Psychotherapy Notes vs. Progress Notes: A HIPAA Compliance Guide for Therapists
As a mental health professional, you're likely accustomed to writing progress notes after a therapy session. But not all clinical documentation is the same.
Process notes — often resembling a reflective journal — differ from progress notes, and psychotherapy notes carry specific requirements under HIPAA law. Understanding what to include in each, and what to leave out, is crucial for protecting both you and your clients.
Psychotherapy notes often capture your feelings, reflections, and observations. They're meant for your own benefit, to sharpen your therapeutic effectiveness — even though the content may not always be strictly factual. Because of their sensitive, personal nature, they carry special legal protections and must be kept private and secure.
What Are Psychotherapy Notes? PHI and Privacy Basics
Psychotherapy notes are private notes mental health clinicians keep for themselves — reminders, questions for supervision, or general observations about a session. They exist solely for the therapist's benefit.
Sometimes called process notes, they differ from progress notes, which are part of the client's official medical record. There's no required format for psychotherapy notes, but the distinction between the two note types matters a great deal for compliance.
Protected Health Information (PHI) includes any data that can identify a client, created, used, or disclosed during healthcare services. According to the Department of Health and Human Services (HHS), PHI identifiers include:
- Name
- Geographic divisions smaller than a state
- Phone and fax numbers
- Dates (birth, admission, discharge)
- Medical record numbers
- Health plan beneficiary numbers
- Email addresses
- Certificate/license numbers
- Photos (including full-face images)
- Biometric identifiers (e.g., fingerprints)
- ZIP codes
- Vehicle identifiers
- URLs
- Social Security numbers
- Account numbers
- Device identifiers and serial numbers
- IP addresses
Psychotherapy notes are not part of a client's official medical record and typically contain minimal PHI. Because they often reflect a therapist's personal thoughts, keeping them secure is essential — and HIPAA affords them special protection.
Recommended Reading: The Best Mental Health Therapy Progress Note Generator
HIPAA and Psychotherapy Notes: What the Law Says
HIPAA provides additional protections that limit the release of psychotherapy notes. Per HHS, these notes receive special protection because they're kept by the clinician for their own benefit. HIPAA requires client consent and authorization before releasing psychotherapy notes to anyone other than the clinician who wrote them.
The HIPAA Privacy Rule defines psychotherapy notes as follows:
"Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record. Psychotherapy notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date."
The Privacy Rule further states:
"Psychotherapy notes are treated differently from other mental health information both because they contain particularly sensitive information and because they are the personal notes of the therapist that typically are not required or useful for treatment, payment, or health care operations purposes, other than by the mental health professional who created the notes. Therefore, with few exceptions, the Privacy Rule requires a covered entity to obtain a patient's authorization prior to a disclosure of psychotherapy notes for any reason, including a disclosure for treatment purposes to a health care provider other than the originator of the notes. See 45 CFR 164.508(a)(2). A notable exception exists for disclosures required by other law, such as for mandatory reporting of abuse, and mandatory 'duty to warn' situations regarding threats of serious and imminent harm made by the patient (State laws vary as to whether such a warning is mandatory or permissible)."
In short: to disclose psychotherapy notes for any reason, you need client authorization. Ideally, these notes stay private for the clinician's benefit and are released only when legally required — such as for abuse reporting.
What to Include in Psychotherapy Notes
Psychotherapy notes exist for the clinician's benefit. They may include:
- Observations about the client: Personal insights or thoughts about the client's behavior or statements during the session.
- Questions for consultation or supervision: Points to raise with colleagues or supervisors for guidance.
- Hypotheses about the client: Theories or ideas about the client's issues or behaviors that may need further exploration.
These notes shouldn't include treatment details, since they're meant for personal use. You might jot down something to revisit later, or flag a topic that needs supervision.
When writing process notes, focus less on treatment details and more on the therapy process itself. For example, if you notice strong personal feelings you want to discuss with a supervisor, a process note is the appropriate place — even though such feelings may be unsuitable for the client's official record.
There's no strict format for process notes; they often resemble journal entries. Some clinicians write these notes anonymously and exclude any PHI to further protect privacy, since a judge can order their release in specific situations. Your comfort level should guide what you include. If you're unsure, consult with a supervisor, your licensing board, or your liability insurance provider.
