Navigating psychotherapy notes
under HIPAA: what stays separate, and why.
Healthcare Compliance Attorney. Contributor at CalmScribe.
PUBLISHED: February 18, 2026 • UPDATED: February 18, 2026
Direct Answer Summary
Psychotherapy notes are a narrow, optional category that HIPAA shields more tightly than the rest of the chart. Under 45 CFR 164.501, they are a provider's private analysis of what was said in a counseling session, kept separate from the medical record. Disclosing them generally requires a separate patient authorization. Almost everything an insurer or auditor actually needs (diagnosis, treatment plan, interventions, medication, session times) is excluded from the definition by the regulation itself and lives in the progress notes instead.
Few terms in behavioral health documentation are misunderstood as often as psychotherapy notes. Clinicians frequently assume the phrase covers every note they write about a therapy session, and that the whole chart therefore enjoys an extra layer of legal protection. The opposite is closer to the truth. HIPAA carves out a very small, specific kind of note and protects only that, while leaving the substantive clinical record subject to the same access rules as any other protected health information.
Getting the boundary right matters in practice. It determines what you hand to a payer during an audit, what you produce in response to a subpoena, and what a patient can compel you to release. This guide walks the legal definition, the heightened protection, the exclusions that trip people up, the handful of disclosures allowed without authorization, and the storage discipline that holds the whole thing together.
1. What the regulation actually says
The definition sits in 45 CFR 164.501. Psychotherapy notes are the notes recorded by a mental health professional documenting or analyzing the contents of a conversation during a private counseling session, or a group, joint, or family counseling session, and that are kept separate from the rest of the individual's medical record. In plainer terms, this is the clinician's private working material: hypotheses, impressions, raw process observations, the things you jot to think through a case rather than to bill or to communicate with other providers.
The separation requirement is not decorative. It is part of the definition. A note only qualifies as a psychotherapy note if it is held apart from the HIPAA-governed designated record set. Merge it into the chart and it loses the special status, because at that point it is functionally a progress note.
2. The heightened protection
Most PHI can be used or disclosed for treatment, payment, and health care operations without a specific authorization. Psychotherapy notes are the exception. Under 45 CFR 164.508, a covered entity must obtain a separate authorization from the patient before using or disclosing them, and that authorization cannot be bundled into a general consent or a release covering the rest of the record. The patient has to knowingly and specifically agree to release the psychotherapy notes as their own act.
The same provision bars a health plan from conditioning payment, enrollment, or eligibility on whether the patient authorizes release of psychotherapy notes. A payer cannot tell a patient that a claim will only be paid if the underlying process notes are surrendered. This is the legal mechanism that keeps a therapist's private analysis out of the reimbursement pipeline.
3. What HIPAA expressly excludes from the definition
This is where most compliance errors originate. The same regulatory definition that creates the category also lists what is not a psychotherapy note. The following items are explicitly excluded, which means they are ordinary medical record content and carry no special protection:
- Medication prescription and monitoring.
- Counseling session start and stop times.
- The modalities and frequencies of treatment furnished.
- Results of clinical tests.
- Any summary of diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.
Read that list carefully, because it is almost everything a clinician documents to run a practice. Diagnosis, the treatment plan, the interventions delivered, the patient's progress, the meds, the session length: none of it is a psychotherapy note. All of it belongs to the designated record set and travels with the chart. The protected residue is the small set of private analytic notes that contain none of those operational elements.
The practical takeaway is that the golden thread connecting assessment to treatment plan to individual session documentation lives entirely in progress-note territory. If you are demonstrating medical necessity, you are doing it in the part of the record a payer is entitled to see. The psychotherapy notes were never going to carry that weight, and they were never meant to.
4. Psychotherapy notes vs progress notes
The cleanest way to internalize the distinction is to put the two record types side by side. The same session can produce both, but they are governed by different rules and live in different places.
The clinician's private analysis of the conversation: process impressions, working hypotheses, raw observations used to think through the case.
Heightened. A separate patient authorization is generally required to disclose, and it cannot be bundled with a general release.
The originator for their own treatment use. Others only with separate authorization or under a narrow statutory exception.
Diagnosis, treatment plan, interventions, symptoms, prognosis, progress, medication, session start and stop times, modalities, and test results.
Standard PHI. Usable for treatment, payment, and operations under the ordinary HIPAA rules.
The patient on request, payers during audits, and other providers for coordinated care, subject to standard safeguards.
5. The narrow disclosures allowed without authorization
The authorization rule has a short list of exceptions written into the Privacy Rule. Outside of these, you need the patient's separate authorization. A use or disclosure of psychotherapy notes may proceed without authorization in the following situations:
- Use by the originator of the notes for their own treatment of the patient.
- Use by the covered entity to train students, trainees, or practitioners in supervised group, joint, family, or individual counseling.
- Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the patient.
- Disclosure required by law, or to a health oversight agency for lawful oversight of the originator of the notes.
- Disclosure to avert a serious and imminent threat to the health or safety of a person or the public.
- Disclosure to a coroner or medical examiner, or where required by the Secretary of HHS to investigate compliance.
Note how tightly drawn these are. The training exception runs to the entity's own supervised programs. The litigation exception applies when the patient sued, not when a third party seeks the notes. The oversight exception covers oversight of the note's originator. None of these opens the door to a routine payer audit.
6. Storage, audits, and subpoenas in practice
Because separation is built into the definition, storage is a compliance control rather than a filing preference. Keep psychotherapy notes physically or logically apart from the designated record set: a distinct paper file, a separate locked module in the EHR, or an access-restricted location that is clearly not part of the billable chart. The moment process notes are interleaved with progress notes, the protection evaporates and a clinician can no longer represent that those entries are exempt psychotherapy notes.
When an insurer audits a claim, the auditor is entitled to the records that justify reimbursement, which are the progress notes documenting diagnosis, medical necessity, interventions, and session parameters. They are not entitled to the psychotherapy notes. A well-organized practice satisfies the audit fully from the designated record set without ever touching the protected file, which is exactly the outcome the regulation is designed to produce.
Subpoenas require more care. A subpoena is not the same as a court order, and neither one automatically overrides the HIPAA authorization requirement for psychotherapy notes. State psychotherapist-patient privilege can layer additional protection on top of the federal floor. The right move when a request reaches the psychotherapy notes is to involve legal counsel and respond through the proper channel rather than producing the notes reflexively. A request that is properly limited to the designated record set, by contrast, is handled like any other release of standard PHI.
7. Where ambient documentation tools fit
The line between protected and unprotected notes carries straight into how you configure documentation technology. Ambient and AI-assisted scribes are built to draft the designated record set: the diagnosis, interventions, treatment plan, and session structure that a progress note needs. That content was always ordinary PHI, so producing it with a tool changes nothing about its protection level. Psychotherapy notes, if you keep them, should stay in your own separate, access-restricted location rather than flowing through a generation pipeline that targets the billable chart.
The compliance questions for these tools therefore sit on the PHI side of the line: data custody, vendor contracts, and patient consent. If you are evaluating one, our guide to evaluating clinical AI scribes covers the vetting framework, and the cornerstone DAP note guide shows what defensible progress-note content looks like in practice. For broader compliance reading, the full guides index collects the related material.
Frequently Asked Compliance Questions
Are psychotherapy notes required by HIPAA?
No. HIPAA does not require a clinician to keep psychotherapy notes. The category is optional. HIPAA only defines what psychotherapy notes are and grants them heightened protection if a clinician chooses to keep them physically or logically separate from the rest of the medical record. Many practitioners keep no psychotherapy notes at all and document entirely in progress notes, which is fully compliant.
Can an insurer demand psychotherapy notes during an audit?
Generally no. Payers are entitled to the progress notes that substantiate billing and medical necessity, not the separately maintained psychotherapy notes. Under 45 CFR 164.508, a health plan cannot condition payment, enrollment, or eligibility on a patient authorizing release of psychotherapy notes. Audit and utilization review activity operates on designated record set content such as diagnosis, treatment plan, interventions, and session start and stop times.
Are psychotherapy notes discoverable in court?
A subpoena or court order does not automatically override the HIPAA protections on psychotherapy notes, and a separate patient authorization is generally required to disclose them. State psychotherapist-patient privilege rules may add further protection. A clinician who receives a subpoena for psychotherapy notes should obtain legal counsel rather than producing them, while a valid request for progress notes from the designated record set is handled differently.
References & Sources
This guide draws on the HIPAA Privacy Rule, specifically the definition of psychotherapy notes at 45 CFR 164.501 and the authorization requirements at 45 CFR 164.508, along with U.S. Department of Health and Human Services Office for Civil Rights guidance on the Privacy Rule. State psychotherapist-patient privilege statutes vary and are not summarized here. This material is educational and is not legal advice; consult counsel licensed in your jurisdiction before responding to a subpoena or release request. To suggest corrections, contact our editorial desk.