HIPAA psychotherapy notes vs progress notes

The key ideas

• HIPAA psychotherapy notes

  Psychotherapy notes are a mental health professional's notes analyzing session content, kept separate from the rest of the record; they exclude medications, session times, modalities, test results, and summaries of diagnosis, treatment plan, symptoms and progress. They need specific authorization except for the originator's treatment use, supervised training, defense against the client's legal action, HHS compliance review, and a few permitted disclosures such as 164.512(j)(1)(i). Clients have no HIPAA access right to them.^[1][2]

• HIPAA right of access

  Individuals may inspect and get copies of PHI in the designated record set, except psychotherapy notes and information compiled for legal proceedings. The entity must act within 30 days, with one extension of up to 30 more days. Denial on grounds like likely danger to life or physical safety is reviewable by another licensed professional.^[3]

• HIPAA authorization required

  A valid written authorization is required for uses and disclosures not otherwise permitted, including marketing and sale of PHI. Authorizations can be revoked in writing except to the extent already relied upon, and providers may not condition treatment on signing one, with limited exceptions such as research treatment.^[1]

• NASW 1.08 Access to records

  Clients get reasonable access to their records. Limit access only in exceptional circumstances with compelling evidence of serious harm, and document the request and rationale. If misunderstanding is a concern, help interpret rather than withhold. Protect other individuals named in the record.^[4]

• NASW 3.04 Client records

  Social workers should take reasonable steps so documentation is accurate and reflects services provided, document sufficiently and in time for continuity, protect privacy by including only information directly relevant to services, and store records after termination for reasonable future access, for the number of years required by law, agency policy and contracts. The Code sets no fixed number of years.^[5]

How the ASWB exam tests it

• Progress notes in the chart are not psychotherapy notes. Separation from the record is the defining feature.^[1][2]
• A therapist cannot deny a chart request just because it may be upsetting. Psychotherapy notes are kept separate from the chart.^[3]
• An authorization (specific, time-limited, and revocable) is different from general consent, and treatment cannot be made conditional on signing one.^[1]
• HIPAA gives a similar right of access to the record, with narrow grounds for denial.^[4]
• How long records must be kept is set by state law and agency policy; the NASW Code defers to them.^[5]
• No single retention period applies nationwide. HIPAA's 6-year rule covers policies and documentation, not clinical records.^[6][7][8]

Covered on other pages

• HIPAA general rule and minimum necessary

  Covered entities may use or disclose PHI only as the Privacy Rule permits or requires. Disclosures and requests must be limited to the minimum necessary, except for treatment disclosures between providers, disclosures to the individual, authorized disclosures, and those required by law.

Related explainers

• Confidentiality and its limits
• Informed consent
• Duty to warn and duty to protect