PHI in Psychotherapy Notes, What Information to Include & What to Not Include

Understanding Psychotherapy Notes and PHI

What is PHI in Psychotherapy Notes?

 

 

 

HIPAA Regulations and Psychotherapy Notes

What Information to Include in Psychotherapy Notes

What to Not Include in Psychotherapy Notes

The Bottom Line

23.What strategies can healthcare providers use to differentiate psychotherapy notes from progress notes in electronic medical records?

Keeping Psychotherapy Notes Distinct in Electronic Records

 

To keep psychotherapy notes clearly differentiated from regular progress notes in your electronic medical records (EMR), there are a few simple strategies you can use:

• Maintain Separate Storage: Ensure that your psychotherapy notes are stored in a segregated section of your EMR that is not accessible as part of the regular clinical record. Most modern EMR systems—including popular providers like Epic, Cerner, and SimplePractice—allow for dedicated, private areas designed specifically for these sensitive notes.
• Use Access Controls and Permissions: Make the most of your EMR’s access controls. Limit visibility of psychotherapy notes to only you (the treating therapist) or a tightly restricted group. This not only preserves client privacy but also upholds HIPAA’s heightened protections for these reflections.

If you're unsure about the best way to accomplish this in your current EMR, consult their support documentation or customer service for clear instructions on segregating psychotherapy notes from standard documentation.

24.How does the "minimum necessary" rule apply to the disclosure of mental health information?

How the “Minimum Necessary” Rule Applies to Mental Health Disclosures

 

The “minimum necessary” standard is a core principle in maintaining client privacy, especially with sensitive mental health details. Under HIPAA, whenever information must be shared—whether for treatment, legal requests, or administrative needs—only the smallest amount of identifiable information required for the specific purpose should be disclosed.

For psychotherapy notes, this protection is even stronger. These notes should almost never be included when responding to information requests unless absolutely required and proper authorization is obtained. Even in situations like subpoenas or legal inquiries, evaluate what information is essential to provide, always withholding unnecessary personal identifiers whenever possible.

In a nutshell, always ask yourself: “Is this detail crucial for the purpose at hand?” If not, leave it out to uphold privacy standards and reduce legal risk. This habit keeps your disclosures compliant with HIPAA while centering client confidentiality at every step.

25.Why is proper documentation important in behavioral health care?

Why Documentation Matters in Behavioral Health Care

 

Diligent note-taking is at the heart of effective therapy. In behavioral health, well-maintained records go far beyond simple paperwork—they help therapists spot patterns, adjust treatment strategies, and track a client’s progress over time. Proper documentation also supports communication across care teams, ensuring everyone is on the same page if multiple providers are involved.

Clear, accurate notes are your safety net in challenging situations. They offer legal protection, provide a roadmap in complex cases, and empower you to deliver care that’s both thorough and responsive. Accurate records help you remember important session details, revisit goals, and refine your approach—ultimately making your sessions more impactful and your decisions more informed.

 

26.What additional safeguards might states impose on mental health records beyond HIPAA?

State-Level Safeguards for Mental Health Records

 

It’s important to remember that while HIPAA sets a federal baseline for protecting psychotherapy notes, some states go further to ensure the privacy of mental health records. These additional restrictions can differ widely depending on where you practice, often layering extra confidentiality on top of HIPAA’s requirements.

For example, states like California, New York, and Massachusetts may require mental health professionals to obtain written consent even for disclosures otherwise permitted under HIPAA. Others mandate stricter procedures for sharing any part of a client’s mental health record—sometimes limiting access even in court settings or requiring special court orders for release.

Additional state-level safeguards might include:

• Requiring more rigorous documentation before releasing records, such as detailed subpoenas or judicial review.
• Prohibiting disclosure of therapy content to family members or third parties, even with client consent, in situations involving sensitive information.
• Mandating enhanced security protocols for storing and transmitting mental health documentation, such as encrypted electronic records or locked file storage.
• Providing clients with the right to restrict access to their records, beyond what HIPAA allows.

Always consult your state’s guidelines or reach out to your local licensing board to ensure you’re complying with both federal and state-level requirements. Staying up to date with these laws not only protects your clients’ privacy but also shields your practice from costly legal complications.

27.How are patient records defined under the California Health and Safety Code?

How Patient Records Are Defined Under California Law

 

Under the California Health and Safety Code, patient records are broadly defined to encompass any document—regardless of format or storage method—that a healthcare provider maintains about a client’s health. This includes details related to physical or mental health history, diagnoses, conditions, and all forms of treatment provided or proposed. In the context of mental health, this also covers records specifically created during the evaluation or treatment of mental health conditions. 

