For providers

Psychotherapy notes: HIPAA's second lock

Summary

Psychotherapy notes — a therapist's private process notes about a session, kept separate from the rest of the chart — get a second lock under HIPAA. Unlike the general record, which moves for treatment, payment, and operations, most disclosures of psychotherapy notes require the patient's specific authorization, with only a narrow set of exceptions. They are also excluded from the patient's HIPAA right of access. The whole protection depends on keeping them separate; commingle them into the record and it is lost.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

What a psychotherapy note actually is — and what it is not

A psychotherapy note is a therapist's private record of what was said and analyzed in a counseling session — the clinician's own impressions, working hypotheses, and process observations — kept physically or electronically separate from the rest of the chart 1Ref 1HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are the clinician's separately-kept process notes, that HIPAA's definition excludes specified items (medications, session times, modalities, test results, and summaries of diagnosis, treatment plan, symptoms, prognosis, and progress), and that most disclosures require the patient's specific authorization.. HIPAA gives it heightened protection precisely because it is the clinician's thinking, not the official account of care. What the definition leaves out is as important as what it includes.

HIPAA's definition explicitly excludes a specific list from the category, and those excluded items get no special protection at all: medications and their monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date 1Ref 1HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are the clinician's separately-kept process notes, that HIPAA's definition excludes specified items (medications, session times, modalities, test results, and summaries of diagnosis, treatment plan, symptoms, prognosis, and progress), and that most disclosures require the patient's specific authorization.2Ref 2HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.That psychotherapy notes receive heightened protection and that a narrow set of exceptions permits use or disclosure without authorization, including the originator's own treatment use, limited oversight, defense in a proceeding the patient brought, and averting a serious and imminent threat to health or safety.. All of that belongs to the general record. So the two kinds of notes a therapy practice keeps are not "detailed" versus "brief" — they are the separately-kept process notes on one side and everything the record needs to document and justify care on the other.

Before any of this applies, a practice has to be a HIPAA covered entity in the first place — the covered-entity test decides that — but for most behavioral-health practices that bill insurance or transmit claims electronically, it does. Once it does, the psychotherapy-note distinction is one of the sharpest lines in the entire Privacy Rule, and getting it wrong in either direction — over-protecting the ordinary record or under-protecting the process notes — creates real exposure.

The separation requirement is the whole protection

The separation requirement is not a formality; it is the entire basis of the protection. Psychotherapy notes qualify for heightened treatment only if they are maintained separately from the individual's medical record 1Ref 1HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are the clinician's separately-kept process notes, that HIPAA's definition excludes specified items (medications, session times, modalities, test results, and summaries of diagnosis, treatment plan, symptoms, prognosis, and progress), and that most disclosures require the patient's specific authorization.. Fold them into the progress note, the treatment plan, or the running body of the chart, and they stop being psychotherapy notes under HIPAA — they simply become part of the record around them and inherit its ordinary rules.

Separation can be physical — a distinct file the process notes live in — or logical, meaning an access-controlled section of an electronic record that is walled off from the rest of the chart. Many electronic systems built for behavioral health provide a segregated psychotherapy-notes area for exactly this reason. When a vendor creates, receives, maintains, or transmits those notes on the practice's behalf, the vendor is a business associate and needs a business-associate agreement like any other handler of protected information 3Ref 3HHS Office for Civil Rights (2026).Business Associates.That a vendor that creates, receives, maintains, or transmits protected health information — including an electronic-record system storing psychotherapy notes — is a business associate requiring a business-associate agreement..

The practical failure mode is subtle and common: a clinician quotes session process — the patient's exact words, the therapist's interpretation — inside the billable progress note. At that moment there is nothing separate left to protect, and the material a clinician assumed was locked away is sitting in the record that moves for payment. The discipline that preserves the protection is simple to state and easy to erode: process observations go in the separate note; everything the record must show to document care goes in the record.

The second lock: authorization even for treatment and payment

The general medical record moves relatively freely for treatment, payment, and health-care operations — the TPO permissions at the core of the Privacy Rule 4Ref 4HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits use and disclosure of the general medical record for treatment, payment, and health-care operations, the baseline against which the psychotherapy-notes authorization requirement is the exception.. Psychotherapy notes do not move that way. Most uses and disclosures of psychotherapy notes require the patient's specific, separate authorization, even for purposes that would need none for the rest of the chart 1Ref 1HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are the clinician's separately-kept process notes, that HIPAA's definition excludes specified items (medications, session times, modalities, test results, and summaries of diagnosis, treatment plan, symptoms, prognosis, and progress), and that most disclosures require the patient's specific authorization.. That is the second lock: a document inside a system already built to protect health information, protected again by a higher standard.

