Psychotherapy Notes vs Progress Notes Under HIPAA — What Therapists Get Wrong
The critical HIPAA distinction between psychotherapy notes and progress notes — and why mixing them up puts your practice at legal risk.
The Most Misunderstood HIPAA Rule for Therapists
HIPAA creates a two-tier system for mental health records. Most therapists know this conceptually — but the details matter enormously. The split: (1) Psychotherapy Notes have extra protections and restrictions under HIPAA. (2) Everything else — what HIPAA calls the 'Designated Record Set' — has standard HIPAA protections. Mixing the two categories, or misclassifying what goes where, is one of the most common compliance errors in therapy practices.
What Qualifies as a Psychotherapy Note Under HIPAA?
HIPAA defines psychotherapy notes (also called process notes) very specifically: notes recorded by a mental health professional documenting or analyzing the contents of a conversation during a private counseling session, group, joint, or family counseling session, AND that are stored separately from the rest of the patient's medical record. The key word is 'separately.' If your session notes live in the same area of your EHR as the general health record, they are NOT psychotherapy notes under HIPAA — even if they are emotionally sensitive. Psychotherapy notes typically include: therapist's analysis of client statements, therapeutic techniques used and why, transference observations, impressions and hypotheses about the client's inner world, counter-transference notes, and working diagnoses before they are formalized.
What Does NOT Count as a Psychotherapy Note?
HIPAA explicitly lists what is NOT a psychotherapy note: medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, clinical test results, and any summary of the following items — diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. These items belong in the general health record (your progress notes). Insurance companies can request progress notes. They cannot request psychotherapy notes — ever — without specific written authorization from the client.
The Storage Requirement: Physically Separate
For notes to qualify for the extra psychotherapy note protections, they MUST be stored separately from the general record. In an EHR context, this means: they should be in a different section, folder, or record type — not just labelled differently within the same visit note. Most modern therapy-specific EHRs (SimplePractice, TherapyNotes, Jane App) have distinct fields for process notes vs. progress notes. If yours does not, you either need to configure it or switch to one that does. If you keep paper records: psychotherapy notes go in a physically separate, separately-locked location from your general charts. Same filing cabinet is NOT sufficient — they need to be demonstrably separated.
What Extra Protections Do Psychotherapy Notes Get?
Under HIPAA, psychotherapy notes: cannot be disclosed without specific written authorization from the client (beyond standard HIPAA authorization), are excluded from the general right of access — clients can request their general health record but NOT automatically their psychotherapy notes, cannot be disclosed to health plans (insurance) for payment purposes — a plan cannot condition payment on receiving them, and cannot be included in a standard records request. Even a court subpoena does not automatically compel psychotherapy notes — in many states, a court order is required. These extra protections exist because Congress recognized that therapy effectiveness depends on clients being able to speak freely — knowing their most intimate disclosures are extra-protected.
Trusted by 225,000+ Therapists — Recommended for Therapist in
Get Your Practice 100% HIPAA Compliant in 2026
SimplePractice is the #1 HIPAA-compliant practice management platform built specifically for therapists. Includes secure messaging, telehealth, billing, and a signed BAA — everything you need to stay compliant and protect your clients.
Start Free Trial with SimplePractice →30-day free trial · No credit card required
Need HIPAA-compliant email only? See Hushmail for Healthcare →
Frequently Asked Questions
Does my EHR automatically store psychotherapy notes separately?
It depends on the EHR. SimplePractice, for example, has a separate 'Private Note' field that is treated as psychotherapy notes and stored separately from the shareable progress note. You should verify with your specific EHR vendor how they handle this distinction and whether the separation meets HIPAA requirements.
Can a client request to see my psychotherapy notes?
Under standard HIPAA, clients have the right to access their 'Designated Record Set' — but psychotherapy notes are explicitly excluded from this right. You can choose to share them, but the client cannot demand them under HIPAA's access provisions. Several states (including California and New York) have modified this — check your state's mental health privacy law.
My insurance panel is asking for session notes. Can I send my process notes?
No. Insurance companies are not entitled to psychotherapy (process) notes. They may request progress notes, treatment summaries, and clinical documentation to verify billing — but not your private process notes. If a payer is demanding process notes as a condition of payment, that is a HIPAA violation on their part. You should decline and, if needed, contact your state insurance commissioner.
What happens if I accidentally mix process notes into the general record?
If a note that should be a psychotherapy note is stored in the general record, it loses the extra protections — it becomes subject to standard HIPAA access and disclosure rules. This means clients can request it, insurance can potentially see it, and it is includible in standard records requests. The practical fix: review how your EHR is configured and ensure you are consistently using the correct note fields going forward.