Psychotherapy Notes and the HIPAA Privacy Rule: Requirements Explained

Psychotherapy notes receive stronger protections under the HIPAA Privacy Rule than most other protected health information. If you are a covered entity or a mental health professional, understanding what counts as a psychotherapy note, when an authorization is required, and which disclosure exceptions apply is essential for compliant practice.

Definition of Psychotherapy Notes

Plain-language definition

Psychotherapy notes are the personal notes of a mental health professional that document or analyze the contents of counseling conversations in individual, group, joint, or family sessions. To qualify, they must be maintained separately from the patient’s general medical record.

Key characteristics

• Created by the treating practitioner for their own use in therapy.
• Focused on the narrative substance of the session, including impressions, hypotheses, and sensitive details not needed for others to treat, bill, or operate.
• Stored apart from the designated record set to preserve heightened confidentiality.

Exclusions from Psychotherapy Notes

Important materials are expressly excluded from the definition and therefore are treated as standard protected health information:

• Medication prescription and monitoring information.
• Counseling session start and stop times.
• Treatment modalities and session frequency.
• Results of clinical tests and assessments.
• Summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.
• Administrative, billing, and scheduling records.

If content appears in the general medical record or an EHR used by a Health Information Organization, it is not a psychotherapy note—even if labeled as such. Place sensitive narrative material in a separate repository to preserve the special status.

Authorization Requirement for Disclosure

When authorization is required

With rare exceptions, a covered entity must obtain a valid, written authorization from the patient before using or disclosing psychotherapy notes. Unlike other PHI, you generally may not rely on treatment, payment, or health care operations to use or share these notes.

What a valid authorization includes

• Specific description of the psychotherapy notes to be used or disclosed.
• Who may disclose and who may receive the notes.
• Purpose of the disclosure.
• Expiration date or event.
• Patient’s signature and date, plus the right to revoke in writing.
• Statements about potential redisclosure and whether services are conditioned on signing (they typically are not).

Authorizations for psychotherapy notes must stand alone; they may be combined only with another authorization that also pertains solely to psychotherapy notes.

Exceptions to Authorization Requirement

HIPAA’s narrow built-in exceptions

• Use by the originator of the notes for the patient’s treatment.
• Use or disclosure by the covered entity for its own training programs for counseling students or practitioners.
• Use or disclosure to defend the covered entity or clinician in a legal action or other proceeding initiated by the patient.

Disclosures permitted or required by law

Certain disclosure exceptions may also apply to psychotherapy notes when specific legal conditions are met. Examples include:

• Required by law, such as mandatory reporting of child abuse or neglect.
• Health oversight activities involving the originator or covered entity.
• Judicial or administrative processes with a valid court order.
• To avert a serious and imminent threat to health or safety.
• To coroners or medical examiners when necessary for their duties.
• To the U.S. Department of Health and Human Services for HIPAA compliance investigations.

Apply the minimum necessary standard to all disclosure exceptions, sharing only what the law or circumstance requires.

Parental Access and Rights

Under HIPAA, a parent is usually the minor’s personal representative with access to the child’s protected health information. However, psychotherapy notes are excluded from the individual right of access, so parents generally may not obtain them.

• If state law allows a minor to consent to specific services (for example, certain mental health or substance use treatment), the parent may not be the personal representative for those encounters.
• If the clinician reasonably believes a parent could endanger the child (e.g., abuse or neglect), the clinician may decline to treat the parent as the personal representative.
• Clinicians may share limited, necessary information with parents or caregivers to facilitate treatment and safety, but not the psychotherapy notes themselves.

Use of Psychotherapy Notes for Research

Authorization is the rule

Using or disclosing psychotherapy notes for research requires the patient’s specific, written authorization. Institutional Review Board or Privacy Board waivers that can apply to other PHI do not substitute for this authorization when the research seeks access to psychotherapy notes.

Structuring the authorization

• Describe the notes to be used, the research purpose, the research team, and the expiration.
• Keep the authorization standalone or combine it only with another psychotherapy-notes authorization.
• Retain documentation to demonstrate that participants understood and agreed to the use of their psychotherapy notes.

Practical alternatives

• Design studies to rely on progress notes or other PHI in the medical record rather than psychotherapy notes.
• Do not mine psychotherapy notes—even in de-identified form—without the individual’s authorization; creating or using de-identified data from these notes still implicates the special protections.

Special Protections under HIPAA

Operational safeguards

• Segregate psychotherapy notes from the designated record set and the EHR modules shared through a Health Information Organization.
• Use role-based access, need-to-know policies, and technical segmentation to prevent routine viewing.
• Avoid including psychotherapy notes in disclosures for payment or routine operations; those activities use standard PHI, not these notes.

Access and minimum necessary

• Patients and parents do not have a HIPAA right of access to psychotherapy notes, though they may access other parts of the record.
• When a disclosure exception applies, limit the disclosure to the minimum necessary to meet the legal or safety purpose.

Information sharing landscape

• Because psychotherapy notes are outside the designated record set, they are not part of the electronic health information that must be shared under information-blocking rules.
• Document clear internal policies so clinicians understand what belongs in psychotherapy notes versus progress notes.

Conclusion

Psychotherapy notes capture the most sensitive narratives from counseling and therefore carry elevated protections. Keep them separate, obtain patient authorization for most uses or disclosures, rely on narrowly defined disclosure exceptions only when applicable, and implement strong operational controls to safeguard this unique category of PHI.

FAQs.

What are psychotherapy notes under HIPAA?

They are a mental health professional’s separate, personal notes that analyze the content of counseling conversations. They must be kept apart from the general medical record to receive HIPAA’s special protections.

How does HIPAA protect psychotherapy notes?

HIPAA requires a specific patient authorization for most uses and disclosures, excludes these notes from the individual right of access, and permits only narrow disclosure exceptions (such as mandatory reporting or a valid court order) under defined circumstances.

Can psychotherapy notes be disclosed without patient authorization?

Only in limited situations, including the originator’s use for treatment, training programs, legal defense by the covered entity, and certain disclosures permitted or required by law. Apply the minimum necessary standard whenever an exception is used.

Do parents have access to their child's psychotherapy notes?

Generally no. While parents often have access to a minor’s health information as personal representatives, psychotherapy notes are excluded from HIPAA’s access rights. State minor-consent laws and safety considerations may further limit parental access.