This is why a blanket consent-to-treat form, or a general authorization to release records, does not reach the psychotherapy notes. An authorization that unlocks them has to be specific to them — the patient has to knowingly authorize the release of the process notes as such. A release worded for "my records" does not silently sweep them in.

It is also why payers and the chart is a live question in therapy practices rather than a settled one. When a payer requests records to support a claim or an audit, the psychotherapy notes are not part of what a routine payment disclosure covers; the payer is entitled to the record that documents medical necessity, not the clinician's separate process notes. When the payer wants notes, the task is to distinguish precisely — to send the designated record that supports the claim and to recognize that the separately-kept psychotherapy notes sit behind the authorization lock, not inside the payment permission.

The narrow exceptions where authorization is not required

HIPAA carves out a small set of situations where psychotherapy notes may be used or disclosed without the patient's authorization. The set is genuinely narrow, and knowing it keeps a clinician from either over-disclosing out of confusion or freezing when a real exception plainly applies 2Ref 2HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.That psychotherapy notes receive heightened protection and that a narrow set of exceptions permits use or disclosure without authorization, including the originator's own treatment use, limited oversight, defense in a proceeding the patient brought, and averting a serious and imminent threat to health or safety.1Ref 1HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are the clinician's separately-kept process notes, that HIPAA's definition excludes specified items (medications, session times, modalities, test results, and summaries of diagnosis, treatment plan, symptoms, prognosis, and progress), and that most disclosures require the patient's specific authorization..

The recognized exceptions include the originator using the notes for their own treatment of the patient; limited oversight of the clinician who created them; the practice's use of the notes to defend itself in a legal action or proceeding the patient brought; and disclosure to avert a serious and imminent threat to health or safety, or where other law requires the disclosure 2Ref 2HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.That psychotherapy notes receive heightened protection and that a narrow set of exceptions permits use or disclosure without authorization, including the originator's own treatment use, limited oversight, defense in a proceeding the patient brought, and averting a serious and imminent threat to health or safety.. These last ones are the break-glass disclosures — the situations that override the authorization requirement when a genuine safety or legal-compulsion trigger is met, not a general license to share.

Two cautions matter here. First, an exception is a permission, not a command; even where HIPAA would allow a disclosure, professional judgment and the minimum-necessary principle still govern how much is released. Second, the safety exception is narrow by design — a serious and imminent threat — and it is not a workaround for ordinary coordination of care. When the trigger is real, disclosing to the people reasonably able to prevent or lessen the threat is permitted; when it is not, the authorization lock stands.

The patient's right of access stops at the notes door

A patient's HIPAA right to see and get a copy of their own record is broad: inspection and copies generally within thirty days, with one thirty-day extension, for a reasonable cost-based fee, in the form and format the patient requests where the practice can produce it 5Ref 5HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That patients may inspect and obtain copies of their records generally within 30 days (one 30-day extension), for a reasonable cost-based fee, in the form and format requested where producible, and that psychotherapy notes are excluded from the right of access.. That right is one of the most-enforced provisions in the Privacy Rule. It stops at the psychotherapy-notes door — those notes are excluded from the right of access entirely 5Ref 5HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That patients may inspect and obtain copies of their records generally within 30 days (one 30-day extension), for a reasonable cost-based fee, in the form and format requested where producible, and that psychotherapy notes are excluded from the right of access..

So when the client wants everything, the accurate answer has two parts. Everything the access right reaches — the designated record set, including diagnoses, medications, treatment plans, test results, and progress notes — the patient is fully entitled to, on the access timeline and at the access fee limits. The separately-kept psychotherapy notes are not part of that entitlement, because the access right does not extend to them.

A clinician may still choose to share process notes with a patient when it serves the work — that is a clinical decision, and sometimes a good one. What the exclusion means is that it is a choice, not a legal obligation triggered by a records request. The distinction protects the candor of the notes: a therapist who knew every process observation would be discoverable on demand would write different, thinner notes, which is part of why the exclusion exists.

Subpoenas, court orders, and the notes

A subpoena or a court order for psychotherapy notes runs into two rules at once: the authorization lock that already governs the notes, and HIPAA's separate rules for legal process 6Ref 6HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That HIPAA distinguishes a court order (disclose only what the order authorizes) from a subpoena without a court order (disclose only with satisfactory assurances of notice to the patient or a protective order).. The first thing to establish is which document has actually arrived, because they are not the same. A court order, signed by a judge, permits disclosure of exactly what the order authorizes — no more. A subpoena that is not backed by a court order requires satisfactory assurances that the patient has been notified or that a protective order has been sought before anything is released 6Ref 6HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That HIPAA distinguishes a court order (disclose only what the order authorizes) from a subpoena without a court order (disclose only with satisfactory assurances of notice to the patient or a protective order)..

