Skip to main content
HIPAA Path
Category: De-identification and PHI Types

Psychotherapy Notes

Also known as: Process Notes, Private Notes
Simply put

Psychotherapy notes are the private notes a mental health professional writes to document or analyze what was discussed during a counseling session, kept separate from the rest of a patient's medical record. Because they capture the provider's personal impressions rather than routine treatment information, HIPAA generally gives them stronger protection than other health information. State laws and other federal privacy rules may add further requirements, so readers should verify against current regulations.

Formal definition

Under the HIPAA Privacy Rule, psychotherapy notes are defined as notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private, group, joint, or family counseling session, and that are separated from the rest of the individual's medical record. The Privacy Rule affords these notes heightened protection relative to other protected health information, generally requiring specific individual authorization for most uses and disclosures rather than relying on the standard treatment, payment, and health care operations permissions. This term applies only to the provider's own analytical or process notes and does not encompass items such as medication prescription and monitoring, session start and stop times, modalities and frequencies of treatment, results of clinical tests, or summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress. This entry addresses the HIPAA Privacy Rule definition only; state law and other federal privacy statutes may impose additional or differing requirements, and readers should confirm the current regulatory text and any patient access provisions against applicable law.

Why it matters

Psychotherapy notes occupy a special place under the HIPAA Privacy Rule because they capture a mental health provider's personal impressions and analysis of a counseling session rather than the routine clinical information found elsewhere in the medical record. This distinction matters because the Privacy Rule generally requires specific individual authorization for most uses and disclosures of these notes, rather than allowing them to flow under the standard treatment, payment, and health care operations permissions that apply to other protected health information. For compliance officers and privacy officers, misclassifying what qualifies as a psychotherapy note, or storing it improperly within the general record, can undermine the heightened protection the rule is designed to provide.

The stakes are practical: because these notes are afforded stronger protection, a provider or organization that discloses them without the required authorization may face compliance exposure that would not attach to ordinary PHI. At the same time, the definition is narrow. Items such as medication prescription and monitoring, session start and stop times, treatment modalities and frequencies, clinical test results, and summaries of diagnosis, treatment plan, symptoms, prognosis, and progress fall outside the definition and do not receive this elevated treatment. Getting this boundary right is essential to applying the correct handling rules.

Because patient access and disclosure rules in this area intersect with other federal health privacy laws and with state law, organizations should not treat the HIPAA definition as the whole picture. Each state can set additional requirements, and access rights may differ from those applying to the general medical record. Readers should verify their specific obligations against current regulatory text and applicable state law rather than relying on the HIPAA definition alone.

Who it's relevant to

Mental Health Providers and Practices
Therapists, psychologists, psychiatrists, and counseling practices are the primary creators of psychotherapy notes. They need to understand that keeping these notes separate from the general medical record is what preserves their heightened protection, and that most disclosures generally require specific individual authorization rather than the standard treatment, payment, and operations permissions.
Privacy Officers and Compliance Staff
Privacy officers must ensure organizational policies correctly distinguish psychotherapy notes from the excluded categories, such as medication monitoring, session times, and diagnosis or treatment summaries, so that authorization and access rules are applied appropriately. They should also account for state law and other federal privacy statutes that may add requirements beyond HIPAA.
Health Information and Records Management Teams
Teams responsible for record storage and release-of-information workflows need systems that keep psychotherapy notes physically or logically separate from the rest of the record, and that flag them for the specific authorization requirements that generally apply before any disclosure.
Legal Counsel Advising Healthcare Organizations
Attorneys advising on disclosures, patient access requests, and litigation must recognize that HIPAA affords these notes distinct treatment, that patient access rights are shaped by HIPAA and other federal privacy laws, and that individual states may set additional requirements, making it essential to confirm obligations against current applicable law.

Inside Psychotherapy Notes

Definition Under the Privacy Rule
Psychotherapy notes are a specifically defined term under the HIPAA Privacy Rule, generally referring to notes recorded by a mental health professional documenting or analyzing the contents of a counseling session and that are kept separate from the rest of the individual's medical record.
Separation Requirement
To qualify for the heightened protections, these notes must generally be maintained separately from the individual's other health records. Notes commingled with the general medical record typically do not receive this special status.
Excluded Content
The definition generally excludes items such as medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.
Heightened Authorization Standard
In most cases, a covered entity must obtain a specific patient authorization to use or disclose psychotherapy notes, even for many purposes that would otherwise be permitted for other PHI, though certain limited exceptions generally apply. Readers should verify the specific exceptions against current regulatory text.
Scope Limitation to Form
As a subset of PHI under the Privacy Rule, psychotherapy notes are covered regardless of form (paper, electronic, or oral). When maintained electronically, the ePHI would also fall within the scope of the Security Rule's safeguards.

Common questions

Answers to the questions practitioners most commonly ask about Psychotherapy Notes.

Are psychotherapy notes just the same as the rest of a patient's mental health record?
No. Under the HIPAA Privacy Rule, psychotherapy notes have a specific, narrow definition: they are the notes recorded by a mental health professional documenting or analyzing the contents of a counseling session, kept separate from the rest of the individual's medical record. The definition generally excludes items such as medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress. Those excluded items are part of the general record and do not receive the heightened protection that applies to psychotherapy notes. You should confirm the exact definition against the current regulatory text.
Do the heightened protections for psychotherapy notes mean patients cannot access their own records?
Not in general. The special treatment of psychotherapy notes is a distinct provision and does not eliminate a patient's broad right of access to the rest of their designated record set. The Privacy Rule generally does not require a covered entity to provide individuals with access to their own psychotherapy notes, but this is a narrow exception that applies only to notes meeting the specific definition. Access to other mental health information typically follows the ordinary access rules, subject to limited exceptions. State law may grant additional access rights, so readers should verify applicable state requirements.
When do we need a specific authorization to use or disclose psychotherapy notes?
The Privacy Rule generally requires a specific authorization for most uses and disclosures of psychotherapy notes, and this authorization cannot typically be combined with an authorization for other PHI. There are limited exceptions where authorization is not required, such as certain uses by the originator for treatment, use in the covered entity's own training programs, and defense in a legal action brought by the individual. Because these exceptions are narrow and fact-specific, confirm the current regulatory language before relying on any exception, and note that state law may impose stricter requirements.
How should we store psychotherapy notes to preserve their protected status?
A defining element of psychotherapy notes is that they are maintained separately from the rest of the individual's medical record. If these notes are commingled with the general record, they may lose the characteristics that qualify them for heightened protection. In practice, organizations typically maintain them in a separate file or a distinct, access-restricted section of an electronic system. When stored electronically, the notes are ePHI and the Security Rule's administrative, physical, and technical safeguards apply as they would to other ePHI. Consult your legal and privacy officers on implementation specifics.
How do psychotherapy notes interact with the HIPAA Security Rule?
The Security Rule governs ePHI regardless of its sensitivity category, so psychotherapy notes maintained in electronic form are subject to the same administrative, physical, and technical safeguards as other ePHI, including both required and addressable implementation specifications. Addressable does not mean optional; it means an entity must assess whether a specification is reasonable and appropriate and, if not, document why and implement an equivalent alternative where reasonable. The Security Rule's separate definition does not create a special sensitivity tier for these notes; the heightened authorization and access provisions come from the Privacy Rule, not the Security Rule.
Do business associates handle psychotherapy notes differently under a business associate agreement?
A business associate's obligations flow from the business associate agreement and from the HIPAA rules, and they generally may use or disclose psychotherapy notes only as permitted by the agreement and consistent with the Privacy Rule's authorization requirements. Because psychotherapy notes carry heightened use-and-disclosure restrictions, covered entities and business associates typically address them carefully in the agreement and in operational procedures. Note that adherence to any private control framework, such as the HITRUST CSF, does not by itself satisfy these HIPAA obligations. Verify the specific handling requirements against current guidance and the terms of your agreement.

Common misconceptions

All mental health treatment records are psychotherapy notes and receive the same special protection.
The term has a narrow regulatory meaning. General mental health treatment records, and the specifically excluded items such as medication monitoring, session times, treatment modalities, test results, and diagnosis or progress summaries, are generally treated as ordinary PHI rather than psychotherapy notes.
Notes kept anywhere in the patient's chart qualify as protected psychotherapy notes.
The heightened protection generally applies only when the notes are maintained separately from the rest of the medical record. Notes commingled with the general record typically do not receive this special status.
Psychotherapy notes can never be used or disclosed without patient authorization.
While a specific authorization is generally required, certain limited exceptions typically apply. The precise exceptions should be confirmed against the current regulatory text, and state law may impose additional or stricter requirements.

Best practices

Maintain psychotherapy notes in a file physically or logically separate from the rest of the medical record so they can qualify for the heightened protections under the Privacy Rule.
Keep excluded content, such as medication and prescription monitoring, session start and stop times, treatment modalities and frequencies, test results, and diagnosis or progress summaries, in the general record rather than mixing it into the protected notes.
Obtain a specific, valid patient authorization before using or disclosing psychotherapy notes, and confirm whether any limited regulatory exception applies before relying on it.
Train clinical and administrative staff on the narrow regulatory definition so they do not treat all mental health records as psychotherapy notes or improperly release them.
When notes are stored electronically, apply the Security Rule's administrative, physical, and technical safeguards to that ePHI, treating addressable specifications as requiring documented evaluation rather than as optional.
Review applicable state law and any additional requirements, as these may impose protections beyond HIPAA, and verify specific exceptions and standards against the current regulatory text.