HIPAA Compliance for Psychotherapy Notes: A Guide for Marriage and Family Therapists

For marriage and family therapists, the distinction between psychotherapy notes and the clinical record affects privacy, disclosure, and patient access. Under the HIPAA Privacy Rule, psychotherapy notes receive special protection—but only when they meet the rule’s definition and are kept separate from the rest of the medical record.

HIPAA applies to covered entities and their business associates. A therapist’s HIPAA obligations depend in part on whether the practice is a covered provider, so check your status and applicable state law as you set up your records and policies. The HHS summary of the HIPAA Privacy Rule explains the rule’s scope and core requirements.

What qualifies as psychotherapy notes under HIPAA?

Psychotherapy notes are notes recorded by a mental health professional that document or analyze the contents of a private counseling session, including a group, joint, or family session. To receive this special treatment under HIPAA, they must also be kept separate from the rest of the patient’s medical record. The HHS guidance on mental health information describes this definition and its limits.

Not every therapist’s note is a psychotherapy note. A progress note, treatment summary, or record used to support a diagnosis, plan care, or bill for services generally belongs in the regular clinical record. A note’s label—such as “process note” or “private note”—does not by itself make it a protected psychotherapy note.

In marriage and family therapy, notes analyzing what was said or explored during a joint or family session may qualify if they meet the definition and are stored separately. Keep in mind that other documentation about the session, such as its date, duration, modality, or treatment progress, is not psychotherapy-note material simply because it concerns therapy.

Which details belong in the medical record instead?

The separate clinical record should contain the information needed to document and support care. HIPAA specifically excludes the following from its definition of psychotherapy notes:

• Medication prescription and monitoring information.
• Counseling-session start and stop times.
• The modalities and frequency of treatment.
• Clinical test results.
• Summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, or progress to date.

These items belong in the regular record when they are part of your documentation. They remain protected health information (PHI), but they do not receive the special disclosure and access rules for psychotherapy notes. The HHS explanation of psychotherapy-note exclusions lists these categories.

For joint family counseling records, be clear about whose care the record documents and whose PHI it may contain. HIPAA’s access right concerns the requesting individual’s PHI; it does not automatically give one family member access to every other participant’s information. Establish recordkeeping and access procedures that account for joint family counseling records, and check state law and professional rules where they affect access or confidentiality.

How should marriage and family therapists store psychotherapy notes separately?

HIPAA’s definition requires psychotherapy notes to be separate from the rest of the medical record; it does not prescribe one specific filing system or storage technology. As a practical approach, maintain them in a distinct paper file or a clearly separated electronic location rather than combining them with progress notes, billing records, or information routinely shared for care coordination.

For electronic notes, use access controls that limit availability to authorized personnel, and consider audit logging and secure transmission as part of your safeguards. The HIPAA Security Rule requires covered entities and business associates to use reasonable and appropriate administrative, physical, and technical safeguards for electronic PHI; HHS describes these in its Security Rule summary. Your specific measures should reflect your risk analysis and systems.

Set written procedures for creating, storing, accessing, and disclosing the separate record. Train staff on the distinction between psychotherapy notes and the clinical record, and configure electronic records so that protected notes are not inadvertently copied into routine visit summaries, billing workflows, or patient portals.

When is patient authorization required to disclose psychotherapy notes?

As a general rule, a covered entity must obtain the individual’s valid authorization before using or disclosing psychotherapy notes. This special rule applies even when another health care provider requests the notes for treatment; the usual permission to share PHI for treatment does not generally eliminate the psychotherapy-notes authorization requirement. See HHS guidance on psychotherapy-note disclosures.

A valid authorization must identify the information and the people or organizations involved, state the purpose and expiration, and include the individual’s signature and date, along with other required statements. The federal authorization regulation, 45 CFR § 164.508, sets out these requirements. An authorization for psychotherapy notes generally cannot be combined with an authorization for other PHI, except another authorization for psychotherapy notes.

Before sending notes to another therapist, insurer, family member, or other recipient, confirm that the authorization covers the specific notes and disclosure. Keep the authorization with your documentation and follow any more protective state requirements that apply.

What exceptions allow disclosure without authorization?

HIPAA permits certain uses or disclosures of psychotherapy notes without authorization. The exceptions are limited and depend on the purpose and circumstances. They include:

• The note’s originator may use the notes for treatment.
• A covered entity may use or disclose notes for its own supervised training programs for mental health students, trainees, or practitioners.
• A covered entity may use or disclose notes to defend itself in a legal action or other proceeding brought by the individual.
• Use or disclosure may occur when required by law, for certain HHS compliance activities, for health oversight of the note’s originator, or for lawful coroner or medical examiner activities.
• A covered entity may disclose notes as permitted to avert a serious and imminent threat to health or safety, consistent with applicable law.

These exceptions do not create a general permission to share psychotherapy notes for routine referrals, billing, or coordination with another provider. The regulation at 45 CFR § 164.508(a)(2) specifies the exceptions. State law may impose additional limits or requirements, so assess the circumstances before relying on an exception.

Do patients have a right to access psychotherapy notes?

HIPAA generally excludes psychotherapy notes from the patient right of access. A patient can therefore be denied access to psychotherapy notes under the federal rule, while still having a right to access other PHI about them in the designated record set, subject to limited exceptions. The HHS access-right guidance distinguishes psychotherapy notes from clinical notes and other records patients may access.

This exception does not allow a practice to withhold the rest of a patient’s clinical record simply because it concerns mental health. Diagnosis, treatment plans, symptoms, progress summaries, and other PHI that is part of the designated record set are not excluded merely because the provider is a therapist.

HIPAA does not require a provider to disclose psychotherapy notes in response to an access request, although a provider may have discretion to disclose them if applicable law permits. For records involving family or joint sessions, assess what information is about the requesting individual and whether disclosure would reveal another person’s PHI; follow applicable state law and practice policies.

How do HIPAA rules differ for psychotherapy notes and other mental health information?

The HIPAA Privacy Rule generally applies the same baseline protections to mental health PHI as to other PHI. Clinical information in the regular record may generally be used or disclosed for treatment, payment, and health care operations as permitted by the Privacy Rule. For example, providers may generally share relevant clinical-record information with another provider for treatment without obtaining an authorization, subject to applicable law and other limits.

Psychotherapy notes are the key exception: they must be maintained separately, are generally excluded from the patient right of access, and usually require specific authorization for use or disclosure—even for treatment disclosures to another provider. The HHS guidance on sharing mental health information explains this difference.

In practice, keep the clinical record complete enough to document care while reserving separately maintained psychotherapy notes for content that meets HIPAA’s definition. Apply the correct access and disclosure rules to each, and check state law and professional requirements for added protections. This distinction is central to handling HIPAA Privacy Rule requirements in marriage and family therapy.

FAQs

Do notes from family therapy sessions qualify as psychotherapy notes under HIPAA?

They can. HIPAA’s definition includes notes documenting or analyzing conversations during joint or family counseling, provided the notes are made by a mental health professional and kept separate from the rest of the medical record. Routine clinical documentation—such as treatment plans, progress summaries, and session dates—is not psychotherapy-note material merely because it relates to family therapy.

Can a marriage and family therapist share psychotherapy notes with another provider without authorization?

Generally, no. The usual HIPAA permission to disclose PHI to another provider for treatment does not generally cover separately maintained psychotherapy notes. A limited exception permits the note’s originator to use the notes for treatment; sharing them with another provider typically requires a valid authorization unless a specific exception applies.

Are psychotherapy notes excluded from a patient’s HIPAA right of access?

Yes. HIPAA generally excludes psychotherapy notes from the patient right of access. That exclusion does not extend to other mental health information in the patient’s designated record set, such as diagnosis, treatment plans, and progress summaries, which may remain accessible under the HIPAA Privacy Rule.

What information must be kept out of psychotherapy notes?

Do not rely on the psychotherapy-notes exception for medication prescription and monitoring information, session start and stop times, treatment modality or frequency, clinical test results, or summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress. These are excluded from HIPAA’s definition and should be documented in the regular clinical record when appropriate.