Essentially, any documentation tied to a client’s care, from assessment through ongoing treatment, falls under the umbrella of a patient record according to California’s legal standards. This is a much wider net than psychotherapy notes, which remain separate due to their private, process-oriented nature.

 

28.What should a provider do if a patient requests access to both psychotherapy notes and other mental health records?

 

When a client asks to review both their psychotherapy notes and their general mental health records, it’s important to handle the request with care—and in line with HIPAA requirements.

 

Here’s how to navigate this situation:   

 

Provide access to standard mental health records. Clients are entitled to see most parts of their medical record, such as progress notes, treatment plans, and assessments.

Withhold psychotherapy notes. You are not required—and in most cases, should not—share psychotherapy notes. These are protected separately under HIPAA and are generally reserved for the therapist’s private use.

Clarify the distinction. If a client seeks access to both, you can explain that while their medical record is available to them, psychotherapy notes are considered private reflections and are excluded unless a rare exception applies (such as a court order or imminent risk scenario).

This approach allows you to respect both the client’s rights and the heightened privacy protections intended for psychotherapy notes.

 

29.Are healthcare providers required to grant access to other mental health records if psychotherapy notes are withheld?

 

Can Clients Access Their Other Mental Health Records If Psychotherapy Notes Are Withheld?

Yes—if you opt to withhold psychotherapy notes, clients (or their personal representatives) still retain the right to access their standard mental health records. HIPAA makes a clear distinction: while therapists can legally withhold psychotherapy notes due to their sensitive and personal nature, this restriction doesn't extend to the rest of the client's record. Information such as treatment summaries, diagnoses, session dates, medication details, and progress notes must still be provided upon valid request, unless another specific legal exception applies.This means you can maintain the privacy of your personal reflections while remaining compliant and transparent with other documentation.

 

30.What are the potential legal consequences for healthcare providers who fail to comply with HIPAA requirements for mental health records?

 

Failure to follow HIPAA requirements for handling mental health records doesn’t just jeopardize client trust—it can also carry serious legal and financial repercussions for healthcare providers. Violations may result in significant fines, civil penalties, or—in extreme cases—criminal charges depending on the nature and intent of the breach.

In addition to federal consequences under HIPAA, many states have their own mental health privacy laws that may impose even stricter standards. Overlooking these regulations could expose you to lawsuits, regulatory sanctions, and possible loss of professional licensure. Ultimately, protecting your clients' confidential information isn't just a best practice—it's essential for safeguarding your practice’s reputation and legal standing.

 

31.Can a parent access their child’s psychotherapy notes?

 

It’s a common question: can parents see their child’s psychotherapy notes? Under HIPAA, the answer is almost always no. Psychotherapy notes are treated as the private reflections of the clinician—protected much more strictly than regular medical records or progress notes.

Even when a parent is otherwise able to access their child’s health records, psychotherapy notes remain off-limits. These notes are kept separate from the main chart and are not released to parents, guardians, or personal representatives, except in rare situations required by law (such as cases of suspected abuse or imminent harm).

This strict protection upholds the privacy of both the therapeutic process and the clinician’s own thought work, helping to maintain trust in the therapy setting—for children, adolescents, and adults alike.

 

32.How does HIPAA apply to minor patients regarding mental health records and psychotherapy notes?

 

When working with minor clients, HIPAA protections still apply to their mental health records and psychotherapy notes—but with some important nuances. Generally, parents or legal guardians are considered the personal representatives of minor clients, granting them access to their child's medical and mental health records. However, there are circumstances where a minor can consent to their own mental health treatment, and in such cases, they may control access to portions of their record.

Psychotherapy notes for minors are granted the same heightened privacy protections as for adults. These notes should remain separate from the rest of the medical record and are not typically accessible—even to parents—unless state law or clinical judgment permits or requires disclosure (such as in situations involving imminent harm or mandated reporting).

Therapists should always stay informed about state-specific laws and seek guidance if questions arise about disclosure. The goal is to safeguard both the minor's privacy and the integrity of psychotherapy notes, while complying with federal and local requirements.

 

33.How do state laws interact with HIPAA regarding the protection of mental health records and psychotherapy notes?

 

It’s not just federal law that guides how you manage psychotherapy notes—state regulations can set the bar even higher. When state privacy laws are stricter than HIPAA, you must follow the standard that offers greater protection for your client’s mental health information.

This means it’s crucial to stay up-to-date on the rules in your own state. Some states, for example, may place additional restrictions on what can be disclosed or require more robust consent from clients. If you’re ever in doubt, always default to whichever law (HIPAA or your state’s) is more protective of client privacy.