For psychotherapy notes specifically, the layers stack. Even a proper subpoena does not by itself dissolve the authorization requirement that already protects the notes; a lawyer's subpoena is not a judge's order. The reliable sequence is to read the document for what it is, to decline to produce the separately-protected notes on the strength of a bare subpoena, and to seek either the patient's specific authorization or a court order that squarely reaches the notes.

This is one of the genuine places where counsel earns its fee. The trigger is specific: a subpoena or discovery request for psychotherapy notes with no patient authorization and no court order compelling them. Recognizing that exact situation — rather than treating every piece of legal paper as either ignorable or automatically binding — is what a clinician can do; deciding the precise response for a contested case is where an attorney belongs.

When SUD records add a third lock: 42 CFR Part 2

If a practice, or a part of it, is a federally-covered substance-use-disorder program, a third lock applies on top of HIPAA: 42 CFR Part 2. Part 2 governs the confidentiality of SUD patient records held by covered programs, with its own consent and redisclosure requirements that are, in important respects, stricter than HIPAA 7Ref 7Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.That 42 CFR Part 2 governs the confidentiality of substance-use-disorder patient records held by covered programs, with its own consent and redisclosure requirements, and defines which programs it covers.. Not every therapist who ever discusses substance use is a Part 2 program — the rule turns on whether the practice holds itself out as providing SUD diagnosis, treatment, or referral for treatment — but where it applies, it governs.

The 2024 Part 2 final rule brought the regime closer to HIPAA. It permits a single patient consent for future uses and disclosures for treatment, payment, and health-care operations, and it aligned Part 2's penalties and breach-notification obligations with HIPAA 8Ref 8U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.That the 2024 Part 2 final rule permits a single patient consent for future TPO uses and disclosures, aligns penalties and breach notification with HIPAA, and carries a compliance date of February 16, 2026, now in effect. As of July 2026.. Its compliance date, February 16, 2026, is now in effect as of July 2026 8Ref 8U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.That the 2024 Part 2 final rule permits a single patient consent for future TPO uses and disclosures, aligns penalties and breach notification with HIPAA, and carries a compliance date of February 16, 2026, now in effect. As of July 2026.. The operative regulatory text spelling out the consent and redisclosure mechanics — and the preamble explaining them — is the published 2024 final rule 9Ref 9Substance Abuse and Mental Health Services Administration (2024).Confidentiality of Substance Use Disorder (SUD) Patient Records.The published 2024 Part 2 final rule as the operative regulatory text and preamble for the consent and redisclosure mechanics..

What has not changed is the defining feature: redisclosure limits. Information received under a Part 2 consent generally cannot be passed further along without meeting Part 2's own rules, and records covered by Part 2 carry a redisclosure notice. For a clinician who both keeps psychotherapy notes and holds SUD records, the two protections are separate and cumulative — a note can be both a psychotherapy note under HIPAA and a Part 2 record, and it then answers to both.

Minors, representatives, and what state law controls

Who controls a minor's or an incapacitated adult's psychotherapy notes is a question HIPAA does not answer on its own — it defers to state law 10Ref 10HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA defers to state law on who controls a minor's or incapacitated adult's records, generally treats a personal representative as the individual, and permits limited exceptions where a representative is implicated in abuse, neglect, or endangerment.. HIPAA generally treats a parent as the personal representative of a minor, and a personal representative stands in the individual's shoes for access and authorization purposes. But state law decides when a minor controls their own mental-health record, and several situations can displace the parent's control entirely.

Because this varies, the reliable move is not to apply a remembered rule; it is to look up your own state's law on minor consent for mental-health treatment and on parental access to those records. The statute controls — a rule that held in a prior job or a neighboring state may be wrong for the one you practice in. HIPAA also permits limited exceptions where a personal representative is implicated in abuse, neglect, or endangerment, allowing a provider to decline to treat that person as the representative when doing so is in the individual's best interest 10Ref 10HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA defers to state law on who controls a minor's or incapacitated adult's records, generally treats a personal representative as the individual, and permits limited exceptions where a representative is implicated in abuse, neglect, or endangerment..

For an adult who has named a representative or has lost capacity, the same deferral to state law and the same personal-representative framework apply. The practical lookup is short: your state's code section on minor consent to mental-health care, your state's rule on parental access, and your licensing board's guidance for your profession. Those three sources answer most of the questions a solo practice actually faces, and they answer them correctly for the jurisdiction the practice is in.