What to Exclude From Psychotherapy Notes
Because psychotherapy notes aren't part of the client's medical record, they should exclude:
- Medication prescription and monitoring
- Start and stop times of sessions
- Treatment modalities used
- Results of clinical tests or assessments
- Diagnosis
- Functional status
- Treatment plan
- Prognosis
- Symptom description
- Any overview of client progress
- Treatment summaries
- Details about payment for healthcare services
This information belongs in mental health progress notes, which are part of the client's official record.
Streamline Psychotherapy Notes with S10.AI
Therapists often keep personal notes on sessions, distinct from official medical records. There's no legal requirement to create these notes, and no standardized format.
S10.AI, an AI scribe for therapists, helps capture session details in real time — freeing clinicians from lengthy post-session note-taking. Here's how it helps:
- Focus on the Client: Automated note-taking lets therapists stay present and fully engaged during sessions.
- Enhanced Accuracy: Advanced technology captures conversational nuance, including nonverbal cues, for more comprehensive notes.
- Improved Efficiency: Eliminates the burden of post-session documentation, freeing time for client care.
Confidentiality remains paramount: notes generated with S10.AI, or otherwise, are strictly confidential and never shared with anyone — including insurance companies — without explicit client consent. Therapists can customize S10.AI to minimize PHI captured, for maximum client privacy.
The choice to reflect: while not mandatory, therapists can use these notes for self-reflection and growth, analyzing session dynamics and personal reactions to sharpen their therapeutic approach.
Legal Protections for Psychotherapy Notes Under HIPAA
Psychotherapy notes carry robust legal protections under HIPAA that distinguish them from standard progress notes:
- Higher Privacy Standards: Therapists can decline to share psychotherapy notes, ensuring confidentiality unless specific circumstances dictate otherwise.
- Restrictions on Sharing: While progress notes may be shared with client consent or legal authority, psychotherapy notes remain more private — often inaccessible even to office staff without explicit permission.
- Exceptions Through Legislation: The information blocking provisions of the 21st Century Cures Act, which took effect April 5, 2021, require healthcare providers to share clinical notes electronically with patients. This requirement does not extend to psychotherapy notes, which remain excluded and protected.
- Insurance Company Limitations: Insurance audits may require sharing progress notes to justify coverage, but HIPAA protects psychotherapy notes from such disclosures absent specific legal conditions.
Exceptional situations where disclosure might still be required:
- Legal Orders: A judge may mandate release for a court case.
- Public Safety Concerns: Credible threats to a client's or others' safety may require accessing the notes to prevent harm.
While not entirely immune from disclosure, psychotherapy notes are afforded significant privacy protection under HIPAA — giving both therapists and clients meaningful assurance.
2026 Compliance Note
HIPAA enforcement and penalty structures are updated periodically, and behavioral health compliance requirements continue to evolve alongside 42 CFR Part 2 alignment and information-blocking rules. Regardless of the exact figures in effect, the underlying practice doesn't change: keep psychotherapy notes segregated, encrypted, and access-controlled, and conduct regular documented security risk assessments.
Key Exclusions for Psychotherapy Notes
To preserve confidentiality, be sure to leave out:
- Prescription medications: Record separately from psychotherapy notes.
- Demographic information: Age, gender, address, and similar details should stay out to preserve privacy and separation from progress notes.
- Progress note information: Avoid session summaries or diagnosis details that belong in the official record.
By focusing strictly on the therapist's impressions and observations, psychotherapy notes retain the confidentiality — and legal protection — they're designed for.
Tips for Writing Compliant Psychotherapy Notes
-
Exercise Discretion with Detail. Psychotherapy notes aren't entirely immune from disclosure. As a guideline, only record what you'd be comfortable sharing with legal authorities if required.
- Segregate Note Types. Keep psychotherapy notes clearly distinct from progress notes — avoid prescription details or demographics that belong elsewhere.
- Develop a Personal Shorthand. A private shorthand can add a layer of protection, as long as it remains clear to you for future reference.
- Store Notes Separately. Keep psychotherapy notes physically and digitally separate from other client documentation to preserve their protected status.
