Guide

Payers and the chart: minimum necessary in behavioral health

Summary

For payment, a payer generally sees only what a claim carries — the CPT code, the date and length of service, and the diagnosis — not your session notes. The minimum-necessary standard limits what you disclose for payment to what the payer actually needs to adjudicate. Psychotherapy notes get extra protection: a plan usually cannot condition payment on obtaining them, and their release needs the patient's authorization. Substance-use records add a further Part 2 layer.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

How much of the record may payers see?

Less than most clinicians assume. For routine payment, a payer sees what your claim transmits — the procedure code, the dates and length of service, and the diagnosis — and little else. Beyond the claim, the minimum necessary standard limits what you disclose for payment to what the payer genuinely needs, and psychotherapy notes carry a separate lock that keeps them out of most payer hands 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits disclosure for payment without separate authorization but the minimum-necessary standard caps what is disclosed, so a payer request is limited to what is reasonably needed for the payment purpose.. The whole chart is not the default; it is the exception.

Three ideas do the work on this page: what a claim actually carries, what minimum necessary permits when a payer asks for more, and why psychotherapy notes and SUD records sit behind extra protection. Sort a payer request into those three buckets and the answer to 'how much can they see' usually resolves itself.

The claim transmits less than you think

A behavioral-health claim is mostly codes. The CMS-1500 or its electronic equivalent carries the CPT service code — 90791 for the evaluation, 90832/90834/90837 for timed therapy, 90847 for family — plus the date of service, the place of service, the units, and an ICD-10 diagnosis 2Ref 2APA Services, Inc. (2025).Psychotherapy Codes for Psychologists.The psychotherapy CPT codes a claim carries — 90791 evaluation, 90832/90834/90837 timed individual therapy, 90847 family — which is the clinical information a payer receives by default on a claim.. It does not carry your progress note or your session content. So the first, largest slice of 'what the payer sees' is a handful of structured fields, not narrative.

That matters for two reasons. First, the diagnosis on the claim is the main clinical fact a payer receives by default, so code it accurately and only to what you can support. Second, when a payer wants more than the claim — for medical-necessity review or an audit — that is a separate request governed by minimum necessary, not something the claim itself hands over 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits disclosure for payment without separate authorization but the minimum-necessary standard caps what is disclosed, so a payer request is limited to what is reasonably needed for the payment purpose..

Minimum necessary governs what you send for payment

When a payer legitimately needs more than the claim, the minimum-necessary standard controls the size of what you send. The Privacy Rule permits disclosure for payment without separate authorization, but it requires you to limit that disclosure to the information reasonably needed for the payment purpose 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits disclosure for payment without separate authorization but the minimum-necessary standard caps what is disclosed, so a payer request is limited to what is reasonably needed for the payment purpose.. For a utilization or medical-necessity review, that usually means the treatment plan, dates, diagnosis, and progress toward goals — not the entire file, and not your private process notes 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits disclosure for payment without separate authorization but the minimum-necessary standard caps what is disclosed, so a payer request is limited to what is reasonably needed for the payment purpose..

In practice, send a focused summary responsive to the specific question the payer asked. If a plan requests 'the records' broadly, it is reasonable to ask what decision the records are for and to tailor the release to that. Minimum necessary is not a suggestion; it is the standard you are held to if the disclosure is later questioned 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits disclosure for payment without separate authorization but the minimum-necessary standard caps what is disclosed, so a payer request is limited to what is reasonably needed for the payment purpose..

Psychotherapy notes: the second lock

Psychotherapy notes are a defined, separately protected category — the clinician's own analysis of the session, kept apart from the rest of the record 3Ref 3HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.The heightened protection of psychotherapy notes as a separately kept category, and that safety-based disclosures to prevent serious harm are a distinct permitted lane from payment.. HIPAA gives them heightened protection: most disclosures require the patient's specific authorization, and a health plan generally may not condition treatment, payment, enrollment, or eligibility on the patient authorizing their release 4Ref 4HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes require specific patient authorization for most disclosures and that a health plan may not condition payment, enrollment, or eligibility on obtaining that authorization.. That is what people mean by calling psychotherapy notes HIPAA's second lock.

To rely on the protection, you have to keep the notes actually separate — a distinct file, not interleaved with the progress notes that make up the designated record set. If your process observations live inside the ordinary chart, they lose the special status and travel with the rest of the record when a payment disclosure is made 3Ref 3HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.The heightened protection of psychotherapy notes as a separately kept category, and that safety-based disclosures to prevent serious harm are a distinct permitted lane from payment..

When the payer wants notes: audits and utilization review

Sometimes the payer wants notes anyway — a records request tied to an audit, a medical-necessity denial, or a utilization review. Your contract may obligate you to produce treatment records for these purposes, but two limits still apply: minimum necessary caps what you send 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits disclosure for payment without separate authorization but the minimum-necessary standard caps what is disclosed, so a payer request is limited to what is reasonably needed for the payment purpose., and psychotherapy notes remain outside the request unless the patient has separately authorized their release 4Ref 4HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes require specific patient authorization for most disclosures and that a health plan may not condition payment, enrollment, or eligibility on obtaining that authorization.. Answer the specific question asked; do not empty the file into the fax.

When the payer wants notes, a good sequence is: confirm the purpose in writing, check what your contract actually requires, release the minimum-necessary treatment record responsive to that purpose, and log the disclosure. If the request reaches for psychotherapy notes, that is the moment to get the patient's authorization or to explain why the notes are not required for the payment decision 4Ref 4HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes require specific patient authorization for most disclosures and that a health plan may not condition payment, enrollment, or eligibility on obtaining that authorization..

