Psychotherapy Notes Under HIPAA: What Qualifies, Who Can See Them, and Why the Separate File Matters

A signed release arrives from a personal injury attorney. It asks for the patient's "complete record, including all psychotherapy notes." The therapist's notes from every session are typed into the progress note field of the EHR, right under the diagnosis and the treatment plan. The office manager wants to know whether those notes go out with the rest of the chart.

The answer turns on a definition, and the definition turns on a filing decision. HIPAA gives one category of mental health documentation stronger protection than any other P.H.I. (Protected Health Information): psychotherapy notes. That category is narrow, it depends on where the notes are kept, and once notes qualify, three rules follow: they need their own authorization for almost any disclosure, they sit outside the patient's right of access, and they are excluded from the federal information-blocking definition. This article quotes each rule, shows what does and does not qualify, and ends with what to write into the policy so the next release is a ten-minute task.

HIPAA Psychotherapy Notes: The Three Rules That Follow From the Definition

Rule 1: The Definition Is Narrow and Depends on the File

45 CFR 164.501 defines the term this way: "Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record."

Then it lists what the term does not include: "medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date."

Three tests, all of which must be met. The author is a mental health professional. The content documents or analyzes the conversation in a counseling session, the therapist's own process notes and impressions. And the notes "are separated from the rest of the individual's medical record." The third test is the one practices lose. Notes typed into the chart are part of the chart, whatever they contain, and they are ordinary PHI with ordinary rules.

The right-hand column is the clinical record the rest of the world runs on: what a payer needs, what a covering clinician needs, what the patient is entitled to. The left-hand column is the therapist's working file. HIPAA lets a practice protect the second only if it keeps it physically or electronically apart from the first.

Rule 2: Almost Every Disclosure Needs Its Own Authorization

164.508(a)(2) states: "Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except:" and then lists the exceptions. For treatment, payment, and health care operations, only three uses survive without an authorization: "Use by the originator of the psychotherapy notes for treatment"; use or disclosure "for its own training programs" in which mental health trainees learn under supervision; and use or disclosure "to defend itself in a legal action or other proceeding brought by the individual." Beyond those, the exceptions are disclosures to HHS for a compliance investigation, disclosures required by law under 164.512(a), health oversight of the originator under 164.512(d), coroners and medical examiners under 164.512(g)(1), and disclosures to avert a serious and imminent threat under 164.512(j)(1)(i).

Read what is missing. Ordinary treatment disclosures to another provider need an authorization. Payment disclosures to a health plan need an authorization, and 164.508(b)(4)(ii)(B) bars a health plan from conditioning enrollment or benefits on getting one. The general treatment-and-payment permission that moves the rest of the chart around every day does not move psychotherapy notes.

The authorization itself has a special rule. Under 164.508(b)(3)(ii), "An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes." The attorney's "complete record" release, however broadly it is worded, is an authorization for the chart. It cannot double as the psychotherapy notes authorization, because the rule forbids combining the two. A practice that wants to release the separate file needs a separate form, with all the core elements and required statements of 164.508(c), that says psychotherapy notes on its face. The elements are laid out in HIPAA authorization requirements, and the standard release for everything else is in the HIPAA release form guide.

Rule 3: Patients Have No Right of Access to Them

164.524(a)(1) grants every patient "a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set," and then lists two exceptions. The first is "(i) Psychotherapy notes;" the second is information compiled for a legal proceeding. Under 164.524(a)(2)(i), a request for the notes may be denied without giving the patient a right to have the denial reviewed.

Two limits keep this from becoming a loophole. First, the exclusion removes the patient's enforceable right; it does not forbid the therapist from sharing the notes. 164.502(a)(1)(i) permits a covered entity to disclose PHI "to the individual," so a clinician who judges that reading the notes would help the patient may provide them. Second, the exclusion covers the separate file and nothing else. Diagnosis, treatment plan, medication records, and progress summaries are in the designated record set and are subject to the full right of access, including the 30-day clock and the cost-based fee limit. OCR imposed a $100,000 penalty against a mental health center for failure to provide timely access to patient records (November 19, 2024). "It is therapy, so it is confidential" is not a ground for denying the chart.

State law can be more protective. Under 160.203(b), a state law that "relates to the privacy of individually identifiable health information and is more stringent" than the Privacy Rule is not preempted, and some states give patients broader access to mental health records than HIPAA does. Check the state statute before relying on the federal exclusion.

The Information Blocking Rule Uses the Same Definition

The federal information blocking regulations at 45 CFR Part 171 apply to health care providers and define the electronic health information they must not interfere with as electronic PHI in the designated record set, but 45 CFR 171.102 expressly states that it "shall not include: (1) Psychotherapy notes as defined in 45 CFR 164.501." A practice that keeps a proper separate file is not information-blocking by declining to release it. A practice whose "psychotherapy notes" are actually the progress notes in the chart has no such cover.

Subpoenas and Court Orders

A subpoena is not one of the exceptions in 164.508(a)(2). A disclosure "required by law" under 164.512(a) is, and a court order is required by law. A bare subpoena from an attorney, without a court order, is handled under 164.512(e), which requires either satisfactory assurance that the patient was notified or a qualified protective order, and even then the disclosure is of the chart; whether the separate file is reachable without an order or a psychotherapy-notes authorization is a question for counsel every time. The safe reflex for a small practice is to treat any legal process that names psychotherapy notes as a call to the attorney, not a fax.

Where the File Actually Lives

"Separated from the rest of the individual's medical record" is a physical requirement. On paper, that is a different folder, ideally a different cabinet. In an EHR, it is a section or document type that is walled off from the chart export and from the release-of-information workflow, so that "print complete record" does not include it. Not every EHR supports that. If the system cannot separate the notes, the choice is to keep them on paper, keep them in a separate secured system, or accept that whatever is typed into the progress note is chart. What a practice cannot do is type process notes into the chart and then call them psychotherapy notes when a request arrives.

Programs that also hold substance use disorder records have a second, stricter layer under 42 CFR Part 2, explained in 42 CFR Part 2 vs HIPAA.

What Therapists Get Wrong

• Over-labeling. Moving the diagnosis, the treatment plan, and progress summaries into the "separate file" to keep them from payers or patients. The definition excludes those items wherever they are filed; the label does not travel.
• Under-separating. Writing genuine process notes into the chart and assuming they are protected. They are chart.
• One release for everything. Sending the separate file on the strength of a general authorization. 164.508(b)(3)(ii) requires a stand-alone psychotherapy notes authorization.
• Denying the whole chart. Treating the psychotherapy notes exclusion as a reason to slow-walk a records request. The chart is due in 30 days.
• Forgetting the amendment rule. Under 164.526(a)(2)(iii), a request to amend information that "would not be available for inspection under § 164.524" may be denied, which includes the separate file; the chart is still amendable.

What to Write Into the Policy

• A definition section that quotes 164.501 and lists, in the practice's own words, what goes in the separate file and what stays in the chart.
• The location and access controls for the separate file (paper cabinet or EHR section), and the rule that nothing in it is exported with the chart.
• A stand-alone psychotherapy notes authorization form, never combined with any other release.
• A records-request workflow: chart requests handled under 164.524 within 30 days; any request naming psychotherapy notes routed to the privacy officer and, for legal process, to counsel.
• The clinician's discretion to share notes with the patient, documented when exercised.
• A note on the state's mental health records statute, with the more protective rule identified.
• Training for every clinician and front desk member on the difference, repeated at onboarding and when the EHR changes.

The attorney's release at the top of this article gets the chart: diagnosis, plan, progress notes, everything in the designated record set, within 30 days. The therapist's process notes go with it only if they were in the chart all along, and stay behind only if they were kept apart from the start. That is the entire rule, and the policy is what makes the filing decision before the request forces it. The rest of the behavioral health picture is on the HIPAA for behavioral health page.

---

FAQ

What counts as psychotherapy notes under HIPAA?

Under 45 CFR 164.501, notes by a mental health professional documenting or analyzing the conversation in a counseling session that are kept separate from the rest of the medical record. Diagnosis, treatment plan, medications, session times, test results, and progress summaries are excluded even if filed separately.

Can a patient get a copy of their psychotherapy notes?

Not as a matter of right. 164.524(a)(1)(i) excludes psychotherapy notes from the right of access, and a denial is unreviewable. The provider may still choose to share them, and some state laws give patients broader access.

Does a general release form cover psychotherapy notes?

No. 164.508(b)(3)(ii) says a psychotherapy notes authorization may only be combined with another psychotherapy notes authorization, so a separate, specific authorization is required.

Can we send psychotherapy notes to another provider for treatment without authorization?

No. The only treatment exception in 164.508(a)(2) is use by the originator of the notes. Disclosure to another provider requires a psychotherapy notes authorization.

Are notes typed into the EHR progress note protected as psychotherapy notes?

No. Notes that are not separated from the rest of the medical record do not meet the definition. They are ordinary PHI, part of the designated record set, and subject to the normal access and disclosure rules.

Conclusion

The psychotherapy notes rule rewards practices that decided, in writing, what goes in the separate file before the first subpoena arrived. One Guy Consulting's Full-Scope plan includes the behavioral health uses-and-disclosures policy, the psychotherapy notes authorization, and the records-request workflow, with consulting time for the request that needs a second opinion. Start with a free 30-minute compliance review. No obligation, no pressure.

Sources

• 45 CFR 164.501 (definition of psychotherapy notes)
• 45 CFR 164.508 (authorization requirements; psychotherapy notes at (a)(2))
• 45 CFR 164.524 (right of access; exclusion at (a)(1)(i))
• 45 CFR 164.512 (required by law, judicial proceedings)
• 45 CFR 171.102 (information blocking definitions; EHI excludes psychotherapy notes)

---

Related Reading

• HIPAA right of access: deadlines, fees, and denials
• HIPAA authorization requirements: form elements and rules
• The HIPAA release form: core elements and a template
• 42 CFR Part 2 vs HIPAA: substance use records explained