- Know State and Federal Law. State privacy laws may offer more protection than HIPAA — stay current on the rules specific to your state.
- Understand Law Enforcement Limits. Police aren't automatically entitled to your psychotherapy notes without a court order; you can request they obtain judicial authorization first.
- Handle Subpoenas Carefully. A subpoena doesn't automatically mandate release. Understand your legal obligations and consult counsel if needed.
What to Do If Your Psychotherapy Notes Are Subpoenaed
If you're facing a subpoena for your psychotherapy notes, consider these steps:
- Confirm Specificity. Check whether the subpoena explicitly requests psychotherapy notes, or more generally seeks client records. In the latter case, you typically aren't required to submit detailed process notes.
- Engage in Negotiation. Contacting the requesting party — usually an attorney — to discuss terms is within your rights and can sometimes resolve the request.
- File a Motion to Quash. This asks the court to dismiss the subpoena on the grounds that disclosure would be detrimental or unjust.
- Request a Protective Order. A middle-ground option: agree to provide necessary records while limiting who can access them.
- Verify the Subpoena's Validity. Confirm it's judicially issued — in states where attorneys can draft subpoenas independently, a lawyer-drafted subpoena may not be enforceable without judicial backing.
Progress Notes vs. Psychotherapy Notes: Key Differences
| Progress Notes | Psychotherapy Notes | |
|---|---|---|
| Part of official record? | Yes | No |
| Shared with others? | Yes, with client consent or legal authority | No — confidential, for therapist's use |
| Format | Often follows SOAP or DAP frameworks | No standardized format |
| Typical content | Diagnosis, symptoms, interventions, progress summary | Private reflections, hypotheses, supervision questions |
| Client's right to access | Yes | No, with rare state-law exceptions |
Progress notes are formal documents meant for sharing with other professionals (with client consent), typically following frameworks like SOAP (Subjective, Objective, Assessment, Plan) or DAP (Data, Assessment, Plan). Psychotherapy notes, by contrast, are highly personal to the therapist — unshared, unstandardized, and often intangible to anyone else.
While larger organizations may enforce strict documentation guidelines, many therapists in private practice have discretion over their documentation style. Still, the distinction matters enormously for privacy law and ethics: progress notes are part of the official clinical record, while psychotherapy notes enjoy heightened confidentiality.
State vs. Federal Privacy Law
HIPAA is a federal baseline, but state laws can offer additional protections that take precedence when more stringent. If you practice in multiple states, stay current on each state's specific rules — consult legal resources or professional organizations that track state-specific legislation.
Can Insurance Companies Access Psychotherapy Notes?
No. Psychotherapy notes generally enjoy greater protection than progress notes under HIPAA:
- Progress notes may be shared with insurers, since they contain the general session content, treatment plans, and progress information insurers need for claims and coverage.
- Psychotherapy notes are the therapist's personal reflections and remain confidential unless the client provides explicit consent.
Distinguishing between the two — and understanding what can and cannot be shared — protects client privacy and preserves trust, which is essential to effective therapy.
Can Clients Access Their Own Psychotherapy Notes?
Generally, no — psychotherapy notes are highly protected, and clients don't have a right to access them under federal law. This protects the therapist's ability to maintain an accurate, effective record without external pressure.
Exceptions: Some states grant clients more rights than HIPAA does. Vermont, for example, allows clients to view their psychotherapy notes under state law.These exceptions are uncommon and vary by jurisdiction. Parents of minors and other interested parties are also generally restricted from accessing these notes unless explicitly permitted by law.
When Might You Share Psychotherapy Notes?
While rarely required, there are situations where sharing may be worth considering:
- Facilitating Client Transitions: When a client changes therapists, psychotherapy notes can offer the new provider deeper insight into the client's history — though the benefits should be weighed against the risk of misinterpretation.
- Enhancing Collaboration: Sharing with other providers, such as a prescribing psychiatrist who sees the client less frequently, can support more informed treatment decisions.
- Boosting Client Engagement: Some clients feel more connected to treatment when they can review their notes, which may enhance commitment to therapy — though notes shared directly with clients should be written with extra care and sensitivity.
Frequently Asked Questions
How does the "minimum necessary" requirement apply to disclosing confidential mental health information?
