Special Protections and FAQ for Therapy Notes

Executive Summary 

Healthcare professionals are often asked to disclose a patient’s psychotherapy notes. However, psychotherapy notes are treated differently under HIPAA’s Privacy Rule because they contain particularly sensitive information and because they are the personal notes of the therapist. Therefore, it is imperative that providers understand their obligations when it comes to sharing psychotherapy notes to avoid any costly HIPAA violations. 

Recommended Actions 

• Consider implementing a checklist or procedure for staff members to use when confronted with a patient’s request for medical records. 
• Ensure that all staff are trained and understand their differing obligations for disclosing a patient’s medical record and disclosing psychotherapy notes. 
• Ensure that all staff members accurately understand what information/data within a patient’s medical record constitutes psychotherapy notes. 

Psychotherapy notes receive special protection under the HIPAA Privacy Rule (Privacy Rule). It is important for practices with behavioral health providers to ensure that their staff understands the special protections provided to psychotherapy notes. 

The Privacy Rule defines psychotherapy notes as “notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint or family counseling session, and that are separate from the rest of the patient’s medical record.” These notes do not include information about medication management, session start and stop times, test results, summaries of the patient’s diagnosis or symptoms or information about the patient’s progress.1 Psychotherapy notes receive special protection because of their sensitive nature and because they are personal notes of the provider that are generally not required for treatment, payment or health care operations.  

The Privacy Rule requires that the practice obtain specific authorization prior to any type of disclosure of psychotherapy notes for any reason, including a disclosure for treatment purposes to another healthcare provider.2 There are very limited exceptions to requiring specific authorization for disclosure of psychotherapy notes, such as reporting of abuse, neglect or domestic violence, or a threat of serious and imminent harm made by the patient during a session. 

It is always a good time for your practice to review and revise your records release form. Evaluate if it specifically delineates the requirement for a separate release form for psychotherapy notes. The form can be altered to remove services not offered by your practice. 

Your practice may also want to determine if your electronic medical record (EMR) is able to distinguish between psychotherapy notes and other medical record entries, and if an alert notification can be added to the psychotherapy notes section. 

Below are the most frequent questions MagMutual receives regarding the release of psychotherapy notes: 

Does a patient have a right to access their own psychotherapy notes? 

No, a patient does not have a right to access their own psychotherapy notes. However, the provider can choose to provide a copy of psychotherapy notes to a patient consistent with applicable state law. 

If a parent requests a copy of the psychotherapy notes about their child’s mental health treatment, must the practice provide it to the parent? 

No. The HIPAA Privacy Rule does not provide a right of access to psychotherapy notes and thus this practice is not required to disclose the psychotherapy notes to the parent. This would be the same in any situation where the personal representative of the patient is requesting psychotherapy notes — for example, when a wife requests the psychotherapy notes of her deceased husband. Again, the practice has no obligation to provide the psychotherapy notes to the wife.  

If my practice receives a subpoena or court order for “all mental health records or “all psychiatric records,” should I also release the psychotherapy notes? 

No. If the subpoena or court order does not specifically request “psychotherapy notes,” do not release the psychotherapy notes. Only release the applicable mental health records. The only time you should release psychotherapy notes is if you receive a court order signed by a judge (not a subpoena signed by an attorney) that specifically requests psychotherapy notes.  

Do I need written authorization to release my patient’s psychotherapy notes to another provider for treatment purposes? 

Yes, you must have the patient’s written authorization to release psychotherapy notes to another provider for treatment purposes. 

What can I do with psychotherapy notes without written authorization? 

The only things you can do without written authorization from the patient are to release the psychotherapy notes if required by law, you are reporting abuse, neglect, or domestic violence or there is a serious threat to the health or safety of the patient. We advise that you always obtain written authorization from the patient. 

What if I get a request from law enforcement for the psychotherapy notes? 

You should ask the law enforcement official to obtain a court order signed by a judge that specifically requests the psychotherapy notes. If one of your patients presented at a hospital emergency department, the emergency department physician can call you to discuss the patient’s case. This discussion can occur without the patient’s written authorization under the HIPAA psychotherapy note exception for serious threat to the health or safety of the patient.  

Lessons Learned  

• Ensure that your healthcare practice has a policy regarding releasing patient records and that the policy includes the requirements for releasing psychotherapy notes. 
• Review your healthcare organization’s records release form to ensure it delineates the requirement for a separate release form for psychotherapy notes. 
• Review your state and local regulations regarding the requirements for releasing patients’ medical records and psychotherapy notes, as those rules might be more stringent than HIPAA’s requirements.  

Potential Damages 

The inappropriate disclosure of psychotherapy notes could lead to a HIPAA violation and the associated fines and financial penalties. Although the frequency of HIPAA violations specifically related to psychotherapy notes is somewhat infrequent, the costs for these violations can quickly add up.