Psychotherapy Notes vs Progress Notes: HIPAA Rules Explained

What Are Psychotherapy Notes vs Progress Notes?

Under HIPAA, psychotherapy notes and progress notes are two legally distinct categories of clinical documentation. Confusing them is a common compliance mistake.

Progress notes are part of the medical record. They document the service provided, dates, clinical impressions, diagnosis, functional status, treatment plan, symptoms, prognosis, and progress. They are protected health information, but HIPAA permits sharing them for treatment, payment, and health care operations without a client authorization. Clients have a right to access them, and other disclosures (for example, in legal proceedings) follow the general Privacy Rule.

Psychotherapy notes, defined in 45 CFR §164.501, are a clinician's separate notes documenting or analyzing what was said in a counseling session. They are kept apart from the medical record and get extra protection: most uses and disclosures, including for treatment by another provider or for payment, need a specific written authorization from the client.

The distinction is not about how detailed or sensitive the content is. It is about what the notes contain and where they are stored. If your detailed session notes are in the client's chart, they are progress notes, whatever you call them.

The HIPAA Definition of Psychotherapy Notes (45 CFR 164.501)

The Privacy Rule definition has three parts:

1. Who writes them: a health care provider who is a mental health professional. They can be recorded "in any medium" (paper, electronic, audio).
2. What they contain: notes "documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session."
3. Where they are kept: they must be "separated from the rest of the individual's medical record."

HHS adds that psychotherapy notes do not include any information that is kept in the medical record (HHS FAQ 2088).

What Is Excluded From the Definition

The definition expressly excludes the following, even if you write them in a separate notebook:

• Medication prescription and monitoring
• Counseling session start and stop times
• The modalities and frequencies of treatment furnished
• Results of clinical tests
• Summaries of diagnosis, functioning, the treatment plan, symptoms, prognosis, or progress

These items belong in the medical record wherever you store them.

When Psychotherapy Notes Can Be Disclosed

Under 45 CFR 164.508(a)(2), a covered entity must get the client's authorization for any use or disclosure of psychotherapy notes, with these exceptions:

Exception	What it allows	Source
Originator's own treatment use	The clinician who wrote the notes may use them to treat the client	164.508(a)(2)(i)(A)
Supervised training	Use or disclosure in the covered entity's own supervised training programs for mental health students, trainees, or practitioners	164.508(a)(2)(i)(B)
Self-defense	Use or disclosure to defend the covered entity in a legal action or proceeding the client brings	164.508(a)(2)(i)(C)
HHS compliance review	Disclosures HHS requires to investigate or determine HIPAA compliance	164.502(a)(2)(ii)
Required by law	Disclosures another law requires, limited to what that law requires	164.512(a)
Oversight of the author	Health oversight activities directed at the clinician who wrote the notes	164.512(d)
Coroners and medical examiners	Identifying a deceased person, determining cause of death, or other authorized duties	164.512(g)(1)
Serious and imminent threat	Good-faith disclosure needed to prevent or lessen a serious and imminent threat, to someone reasonably able to prevent or lessen it	164.512(j)(1)(i)

HHS gives mandatory abuse reporting and mandatory duty-to-warn situations as examples, and notes that state laws vary on whether a warning is mandatory or permitted (HHS FAQ 2088). In practice, the facts you need for a report (risk, threats, safety actions) should already be in your progress note.

Everything else needs an authorization, including sending psychotherapy notes to another treating provider. Two rules make this authorization different from an ordinary release:

• It must stand alone. An authorization for psychotherapy notes may only be combined with another authorization for psychotherapy notes (164.508(b)(3)(ii)). A general release with a "psychotherapy notes" checkbox is not enough. See the release of information guide.
• Payment cannot be conditioned on it. A covered entity, including a health plan, may not condition treatment, payment, enrollment, or eligibility for benefits on an authorization (164.508(b)(4)). The exception that lets a health plan request an authorization before enrollment for underwriting expressly excludes psychotherapy notes (164.508(b)(4)(ii)(B)).

Can Clients See Their Psychotherapy Notes?

The HIPAA right of access covers the designated record set but expressly excepts psychotherapy notes (45 CFR 164.524(a)(1)(i)). A provider may deny access to them without offering the review process that applies to other denials (164.524(a)(2)(i)).

That is a floor, not a ban. HHS says providers generally have discretion to share psychotherapy notes with the client or their personal representative, and should check state law for prohibitions or conditions first (HHS mental health guidance). State law may give clients broader access to their mental health records, or add conditions. The same HHS guidance says parents who are a minor's personal representative have no HIPAA right to the child's psychotherapy notes, but generally can get the child's medical record, including diagnosis, symptoms, and treatment plan.

Psychotherapy Notes vs Progress Notes at a Glance

	Progress notes	Psychotherapy notes
Required?	Expected for every billed service (payer, state, and licensing rules set the details)	Optional
Where stored	In the medical record	Separate from the medical record
Typical content	Dates and times, service type, interventions, mental status, risk, diagnosis, symptoms, progress, plan	Your analysis of session conversation: process observations, hypotheses, reactions, material for supervision
Sharing for treatment, payment, operations	Permitted without authorization	Authorization needed (except the originator's own treatment use, supervised training, and self-defense)
Insurance claims and audits	Payers can review them	A health plan cannot condition payment on an authorization for them
Client right of access	Yes (45 CFR 164.524)	No HIPAA right; provider discretion, subject to state law
Authorization form	Can be combined with other authorizations	Only with other psychotherapy-note authorizations
Legal process	General HIPAA rules for court orders and subpoenas apply	Only the 164.508(a)(2) exceptions, such as disclosures required by law; state privilege law decides the rest

What Payers and CMS Can and Cannot Require

• Can: request and review the medical record, including progress notes, the treatment plan, and assessment results, to process claims, review medical necessity, or audit. HIPAA permits these payment and operations disclosures without an authorization. What a payer may request, and what you must supply, is also set by your contract and, for Medicare and Medicaid, program rules.
• Cannot: condition payment, enrollment, or eligibility for benefits on the client signing an authorization for psychotherapy notes (45 CFR 164.508(b)(4)).
• Practical result: a claim stands or falls on the progress note. If your progress note does not support medical necessity, keeping detail in psychotherapy notes will not help. Put the clinically necessary information in the record.

When You Need to Understand This Distinction

• When an insurance company or managed care organization requests clinical records
• When you receive a subpoena or court order for client records
• When another provider requests records for coordination of care
• When a client requests their own records under HIPAA's right of access
• When setting up your documentation system and EHR workflows
• When training new clinicians or supervisees on documentation practices
• When responding to a licensing board complaint or malpractice claim
• When determining what to include in a record release

Key Components

What Belongs in Progress Notes (Medical Record)

Progress notes should contain what is needed for continuity of care, reimbursement, and clinical accountability. Typical content includes:

• Session logistics: Date, start and stop time, type of service, CPT code
• Modality and participants: Individual, couples, family, group; who was present
• Diagnosis and functional status: Current diagnoses and functional descriptions
• Clinical observations: Affect, appearance, behavior, mental status
• Interventions used: CBT, exposure therapy, motivational interviewing — the technique, not the full session dialogue
• Standardized measures: PHQ-9 scores, GAD-7 results, outcome measures
• Risk assessment: Suicidal ideation, homicidal ideation, safety concerns
• Medications: Current medications noted, any changes discussed
• Treatment plan progress: Movement toward identified goals
• Assessment and clinical impressions: Your professional judgment about the client's status
• Plan: Next session, referrals, between-session tasks

What Belongs in Psychotherapy Notes (Separate, Private)

Psychotherapy notes are your workspace for thinking about the session. They may include:

• Detailed session content: What the client talked about in depth — narratives, stories, memories
• Your analytic thinking: Hypotheses about dynamics, transference observations, countertransference reactions
• Process observations: How the client related to you in session, relational patterns
• Sensitive disclosures: Detailed content that is not needed in the progress note. Anything clinically necessary, such as risk, a reportable event, or a fact that changes the diagnosis or plan, still goes in the progress note.
• Your emotional responses: Your own feelings about the session, the client, or the therapeutic relationship
• Theoretical formulations: Interpretations and case conceptualization work in progress

Side-by-Side Example: Same Session, Two Formats

This fictional example follows one session with a client in trauma-focused therapy for posttraumatic stress disorder (F43.10). The diagnosis is described in this library's own words; see the American Psychiatric Association's PTSD fact sheet.

Short Example: What Moved Where

A second, shorter fictional example. Client "R.M.", a 34-year-old adult in individual therapy for panic disorder (F41.0). The diagnosis is described in this library's own words; see the American Psychiatric Association's anxiety disorders overview.

Progress note (medical record): 50-minute individual session. Client reports two panic attacks this week, down from four, and has resumed driving to work on side streets. Practiced interoceptive exposure in session with moderate distress that decreased within the session. Denies suicidal ideation. Progressing toward goal 2 (reduce avoidance). Plan: continue weekly CBT; between-session task is one highway on-ramp drive with a support person; next session 10/27.

Psychotherapy note (kept separately): She laughed every time she described a panic attack; the laughter dropped away when she mentioned her father's heart attack. I wonder whether the fear of dying is tied to that loss more than she has said. I noticed I was moving fast to keep the session upbeat. Slow down next time and take this to consultation.

Content	Goes in	Why
Panic frequency, exposure work, risk screen, goal progress, plan	Progress note	Symptoms, progress, and the plan are excluded from the psychotherapy notes definition
Hypothesis about the father's illness, your own reaction, consultation idea	Psychotherapy note	Your analysis of the session conversation, not needed by others to continue care
If the hypothesis becomes a treatment focus	Progress note (summarized)	Once it changes the assessment or plan, a summary belongs in the record

How to Implement This Distinction Step by Step

Step 1: Understand what HIPAA actually says. Read 45 CFR §164.501 and §164.508(a)(2). Psychotherapy notes are narrowly defined and must be kept separate from the medical record to qualify.

Step 2: Configure your documentation system. If you use an EHR, set up the psychotherapy notes feature with access restrictions. If you use paper records, store psychotherapy notes in a separate, locked location away from the clinical chart. If your EHR does not support separate psychotherapy notes, use a separate secured system.

Step 3: Write your progress note first. Complete the medical-record progress note for every session. It should contain everything needed for continuity of care, billing, and your legal and licensing obligations. Any clinician taking over the case tomorrow should be able to work from it.

Step 4: Write psychotherapy notes only when you need them. They are optional. Write them when you have process observations, analytic thinking, or sensitive content that supports your clinical work but does not belong in the shared medical record.

Step 5: Never mix the two. Do not copy psychotherapy note content into progress notes or file them together. Once the content is in the medical record, it no longer meets the definition.

Step 6: Train your administrative staff. Staff who handle record releases need to know this distinction. When a records request arrives, leave psychotherapy notes out of the release unless a separate psychotherapy-notes authorization is present or one of the 164.508(a)(2) exceptions clearly applies. Build this into your release-of-information procedures.

Common Mistakes

1. Believing all therapy notes are protected. Only notes that meet HIPAA's definition, kept separate from the chart, get the extra protection. Everything else is part of the medical record, available for treatment, payment, and operations, through the client's right of access, and in legal processes.

2. Keeping only one set of notes and calling them psychotherapy notes. If your only documentation is what you call psychotherapy notes, you probably are not meeting progress note expectations for billing, continuity of care, or licensing board standards. You need a progress note in the medical record for every session. Psychotherapy notes are supplementary.

3. Putting medication information or test results in psychotherapy notes. HIPAA excludes medication prescribing and monitoring, session start and stop times, test results, and summaries of diagnosis, treatment plan, and progress from the definition. Those items are not psychotherapy notes, wherever you write them, and belong in the record.

4. Assuming psychotherapy notes are immune from legal proceedings. They are not. HIPAA's exception for disclosures required by law covers court orders, and state privilege law decides when a court can compel production. Consult a healthcare attorney in your jurisdiction before releasing or withholding them in response to legal process.

5. Storing psychotherapy notes in the same chart or EHR section as progress notes. The separation requirement is physical or electronic, not just a label. If psychotherapy notes open through the same record path as the rest of the chart, they may not meet the definition.

6. Using a general release for psychotherapy notes. A psychotherapy-notes authorization can only be combined with another psychotherapy-notes authorization. Use a separate form.