 

In practice:  

Review both HIPAA requirements and your state’s statutes to ensure full compliance.

If state law provides more stringent privacy safeguards, those take priority over the federal baseline.

Seek legal consultation or guidance from your professional association (such as NASW, APA, or your state licensing board) if you’re unsure how the regulations apply in a specific situation.

By staying alert to both federal and state requirements, you’ll ensure your therapy documentation and privacy practices are ethical, legal, and focused on the best interests of your clients.

 

34.What are the requirements for sharing psychotherapy notes with health information organizations or electronic health information exchanges?

 

When it comes to health information organizations (HIOs) or electronic health information exchanges, the handling of psychotherapy notes is especially strict. Even if you are permitted to share other types of protected health information (PHI) through these systems, psychotherapy notes cannot be disclosed without explicit, written authorization from the client.

This requirement goes above and beyond general HIPAA rules for other medical records. It doesn’t matter if you are sharing documentation for treatment, billing, or coordination with other providers—psychotherapy notes must remain confidential unless the client has specifically agreed in writing to their release.

Keep in mind:

 

Psychotherapy notes are never automatically included in electronic data shared with HIOs or exchanges.

Always obtain separate, written consent from the client for any disclosure of psychotherapy notes, no matter the purpose.

Only include the minimum necessary information when sharing any PHI—if unsure, consult your organization’s privacy officer or legal counsel before proceeding.

These rules help safeguard both the therapeutic relationship and your own professional liability by ensuring private reflections and sensitive content are not inadvertently disclosed.

 

35.How does HIPAA address access to a deceased relative’s protected health information?

 

HIPAA’s privacy protections extend beyond a person’s lifetime, meaning that a client’s protected health information (PHI) remains confidential even after their death. However, access can be granted in certain circumstances. Generally, a deceased individual’s PHI may be released to the executor or administrator of their estate, or to someone authorized by law or in writing before death. In situations where no estate representative exists, a family member or other individual involved in the person’s care or payment for care may have limited access to relevant health information—such as for settling affairs or continuing care.

It’s important to note that HIPAA limits this access to only the PHI necessary for those specific purposes. Additionally, after 50 years, all PHI protections under HIPAA expire and the information is no longer considered protected.Healthcare providers should always verify a requester’s authority before releasing any records and remain mindful of state-specific laws, which may provide even stricter guidelines.

 

Sources:

U.S. Department of Health and Human Services. (2022). Guidance Regarding Methods for De-Identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html#protected

Office for Civil Rights (OCR). (2017). Does HIPAA Provide Extra Protections for Mental Health Information compared with Other Health Information? https://www.hhs.gov/hipaa/for-professionals/faq/2088/does-hipaa-provide-extra-protections-mental-health-information-compared-other-health.html

 

36) What are some common formats used for psychotherapy notes (e.g., SOAP, BIRP, DAP)?

There are several well-established formats therapists often use when drafting psychotherapy notes, each with its own structure and purpose. Three of the most widely recognized are:

SOAP (Subjective, Objective, Assessment, Plan): Organizes notes into key clinical categories, making it easy to capture the flow of each session.

BIRP (Behavior, Intervention, Response, Plan): Focuses on the client’s behaviors and the therapist’s interventions, offering a clear narrative on progress and next steps.

DAP (Data, Assessment, Plan): Provides a streamlined approach, emphasizing the essential session highlights, clinical impressions, and going-forward strategies.

While preferences vary, these formats can help keep reflections organized and consistent—just remember, the core purpose of psychotherapy notes remains to support your own clinical thinking, not to serve as formal medical documentation.

37) Why might clients feel concerned about not having access to their therapist's private notes?

It's natural for clients to feel a bit uneasy when they realize there’s a set of notes kept entirely private by their therapist—notes they’re not allowed to access. This can lead to questions: Are these notes hiding judgments, unexplained diagnoses, or information that could affect their care?

This lack of transparency may stir up concerns about trust and openness in the therapeutic relationship. Clients might wonder if these private reflections contain details they should know about, or if important insights are being sidelined from their own understanding or treatment plan.

Being aware of these common worries can help therapists reassure clients, clarify what psychotherapy notes are (and are not), and strengthen the collaborative nature of therapy.

38) Why is it important for therapists to use structured note-taking formats?

While psychotherapy notes offer therapists flexibility in how they’re created, adopting a structured format isn’t just about neatness—it’s about making your work genuinely more useful. Unstructured, scattered notes might seem freeing in the moment, but tracking your own thoughts later can quickly turn into a frustrating guessing game (and “guess-what-I-meant-a-week-ago” is never anyone’s favorite therapy exercise).

Structured note-taking formats—like SOAP, BIRP, and DAP—are popular for good reason. They provide an organized, predictable flow, so your notes remain clear, logical, and easy to review weeks or months later. This means you spend less time trying to decode your own shorthand and more time focusing on your clients. Ultimately, having a consistent format supports your clinical reasoning and better prepares you for future sessions, turning your notes into a genuinely valuable tool rather than a cryptic puzzle.

39) As a therapist, what is the practical difference between psychotherapy notes and progress notes for HIPAA compliance?

The primary difference lies in their purpose and level of legal protection under HIPAA. Progress notes are part of the official medical record, documenting the client's care, including diagnosis, treatment plan, and progress. They are required by law and can be shared with other providers or insurance companies for treatment and billing. Psychotherapy notes, often called "process notes," are for your personal use to record your private thoughts, clinical impressions, and hypotheses. To receive special HIPAA protection, they must be stored entirely separate from the client's medical record. Consider implementing a documentation system that clearly separates these two types of notes to maintain compliance.

40) What specific information is excluded from psychotherapy notes according to HHS.gov?

According to HIPAA, several categories of information must be excluded from psychotherapy notes to maintain their protected status. This includes medication prescriptions and monitoring, session start and stop times, the modalities and frequencies of treatment, results of clinical tests, and any summary of diagnosis, functional status, the treatment plan, symptoms, or prognosis. This information belongs in the client's official progress notes.

41) I've seen on Reddit that therapists worry about subpoenas. How protected are my psychotherapy notes if I receive a legal request?

Psychotherapy notes have significantly stronger legal protections than progress notes. While not entirely immune from disclosure, a specific client authorization is generally required for their release. If you receive a subpoena, it is not an automatic requirement to release them. The first step is to verify the scope of the request and consult with legal counsel, as many requests can be challenged or narrowed to protect the sensitive nature of these notes.

42) Can a client or their parent demand to see their psychotherapy notes?

No, under HIPAA, clients do not have a right to access their psychotherapy notes. This is a key distinction from progress notes and the rest of the medical record, which they can generally access upon request. This rule is in place because psychotherapy notes contain the clinician's private reflections and are not considered part of the formal record of care. Be prepared to explain this distinction if clients or their representatives ask.

43) What are the most common mistakes to avoid when writing psychotherapy notes to ensure they remain protected?

A common mistake is blending objective data with your subjective thoughts. To keep psychotherapy notes protected, avoid including any PHI or diagnostic information that belongs in a progress note, as this could legally convert them into regular medical records. Also, do not store them in the same location as the client's chart. Maintaining a clean boundary between your private reflections and the official record is critical for compliance.

44) What is the "duty to warn" exception for disclosing psychotherapy notes without client authorization?

The "duty to warn" is a significant exception to the privacy of psychotherapy notes. If your notes contain information indicating a serious and imminent threat of harm by the client to themselves or a specific person, you may be legally obligated to disclose this information to protect safety. It's one of the few scenarios, along with situations like mandated reporting of child abuse, where the law may compel disclosure. Explore your state's specific statutes on this topic.

45) How should I securely store my psychotherapy notes, especially if I use an EHR?

To be HIPAA compliant, psychotherapy notes must be kept separate from the client's main medical record. If you use an Electronic Health Record (EHR), check if it has a specific, separate module designed for psychotherapy notes that is firewalled from the rest of the chart. If not, you must use a different, secure system. Security is mandatory, so ensure the storage is encrypted, access is limited, and any backups are also secure.

46) Is it better to keep very detailed or very brief psychotherapy notes?

The level of detail depends on their utility for you as a clinician. These notes are for your benefit, helping you track your hypotheses, transference, and countertransference, and plan for future sessions. They should be detailed enough to be clinically useful for your reflection and supervision but should not contain the objective, factual information that belongs in a progress note. Avoid using boilerplate templates, as each session is unique.

47) Can I include my own personal feelings and reactions to a session in my psychotherapy notes?

Yes, psychotherapy notes are the appropriate and intended place for your personal reactions, clinical impressions, and subjective thoughts about the therapeutic process. Unlike progress notes, which must be objective, psychotherapy notes are your private workspace to analyze the session and your own experience of it. Leveraging these notes can be a powerful tool for self-supervision and improving your clinical approach.

48) If I don't include PHI, can I use my psychotherapy notes for my own training or in a supervision group?

Yes, one of the permissible uses of psychotherapy notes under HIPAA is for the originator's own training purposes. This can include use in clinical supervision where you are working to improve your counseling skills. As a best practice, continue to de-identify information as much as possible to protect confidentiality, even in a professional setting like supervision. Learn more about how to effectively use your notes to enhance your clinical development.