclose 7Ref 7U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The court-order rule at (e)(1)(i) limiting disclosure to what the order expressly authorizes; the satisfactory-assurance routes at (e)(1)(ii) through (iv) for a subpoena with no order, the qualified-protective-order requirements at (e)(1)(v), and the covered entity's own-efforts route at (e)(1)(vi); the law-enforcement instruments at (f)(1)(ii); the child-abuse report channel at (b)(1)(ii) and the abuse, neglect and domestic-violence victim disclosures at (c) with the duty to inform.. Or you may wait. The privacy rule permits honoring a subpoena; it does not order you to.

But HIPAA is silent on privilege, and privilege is what usually decides these. Whether the client's communications with you are protected from compelled disclosure, who may assert that protection, and how a motion to quash is filed are questions of your state's evidence law, and this is where counsel earns the fee. A subpoena in a custody matter, a criminal case, or a civil suit the client did not bring is the trigger.

Law enforcement has its own list: a court order or court-ordered warrant, a subpoena or summons a judicial officer issued, a grand jury subpoena, or an administrative request that the law requires you to answer and that is relevant, specific, limited in scope, and unanswerable with de-identified data 7Ref 7U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The court-order rule at (e)(1)(i) limiting disclosure to what the order expressly authorizes; the satisfactory-assurance routes at (e)(1)(ii) through (iv) for a subpoena with no order, the qualified-protective-order requirements at (e)(1)(v), and the covered entity's own-efforts route at (e)(1)(vi); the law-enforcement instruments at (f)(1)(ii); the child-abuse report channel at (b)(1)(ii) and the abuse, neglect and domestic-violence victim disclosures at (c) with the duty to inform.. An officer with none of those has the same standing as anyone else in the table: a signed authorization, or nothing.

A parent, a guardian, or a child-protection worker

A parent or guardian acting as a minor's personal representative is treated as the client, and your state decides how far that goes. The federal rule requires a covered entity to treat a personal representative as the individual, and then, for an unemancipated minor, hands the question to state or other law, including case law, in both directions: a state may permit disclosure to the parent, or prohibit it 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.502 Uses and disclosures of protected health information: General rules..The personal-representative rule at 164.502(g)(1), the deference to state or other law in both directions on an unemancipated minor's records at (g)(3)(ii), the abuse, neglect and endangerment election at (g)(5), and the minimum-necessary standard at (b) with its exception for disclosures to a provider for treatment..

Where the state has said nothing, a licensed professional decides in the exercise of professional judgment 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.502 Uses and disclosures of protected health information: General rules..The personal-representative rule at 164.502(g)(1), the deference to state or other law in both directions on an unemancipated minor's records at (g)(3)(ii), the abuse, neglect and endangerment election at (g)(5), and the minimum-necessary standard at (b) with its exception for disclosures to a provider for treatment.. The rule also lets you decline to treat someone as the representative where both conditions hold: you reasonably believe that person has abused or neglected the client, or that treating them as representative could endanger the client, and you decide in your professional judgment that it is not in the client's best interest 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.502 Uses and disclosures of protected health information: General rules..The personal-representative rule at 164.502(g)(1), the deference to state or other law in both directions on an unemancipated minor's records at (g)(3)(ii), the abuse, neglect and endangerment election at (g)(5), and the minimum-necessary standard at (b) with its exception for disclosures to a provider for treatment..

California shows what a state layer looks like. A minor's representative there is not entitled to inspect or copy the minor's records, including clinical notes, in three circumstances: where the minor may inspect the records under the state's own access statute, where the provider determines that access would have a detrimental effect on the professional relationship or on the minor's physical safety or psychological well-being, and where the records concern services the minor could consent to alone 5Ref 5California State Legislature (2022).California Health and Safety Code Section 123115.California only, as a worked example of the state layer: the three circumstances at (a) in which a minor's representative is not entitled to inspect or copy the minor's records including clinical notes, and the substantial-risk route at (b) by which a provider may decline to give an adult patient their own mental health records, with the written-record and designated-licensee conditions.. Your state may say the same, the opposite, or nothing. Minors' records are the row where reading your own statute matters most.

A child-protection agency brings a different instrument. Reports of child abuse or neglect go to the authority the law designates to receive them, and disclosures about a victim of abuse, neglect or domestic violence go to an authorized government authority to the extent a law requires, with the client's agreement, or where a statute expressly authorizes it and you believe it is needed to prevent serious harm 7Ref 7U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The court-order rule at (e)(1)(i) limiting disclosure to what the order expressly authorizes; the satisfactory-assurance routes at (e)(1)(ii) through (iv) for a subpoena with no order, the qualified-protective-order requirements at (e)(1)(v), and the covered entity's own-efforts route at (e)(1)(vi); the law-enforcement instruments at (f)(1)(ii); the child-abuse report channel at (b)(1)(ii) and the abuse, neglect and domestic-violence victim disclosures at (c) with the duty to inform.. The victim disclosure carries a duty to promptly inform the client, with narrow exceptions 7Ref 7U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The court-order rule at (e)(1)(i) limiting disclosure to what the order expressly authorizes; the satisfactory-assurance routes at (e)(1)(ii) through (iv) for a subpoena with no order, the qualified-protective-order requirements at (e)(1)(v), and the covered entity's own-efforts route at (e)(1)(vi); the law-enforcement instruments at (f)(1)(ii); the child-abuse report channel at (b)(1)(ii) and the abuse, neglect and domestic-violence victim disclosures at (c) with the duty to inform.. The mandated report is the floor; a caseworker's later request for the whole file is not the report, and cps requests without a subpoena run on your state's child-welfare statute and, past it, on the rules above.

The hour after the request arrives

Sort the request by requester and instrument, log it, and answer inside the deadline the row sets. Nothing on this page needs a lawyer in the first hour; it needs a triage note in the chart. Write down who asked, what they sent, which row they fall in, and what you gave or declined, with the date. That note is the answer if the board or a court later asks why.

Then run the state lookup from the first section once, write the answers on one dated sheet, and keep it with your intake templates. These rules change, so the date matters.

Two habits close most gaps. Keep psychotherapy notes apart from the progress note, or accept that the second lock does not exist for you. And when a subpoena arrives without a court order, read the assurance rule before you read the subpoena; until its conditions are met you are permitted to wait.