SUD records get an extra layer

If your practice is a Part 2 program, substance-use records carry a further layer even for payment. Under 42 CFR Part 2, patient-identifying SUD records generally require consent to disclose — and while the 2024 rule lets one consent cover future payment disclosures, the consent requirement itself does not disappear for a payer the way it does for ordinary PHI under the Privacy Rule 5Ref 5Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.That patient-identifying SUD records from a Part 2 program require consent to disclose even for payment, so a payer's access to those records runs through Part 2 consent rather than the ordinary payment permission.. So a payer's routine access to SUD treatment records still runs through Part 2 consent 5Ref 5Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.That patient-identifying SUD records from a Part 2 program require consent to disclose even for payment, so a payer's access to those records runs through Part 2 consent rather than the ordinary payment permission..

Most solo therapists are not Part 2 programs, so this layer will not reach them. But if you hold yourself out as SUD treatment, check the applicability test before you release anything to a plan: the consent path, not the plain payment permission, is what governs those records 5Ref 5Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.That patient-identifying SUD records from a Part 2 program require consent to disclose even for payment, so a payer's access to those records runs through Part 2 consent rather than the ordinary payment permission..

Payer access vs the patient's own access

Do not confuse what a payer may see with what the patient may see — they run on different rules. A payer's access is a payment disclosure, capped by minimum necessary. The patient's own right of access is broader: patients can inspect and obtain most of their record, though psychotherapy notes are excluded from that access right 6Ref 6HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That the patient's own right of access is broader than a payer's payment access and reaches most of the record, but that psychotherapy notes are excluded from that access right.. So when the client wants everything, the answer is not the same as when a payer asks 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits disclosure for payment without separate authorization but the minimum-necessary standard caps what is disclosed, so a payer request is limited to what is reasonably needed for the payment purpose..

A third lane is the emergency: HIPAA permits certain break-glass disclosures to prevent serious harm, again on its own terms and separate from payment 3Ref 3HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.The heightened protection of psychotherapy notes as a separately kept category, and that safety-based disclosures to prevent serious harm are a distinct permitted lane from payment.. Keeping these lanes distinct — payer, patient, emergency — is how you answer any single request correctly, because each carries a different scope and a different standard.

Common questions

Not from a routine claim, which carries codes and a diagnosis rather than notes. Psychotherapy notes are separately protected and generally require the patient's authorization to release, and a plan usually cannot condition payment on getting them. A payer may request treatment records for an audit, but minimum necessary still limits what you send.

A standard claim transmits structured fields: the CPT service code (such as 90791, 90834, or 90847), the date and place of service, the number of units, and an ICD-10 diagnosis. It does not include your session content or progress notes. The diagnosis is usually the only clinical detail a payer receives by default.

Generally no. HIPAA bars a health plan from conditioning payment, enrollment, or eligibility on the patient authorizing release of psychotherapy notes, and those notes require specific authorization to disclose. A payer can review the treatment record for medical necessity, but the separately kept psychotherapy notes stay out unless the patient chooses to authorize them.

No. Send the minimum necessary to answer the payer's specific purpose — typically the treatment plan, dates, diagnosis, and progress toward goals — not the entire chart, and not the separately kept psychotherapy notes. Confirm the purpose in writing, check what your contract requires, release the responsive record, and log the disclosure.

If your practice is a 42 CFR Part 2 program, no. Patient-identifying substance-use records still require the patient's consent to disclose, even for payment, so a payer's access runs through Part 2 consent rather than the ordinary payment permission. Most general practices are not Part 2 programs, but confirm your status before releasing SUD records.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.HHS Office for Civil Rights (2026). Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services. linkThat the Privacy Rule permits disclosure for payment without separate authorization but the minimum-necessary standard caps what is disclosed, so a payer request is limited to what is reasonably needed for the payment purpose.
2.APA Services, Inc. (2025). Psychotherapy Codes for Psychologists. APA Services, Inc.. link ✓The psychotherapy CPT codes a claim carries — 90791 evaluation, 90832/90834/90837 timed individual therapy, 90847 family — which is the clinical information a payer receives by default on a claim.
3.HHS Office for Civil Rights (2026). HIPAA Privacy Rule and Sharing Information Related to Mental Health. U.S. Department of Health and Human Services. linkThe heightened protection of psychotherapy notes as a separately kept category, and that safety-based disclosures to prevent serious harm are a distinct permitted lane from payment.
4.HHS Office for Civil Rights (2026). Does HIPAA provide extra protections for mental health information compared with other health information?. U.S. Department of Health and Human Services. linkThat psychotherapy notes require specific patient authorization for most disclosures and that a health plan may not condition payment, enrollment, or eligibility on obtaining that authorization.
5.Office of the Federal Register (2026). 42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records. eCFR. link ✓That patient-identifying SUD records from a Part 2 program require consent to disclose even for payment, so a payer's access to those records runs through Part 2 consent rather than the ordinary payment permission.
6.HHS Office for Civil Rights (2026). Individuals' Right under HIPAA to Access their Health Information. U.S. Department of Health and Human Services. linkThat the patient's own right of access is broader than a payer's payment access and reaches most of the record, but that psychotherapy notes are excluded from that access right.

https://www.gale.care/for-providers/pr-payer-disclosures-minimum · 6 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers