What are psychotherapy notes, and do mine qualify?

Short answer: they are notes recording the contents of conversation during a counseling session, kept separate from the rest of the medical record. Both halves of that have to be true, or the special protection does not apply.

I am Scott Derby, I am an attorney, and most of what I get to tell psychologists and mental health therapists about HIPAA is a limit. This one is a protection, written specifically for you.

The rule defines psychotherapy notes as notes recorded, in any medium, by a health care provider who is a mental health professional, documenting or analyzing the contents of conversation during a private, group, joint, or family counseling session, and that are separated from the rest of the individual’s medical record.

Two things in that definition to notice. The notes have to record the contents of conversation during the session, not the session in general. And they have to be separated from the medical record. Kept separate, they may qualify for the special rules. Mixed into the medical record, they do not.

With limited exceptions, using or disclosing them requires the client’s specific written authorization, even when another provider wants them for treatment. That last part surprises people. The ordinary permission to share information for treatment is not enough for psychotherapy notes.

Picture a client who will not sign a release. Can you refuse to treat them until they do? No. Can their health plan refuse to enroll them, or refuse to cover their care? Also no. There are a few narrow exceptions to that rule, but the one exception a plan normally has, the one that lets it ask for an authorization at enrollment, does not apply to psychotherapy notes at all.

The category is also narrower than people assume. It does not include medication prescription and monitoring. It does not include session start and stop times, or the modalities and frequencies of treatment. It does not include the results of clinical tests. And it does not include any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, or progress. All of that belongs in the regular record, even if you type it somewhere else.

One more thing, because it is the trap people actually fall into. Most authorization forms can be bundled. You can put several permissions on one page and have the client sign once. Psychotherapy notes are the exception. That authorization has to stand alone. It cannot ride along on your general release of information, which means the release form your clients already sign is not enough to release these notes, no matter what it says.

So if you keep psychotherapy notes, it is worth ten minutes deciding two things: what goes in them, and where they live. The content and the separation are what determine whether they get the protection.

This is general information about federal HIPAA. It is accurate as of writing and it can change. Your state very likely has its own privacy rules that sit on top of HIPAA and can be stricter, so treat this as a starting point rather than the final word, and check what applies where you practice. This is education, not legal advice for your specific situation.