Common questions

A therapist's private notes documenting or analyzing the contents of a counseling session, kept separate from the rest of the chart. HIPAA's definition specifically excludes medications and monitoring, session start and stop times, treatment modalities and frequencies, test results, and any summary of diagnosis, treatment plan, symptoms, prognosis, and progress. Those excluded items live in the general record and get no special protection.

Yes — separation is the whole basis of the protection. The notes qualify for heightened treatment only if maintained separately from the medical record, which can be a distinct physical file or an access-controlled, walled-off section of an electronic record. Fold them into the progress note or treatment plan and they lose their status, becoming part of the ordinary record around them.

No. Psychotherapy notes are excluded from the HIPAA right of access. A patient is fully entitled to the designated record set — diagnoses, medications, treatment plans, test results, progress notes — but not to the separately-kept psychotherapy notes. A clinician may choose to share process notes therapeutically, but that is a clinical decision, not an obligation triggered by a records request.

Not by itself. A subpoena not backed by a court order requires satisfactory assurances of notice to the patient or a protective order, and it does not dissolve the authorization lock that already protects psychotherapy notes. The reliable response is to identify whether it is a judge's order or a lawyer's subpoena, and to seek the patient's specific authorization or a court order that squarely reaches the notes.

When the practice, or part of it, is a federally-covered substance-use-disorder program — one that holds itself out as providing SUD diagnosis, treatment, or referral. Part 2 then adds consent and redisclosure requirements stricter than HIPAA. The 2024 final rule aligned parts of Part 2 with HIPAA, including a single TPO consent, with a compliance date of February 16, 2026, now in effect as of July 2026.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.HHS Office for Civil Rights (2026). Does HIPAA provide extra protections for mental health information compared with other health information?. U.S. Department of Health and Human Services. linkThat psychotherapy notes are the clinician's separately-kept process notes, that HIPAA's definition excludes specified items (medications, session times, modalities, test results, and summaries of diagnosis, treatment plan, symptoms, prognosis, and progress), and that most disclosures require the patient's specific authorization.
2.HHS Office for Civil Rights (2026). HIPAA Privacy Rule and Sharing Information Related to Mental Health. U.S. Department of Health and Human Services. linkThat psychotherapy notes receive heightened protection and that a narrow set of exceptions permits use or disclosure without authorization, including the originator's own treatment use, limited oversight, defense in a proceeding the patient brought, and averting a serious and imminent threat to health or safety.
3.HHS Office for Civil Rights (2026). Business Associates. U.S. Department of Health and Human Services. linkThat a vendor that creates, receives, maintains, or transmits protected health information — including an electronic-record system storing psychotherapy notes — is a business associate requiring a business-associate agreement.
4.HHS Office for Civil Rights (2026). Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services. linkThat the Privacy Rule permits use and disclosure of the general medical record for treatment, payment, and health-care operations, the baseline against which the psychotherapy-notes authorization requirement is the exception.
5.HHS Office for Civil Rights (2026). Individuals' Right under HIPAA to Access their Health Information. U.S. Department of Health and Human Services. linkThat patients may inspect and obtain copies of their records generally within 30 days (one 30-day extension), for a reasonable cost-based fee, in the form and format requested where producible, and that psychotherapy notes are excluded from the right of access.
6.HHS Office for Civil Rights (2026). Court Orders and Subpoenas. U.S. Department of Health and Human Services. linkThat HIPAA distinguishes a court order (disclose only what the order authorizes) from a subpoena without a court order (disclose only with satisfactory assurances of notice to the patient or a protective order).
7.Office of the Federal Register (2026). 42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records. eCFR. link ✓That 42 CFR Part 2 governs the confidentiality of substance-use-disorder patient records held by covered programs, with its own consent and redisclosure requirements, and defines which programs it covers.
8.U.S. Department of Health and Human Services (2024). Fact Sheet: 42 CFR Part 2 Final Rule. U.S. Department of Health and Human Services. linkThat the 2024 Part 2 final rule permits a single patient consent for future TPO uses and disclosures, aligns penalties and breach notification with HIPAA, and carries a compliance date of February 16, 2026, now in effect. As of July 2026.
9.Substance Abuse and Mental Health Services Administration (2024). Confidentiality of Substance Use Disorder (SUD) Patient Records. Federal Register. link ✓The published 2024 Part 2 final rule as the operative regulatory text and preamble for the consent and redisclosure mechanics.
10.HHS Office for Civil Rights (2026). Personal Representatives. U.S. Department of Health and Human Services. linkThat HIPAA defers to state law on who controls a minor's or incapacitated adult's records, generally treats a personal representative as the individual, and permits limited exceptions where a representative is implicated in abuse, neglect, or endangerment.

https://www.gale.care/for-providers/pr-psychotherapy-notes-hipaa · 10 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers