Arizona Trauma Recovery Treatment Plans: Privacy Laws Checklist

Trauma recovery records are confidential, but confidentiality has legal limits. The rules that apply depend on the provider’s license and setting, whether the provider is subject to HIPAA, and whether special protections—such as federal substance use disorder rules—cover the records.

Use this checklist to understand the main Arizona privacy rules, what a treatment plan should document, and how clients or authorized representatives can request records. This is general information, not legal advice for a particular case.

What privacy laws govern Arizona behavioral health records?

Several laws may apply at the same time. Arizona’s behavioral health confidentiality statutes and professional rules protect client information, while HIPAA applies to covered health care providers, health plans, and their business associates. HIPAA is not a blanket rule that applies to every counselor or every record, so first identify the provider’s legal and organizational status.

• Arizona professional confidentiality: Under A.R.S. § 32-3283, the confidential relationship between a behavioral health licensee and client generally restricts disclosure, subject to duties such as reporting information required by law and addressing clear, imminent danger.
• Arizona health care records: A.R.S. § 36-509 requires health care entities to keep records confidential and identifies disclosures permitted or required by law, including specified care-related, court-authorized, and safety-related disclosures.
• HIPAA: The federal Privacy Rule generally permits covered providers to use or disclose protected health information for treatment, payment, and health care operations without a separate authorization, subject to applicable limits. See HHS guidance on treatment, payment, and health care operations.
• Substance use disorder records: Records held by a federally assisted substance use disorder program may also be subject to 42 CFR Part 2. HHS states that compliance with its updated Part 2 rule was required by February 16, 2026.

Psychotherapy notes can have additional protection under HIPAA. These are a therapist’s separately maintained notes analyzing or documenting session conversations—not ordinary progress notes, treatment plans, diagnoses, or summaries maintained in the medical record. A covered provider generally needs authorization to disclose psychotherapy notes, with limited exceptions. See HHS’s explanation of HIPAA protections for mental health information.

When may providers disclose trauma recovery information without written authorization?

Written authorization is generally needed when a disclosure is not otherwise permitted or required by law. But it is not required for every disclosure: HIPAA and Arizona law allow certain disclosures without a separate authorization, and the provider must follow the rule that applies to the record and situation.

• Care coordination: HIPAA generally permits covered providers to share ordinary protected health information for treatment, including care coordination and referrals, without separate authorization. This does not mean separately maintained psychotherapy notes can routinely be shared the same way.
• People involved in care: Arizona law may allow a health care entity to share information directly relevant to a family member’s or other person’s involvement in care, depending on the client’s opportunity to agree or object, the client’s capacity, and the provider’s professional judgment. The provider must consider safety concerns, including the risk of abuse or endangerment, under A.R.S. § 36-509.
• Mandated reporting requirements: Arizona law requires immediate reporting when the statutory conditions for suspected child abuse or neglect are met. Separate rules require certain professionals and other responsible persons to report suspected abuse, neglect, or exploitation of a vulnerable adult. See A.R.S. § 13-3620 and A.R.S. § 46-454.
• Imminent danger disclosure: Arizona law permits specified disclosures to avert a serious and imminent threat. HIPAA also permits a covered provider, using professional judgment and a good-faith belief, to disclose necessary information to someone able to prevent or lessen the threatened harm. See HHS guidance on serious and imminent threats.
• Other legal authority: Disclosures may also be allowed or required under a court order or other applicable state or federal law. Providers should document the legal basis and limit the information shared to what is appropriate for that purpose.

For disclosures made to prevent or lessen an imminent threat, HIPAA does not generally require the provider to notify the client at the moment of disclosure. However, the provider’s Notice of Privacy Practices should describe this type of possibility in advance. See HHS guidance on advance notice of threat-related disclosures.

What must an individualized treatment plan include and when is it due?

The applicable deadline depends on the provider and setting. For a licensee regulated by Arizona’s Board of Behavioral Health Examiners, the current rule requires a written, integrated, individualized treatment plan by completion of the fourth session. The plan is developed jointly with the client or the client’s legal representative and is based on the licensee’s diagnosis and assessment of the client’s needs, abilities, resources, and circumstances. See Arizona Administrative Code R4-6-1102.

That rule requires the plan to include one or more treatment goals and methods, a review and reassessment date no more than 12 months away, aftercare if a discharge date has been determined, and dated signatures from the client or legal representative and the licensee. The licensee must review the plan by its stated review date and document a review with the client or representative at least annually; revisions require dated signatures.

A separate rule applies to patients in Arizona behavioral health inpatient facilities. Under A.A.C. R9-10-308, the treatment plan generally must be completed before treatment begins and entered in the patient’s medical record within 24 hours after the first treatment. It must address the presenting issue and acuity, services to be provided, the review date, and other specified items; it must be updated on the scheduled review date and when goals, assessment information, or the patient’s condition changes. Setting-specific exceptions apply, including for some crisis services.

Because these rules do not establish one universal deadline for every behavioral health program, confirm the client’s care setting, provider license, and any applicable program or payer requirements before treating an interval as universal.

How should clients be informed about confidentiality and its limits?

Before treatment, Arizona behavioral health licensees must document informed consent, including the client’s confidentiality rights and an explanation of confidentiality limits. The consent information must also address the treatment’s purpose and general procedures, potential benefits, limitations and risks, any supervision or treatment-team involvement, how to obtain records, participation in treatment planning, and the right to refuse or withdraw consent and understand the possible consequences. See A.A.C. R4-6-1101.

Explain limits in plain language before the client shares sensitive trauma details. For example, discuss circumstances in which the law may require a report or permit a safety disclosure, and explain that a provider may share information for certain treatment purposes without a separate HIPAA authorization. If a client’s circumstances or the treatment arrangement changes in a way that could affect consent, revisit the relevant information.

A HIPAA-covered provider must also maintain a Notice of Privacy Practices explaining how protected health information may be used and disclosed and describing the client’s privacy rights. Providers that create or maintain Part 2 records have additional notice requirements; HHS explains these in its Part 2 overview and privacy notice guidance.

How can clients or guardians request access to treatment records?

Clients generally can submit a written request to the provider holding the records, identify the records or date range they want, and state whether they prefer inspection or a copy. A health care decision maker may request records when authorized to act for the client. A parent’s or guardian’s authority to access a minor’s records can depend on applicable law, the treatment involved, and the person’s legal authority, so it should not be assumed that every representative can access every record.

Arizona’s record-access law generally calls for prompt access and sets a seven-business-day deadline in A.R.S. § 12-2293. The statute also specifies response periods for certain requests: requests for records needed for upcoming medical treatment have deadlines of 10 or 15 business days for records in the provider’s current electronic health record system, depending on the records’ age; other specified requests have a 30-calendar-day deadline. HIPAA separately requires covered entities to act on an access request within 30 calendar days, with one possible extension of up to 30 more days if the provider gives the client a written explanation and completion date within the initial period. See HHS guidance on access-request deadlines.

Access is not unlimited. Arizona law lists specific grounds for denying access, including certain risks of harm, and generally requires a written explanation while releasing portions for which there is no basis to deny access. HIPAA also excludes separately maintained psychotherapy notes from its access right. Ordinary clinical notes and treatment-plan information are not automatically excluded merely because they concern behavioral health.

What privacy and consent items should an Arizona treatment plan checklist cover?

Use this checklist to review whether a treatment record addresses privacy, consent, and planning duties that may apply to the client’s specific care setting:

• Applicable rules: Identify the provider’s license and care setting, whether HIPAA applies, and whether Part 2 covers any substance use disorder records.
• Informed consent: Document the treatment purpose, general procedures, benefits, limitations and risks, confidentiality rights and limits, treatment-team involvement, record-request methods, and the client’s rights to participate, refuse, or withdraw consent.
• Authorization for disclosure: For disclosures that require authorization, identify who will disclose and receive information, the purpose and scope, the expiration date or event, the client’s right to revoke, and the dated signature. Arizona Board rules require an authorization to be maintained in the client record and limit its expiration to no more than 12 months. See A.A.C. R4-6-1105.
• Exceptions and documentation: Distinguish written-authorized disclosures from legally permitted or required disclosures, including mandated reports and serious, imminent threat disclosures. Record the basis and information shared as required by applicable policy and law.
• Individualized plan and review interval: Include goals, methods, signatures, aftercare when applicable, and the individualized treatment plan review interval. For Board-regulated licensees, the stated review date must be within 12 months, with at least an annual documented review.
• Record access: Explain how the client or authorized representative can request records, verify the applicable deadline, and document the request and its resolution.
• Privacy safeguards: Protect records in paper and electronic form, control staff access, and ensure transfers and disposal protect confidentiality.
• Minor or representative status: Confirm who can consent to treatment and request records, and check for any applicable court order or legal exception before sharing information with a parent, guardian, or other representative.

In short, a sound checklist connects each treatment plan to the correct rules for the provider and setting, explains confidentiality limits before treatment, documents review and disclosure decisions, and makes record-access rights clear.

FAQs.

Is written authorization generally required to disclose Arizona behavioral health records?

Usually, authorization is required when a disclosure is not otherwise allowed or required by law. But it is not universal: HIPAA generally permits certain treatment, payment, and health care operations disclosures without a separate authorization, and Arizona and federal laws provide additional exceptions. Psychotherapy notes and Part 2 records may have special rules.

When can a provider share confidential information without client authorization?

Depending on the law and circumstances, a provider may share information for treatment, make a required abuse or neglect report, respond to a qualifying serious and imminent threat, comply with a court order, or use another disclosure exception. The provider should confirm the exception applies and limit the disclosure appropriately.

By when must an individualized treatment plan be prepared and reviewed?

For Arizona Board of Behavioral Health Examiners licensees, the written plan is due by completion of the fourth session; it must specify a review date no more than 12 months away and be reviewed at least annually. Behavioral health inpatient facilities have separate rules that generally require a plan before treatment and documentation within 24 hours after the first treatment.

How long does a provider generally have to respond to a request for records?

Arizona law generally requires prompt access within seven business days, but it specifies different response periods for certain requests: 10 or 15 business days for qualifying upcoming-treatment requests involving current electronic records, and 30 calendar days for other specified requests. HIPAA generally allows up to 30 calendar days, with one properly noticed extension of up to 30 additional days. Which deadline governs depends on the request and applicable law.