HIPAA's "minimum necessary" standard requires covered entities to limit any disclosure to the smallest amount of information needed for the intended purpose. For psychotherapy notes, this threshold is even higher: these notes are rarely shared, and only essential details — never the full content — are considered for disclosure, and only with proper authorization or a legal requirement. State laws vary, and in rare instances (like a court order related to imminent harm or abuse), disclosure may be compelled. Always err on the side of discretion.
What policies and procedures should be in place for responding to records requests?
- Differentiate record types: Ensure staff understand the difference between psychotherapy notes and standard clinical/progress notes.
- Implement clear filing systems: Separate psychotherapy notes physically and electronically, coordinating with your EHR provider as needed.
- Standardize response protocols: Document who reviews requests, how legitimacy is verified, and what steps precede any disclosure.
- Use specific authorization forms: Ensure forms clearly specify which records are requested and who may receive them.
- Train staff regularly: Review policies and walk through hypothetical scenarios.
- Consult legal experts when in doubt: Especially for complex requests involving third parties or unclear authorizations.
How do I differentiate between psychotherapy notes and progress notes to ensure HIPAA compliance?
Progress notes are part of the official medical record and must include diagnosis, treatment plan, session times, and progress. Psychotherapy notes are for personal use — private reflections, questions, and analyses — and must be stored entirely separate from the client's record to retain their special HIPAA protection.
What specific information must I exclude from psychotherapy notes to avoid compliance issues?
Exclude anything that belongs in the official medical record: medication prescriptions and monitoring, session start/stop times, treatment modalities, clinical test results, and any summary of diagnosis, functional status, treatment plan, symptoms, or prognosis. An AI scribe can help capture this required data accurately in your progress notes, leaving psychotherapy notes free for pure clinical reflection.
What are the real-world consequences of mixing progress notes with psychotherapy notes?
Blending the two eliminates HIPAA's special protections. The entire blended note becomes part of the medical record — accessible to clients, discoverable during insurance audits, and potentially subject to legal proceedings. This can expose private thoughts and clinical hunches, creating meaningful legal and ethical risk. Strict separation is a non-negotiable best practice.
My client is asking for a copy of their records — am I required to release my psychotherapy notes?
No. HIPAA gives clients the right to access their official medical record (including progress notes), but this right doesn't extend to psychotherapy notes, which are the therapist's personal work product. Having a clear policy on this helps set client expectations from the outset.
What's the best way to store psychotherapy notes, especially with an EHR system?
Keep them physically or digitally separate from the client's official chart — not in the same EHR section as progress notes. Many clinicians use a separate, encrypted digital file or a locked physical journal, ensuring the notes can't be accidentally or routinely accessed alongside the rest of the client's chart.
Can I be legally compelled to release psychotherapy notes in a court case?
Yes, release can be compelled by a court order, though this is a high bar. Never release these notes in response to a subpoena alone — consult legal counsel and confirm specific client authorization first. Understanding the difference between a subpoena and a court order is critical.
What content is appropriate to include in psychotherapy notes?
Document and analyze conversations, explore your own counter-transference, jot down hunches or hypotheses, formulate supervision questions, and track subjective impressions of the client's journey — think of them as a private, reflective journal that helps you become a more effective therapist.
If I don't bill insurance, do I still need to worry about the distinction between psychotherapy and progress notes?
Yes. HIPAA compliance isn't just about insurance billing — it's a federal law protecting all PHI. The special status of psychotherapy notes and the requirement to keep them separate apply to all covered entities, regardless of billing practices.
How can an AI scribe improve my note-taking process for both progress and psychotherapy notes?
An AI scribe can generate the structured, objective data required for compliant progress notes (session times, interventions, progress toward goals), ensuring completeness. This frees you to reserve your private psychotherapy notes for clinical insight and reflection, without the risk of accidentally including data that belongs in the medical record.
What is the "minimum necessary" standard, and how does it apply to releasing psychotherapy notes?
This core HIPAA principle requires disclosing only the minimum PHI necessary to accomplish a task. For psychotherapy notes — which carry the highest protection — this standard is especially important: even when a release is authorized, disclose only the specific information requested, redacting or withholding everything else. This minimizes exposure and demonstrates a genuine commitment to client privacy.