Can insurance companies access my psychotherapy notes?

No — not without a specific, separate authorization from the client. Under HIPAA, psychotherapy notes receive heightened protection and cannot be disclosed for treatment, payment, or healthcare operations without the client's explicit written authorization. This is different from progress notes, which can be shared with insurance companies for claims processing under the treatment, payment, and operations (TPO) exception. This extra protection is one of the main reasons to keep psychotherapy notes separate.

Are psychotherapy notes protected from subpoenas?

HIPAA provides additional federal protection, but state laws vary significantly. In many states, psychotherapy notes can still be subpoenaed by court order, though the threshold is higher than for regular medical records. Some states have stronger therapist-client privilege protections. You should consult with a healthcare attorney familiar with your state's laws. The key point: HIPAA protection is a floor, not a ceiling — your state may offer more protection, but it cannot offer less.

If I only keep one set of notes, are they psychotherapy notes or progress notes?

They are progress notes. Under HIPAA, psychotherapy notes must be kept separate from the medical record to receive heightened protection. If your notes are filed in the client's general medical or clinical record, they are legally progress notes regardless of their content. The separation requirement is not just about labeling — psychotherapy notes must be stored apart from the rest of the chart.

What happens if I accidentally put psychotherapy note content into a progress note?

The content loses the heightened HIPAA protection afforded to psychotherapy notes. Once sensitive session details are in the medical record, they can be accessed by anyone with legitimate access to the record — other providers, insurance companies, auditors, and potentially attorneys through legal proceedings. This is why the distinction matters practically, not just theoretically. Be deliberate about what goes where.

Do EHR systems support separate psychotherapy notes?

Most modern EHR systems designed for behavioral health offer a separate psychotherapy notes section with restricted access controls. This section is typically excluded from standard record releases, insurance submissions, and patient portal access. If your EHR does not support this functionality, you may need to maintain psychotherapy notes in a separate, secured system — such as an encrypted document stored separately from the clinical chart. Verify with your EHR vendor that their psychotherapy notes feature meets HIPAA's separation requirement.

Psychotherapy Notes vs Progress Notes: HIPAA Rules Explained

Progress Notes|10 min read|Updated 2026-03-19|Clinically reviewed

What Are Psychotherapy Notes vs Progress Notes?

Under HIPAA, psychotherapy notes and progress notes are two legally distinct categories of clinical documentation — and confusing them is one of the most common compliance mistakes mental health professionals make.

Progress notes are part of the standard medical record. They document the type of service provided, dates, clinical impressions, diagnosis, functional status, treatment plan, symptoms, prognosis, and progress. Progress notes can be shared with insurance companies, other providers, and in legal proceedings without requiring a separate patient authorization beyond the general consent for treatment, payment, and healthcare operations.

Psychotherapy notes — defined in 45 CFR §164.501 — are a clinician's private notes documenting or analyzing the contents of a therapy conversation. They are kept separate from the medical record and receive enhanced HIPAA protection. They cannot be shared for treatment, payment, or operations without a specific, separate written authorization from the client.

The critical distinction is not about the detail level or the sensitivity of the content. It is about where the notes are stored and what they contain. HIPAA defines psychotherapy notes narrowly: they must be the therapist's personal notes about session conversations, kept separately from the rest of the record. If your detailed session notes are in the client's chart, they are legally progress notes — no matter what you call them.

This distinction matters because many clinicians believe that all of their therapy notes are protected from disclosure. They are not. Only notes that meet HIPAA's specific definition and storage requirements receive heightened protection.

When You Need to Understand This Distinction

When an insurance company or managed care organization requests clinical records
When you receive a subpoena or court order for client records
When another provider requests records for coordination of care
When a client requests their own records under HIPAA's right of access
When setting up your documentation system and EHR workflows
When training new clinicians or supervisees on documentation practices
When responding to a licensing board complaint or malpractice claim
When determining what to include in a record release

Key Components

What Belongs in Progress Notes (Medical Record)

Progress notes should contain the information necessary for continuity of care, insurance reimbursement, and clinical accountability. Under HIPAA, progress notes specifically include:

Session logistics: Date, start and stop time, type of service, CPT code
Modality and participants: Individual, couples, family, group; who was present
Diagnosis and functional status: Current diagnoses, GAF or functional descriptions
Clinical observations: Affect, appearance, behavior, mental status
Interventions used: CBT, exposure therapy, motivational interviewing — the technique, not the full session dialogue
Standardized measures: PHQ-9 scores, GAD-7 results, outcome measures
Risk assessment: Suicidal ideation, homicidal ideation, safety concerns
Medications: Current medications noted, any changes discussed
Treatment plan progress: Movement toward identified goals
Assessment and clinical impressions: Your professional judgment about the client's status
Plan: Next session, referrals, between-session tasks

What Belongs in Psychotherapy Notes (Separate, Private)

Psychotherapy notes are your personal workspace for processing what happened in session. They may include:

Detailed session content: What the client talked about in depth — narratives, stories, memories
Your analytic thinking: Hypotheses about dynamics, transference observations, countertransference reactions
Process observations: How the client related to you in session, relational patterns
Sensitive disclosures: Detailed content about sexual history, abuse, fantasies, or other deeply personal material that is not necessary for the progress note
Your emotional responses: Your own feelings about the session, the client, or the therapeutic relationship
Theoretical formulations: Psychodynamic interpretations, attachment pattern analysis, detailed case conceptualization work

What Does NOT Qualify as Psychotherapy Notes Under HIPAA

Even if kept separately, the following are explicitly excluded from HIPAA's psychotherapy notes definition:

Medication prescription and monitoring
Counseling session start and stop times
Modalities and frequencies of treatment
Results of clinical tests
Diagnosis, functional status, treatment plan, symptoms, prognosis, and progress

These items are part of the medical record regardless of where you store them.

Side-by-Side Example: Same Session, Two Formats

Progress Note — Individual Therapy Session (Trauma-Focused CBT)

Client: L.W. | Date: 03/17/2026 | Session: #14 (50 min) | Modality: Individual | CPT: 90837

S — Subjective: Client reports increased nightmares over the past week (4 out of 7 nights), which she attributes to an upcoming anniversary of the traumatic event. States hypervigilance has increased — "I keep checking the locks multiple times before bed." Reports using grounding techniques from session with partial effectiveness. Denies suicidal ideation. Rates distress at 7/10, up from 5/10 last session. PCL-5 completed: score 42, up from 36 at session #10.

O — Objective: Client was casually dressed and appropriately groomed. Affect was anxious and guarded — limited eye contact, arms crossed, visible startle response to office door closing. Speech was soft but coherent. Thought process linear. Cognitive processing therapy worksheet reviewed — client completed the stuck point log identifying 3 stuck points related to self-blame. In-session Socratic questioning targeted the stuck point: "I should have known it was going to happen." Client engaged but became tearful during exercise. Grounding was used briefly to re-regulate before continuing.

A — Assessment: Client is experiencing a predictable increase in PTSD symptoms as the trauma anniversary approaches. PCL-5 increase (36 → 42) is consistent with her self-report and likely time-limited. Her continued engagement with CPT worksheets and willingness to address stuck points in session demonstrates treatment commitment despite increased distress. The self-blame stuck point remains a central barrier to processing. Client's ability to use grounding when activated in session is a positive sign of growing affect regulation capacity. Risk assessment: Denied SI/HI; no current safety concerns. Current diagnosis: PTSD (F43.10). Prognosis: Fair to good with continued treatment.

P — Plan:

Continue weekly individual therapy (CPT)
Focus next session on challenging the self-blame stuck point using the ABC worksheet
Review and practice additional grounding techniques for nightmare management
Client to complete challenging beliefs worksheet on the "should have known" stuck point before next session
Monitor PCL-5 — readminister at session #16
Discuss with client the option of adding EMDR for anniversary-related distress if CPT alone is insufficient
Next session: 03/24/2026 at 11:00 AM

This is a sample for educational purposes only — not real patient data.

Psychotherapy Note — Same Session (Private, Separate from Medical Record)

Session date: 03/17/2026 | Client: L.W.

Client spent the first 15 minutes describing the nightmares in detail — recurring dream of being back in the apartment, hearing footsteps, unable to move. She described the dream with a flat affect that shifted suddenly to tears when she mentioned the sound of the door opening. The sensory detail she recalled (specific sounds, smells) suggests continued vivid re-experiencing that has not yet been adequately processed.

The self-blame stuck point ("I should have known") is deeply entrenched. When I used Socratic questioning, she initially gave intellectually flexible answers ("I guess I couldn't have predicted it") but her body language told a different story — she was clenched, withdrawn, and said it in a rote way that suggested she was giving me the "right answer" rather than genuinely shifting the belief. I chose not to push further today because her window of tolerance was narrowing. The brief grounding exercise brought her back, but I could see she was efforting to stay present.

I'm noticing a pattern in our dynamic — she tends to minimize her distress with me and then report more severe symptoms on the PCL-5. I wonder if there's a relational component here: she may be managing my perception of her, which would be consistent with the interpersonal patterns she's described from before the trauma. I want to hold this observation for now and see if it continues before addressing it directly.

Countertransference note: I felt protective during the stuck point work — an urge to reassure her that it wasn't her fault rather than letting her arrive there through the Socratic process. I need to be careful not to rescue. Her processing needs to be hers.

Plan to bring the interpersonal pattern to supervision next week.

This is a sample for educational purposes only — not real patient data.

How to Implement This Distinction Step by Step

Step 1: Understand what HIPAA actually says. Read 45 CFR §164.501 and §164.508(a)(2). Psychotherapy notes are narrowly defined and must be kept separate from the medical record. This is not optional — it is a structural requirement.

Step 2: Configure your documentation system. If you use an EHR, set up the psychotherapy notes feature with appropriate access restrictions. If you use paper records, store psychotherapy notes in a physically separate, locked location from the clinical chart. If your EHR does not support separate psychotherapy notes, use a separate encrypted system.

Step 3: Write your progress note first. Complete the medical-record progress note for every session. This note should contain everything needed for continuity of care, insurance, and legal compliance. Think of it as the note any clinician could read if they needed to take over the case tomorrow.

Step 4: Write psychotherapy notes only when you need them. Psychotherapy notes are optional. Not every session requires them. Write them when you have process observations, analytic thinking, or sensitive content that supports your clinical work but does not belong in the shared medical record.

Step 5: Never mix the two. Do not reference psychotherapy notes in your progress notes. Do not file them together. The moment psychotherapy notes enter the medical record — even accidentally — they lose their enhanced HIPAA protection.

Step 6: Train your administrative staff. Staff who handle record releases need to understand this distinction. When a records request arrives, psychotherapy notes should be excluded from the release unless a separate, specific authorization is present. Build this into your release-of-information procedures.

Common Mistakes

Believing all therapy notes are protected. The most dangerous misconception in clinical documentation. Only notes that meet HIPAA's specific definition — personal notes about session conversations, stored separately from the chart — receive heightened protection. Everything else is a progress note, accessible to insurers, other providers, and courts.
Keeping only one set of notes and calling them psychotherapy notes. If your only documentation is what you call "psychotherapy notes," you are likely not meeting the progress note requirements for insurance, continuity of care, or licensing board standards. You need a progress note in the medical record for every session. Psychotherapy notes are supplementary.
Including medication information or test results in psychotherapy notes. HIPAA explicitly excludes medication prescribing, session start/stop times, test results, diagnosis, treatment plan, and progress from the psychotherapy notes definition. If these items are in your "psychotherapy notes," a court may determine that the entire document is a progress note.
Assuming psychotherapy notes are completely immune from legal proceedings. They are not. While HIPAA creates a higher barrier to disclosure, courts can order the release of psychotherapy notes in certain circumstances — particularly in cases involving child custody, fitness for duty, or when the client has put their mental health at issue in litigation. Consult a healthcare attorney in your jurisdiction.
Storing psychotherapy notes in the same chart or EHR section as progress notes. The separation requirement is physical or electronic, not just conceptual. If psychotherapy notes are accessible through the same record path as the rest of the chart, they may not qualify for enhanced protection. Ensure genuine separation in your storage system.