Psychotherapy notes vs progress notes: what HIPAA protects and what gets released

By Selam Koch, PMHNP-BC, founder of OneStep Scribe and practicing psychiatric nurse practitioner. Published September 2026.

In my experience, most clinicians who tell me they keep psychotherapy notes turn out not to have any. They have a chart that feels private, written in their own voice, sometimes in a folder they think of as separate. When a records request lands, all of it goes out, and the surprise is the worst kind: retroactive.

Under federal privacy rules, "psychotherapy notes" is a term of art: a narrow, specifically defined category with unusually strong protection, and almost everything a therapist writes sits outside it. The distinction becomes urgent the day an authorization form, a payer audit, or a subpoena arrives, which is the worst moment to learn which pile your documentation was in. This guide is educational rather than legal advice, and its recurring instruction is to settle your position with a healthcare attorney in your state before you need one. One note on terms, since this article is written for therapists and prescribers both: I write client where the subject is the therapy session itself and patient where it tracks the language of the rule and of records requests. The regulation says individual, and all three mean the same person.

What the rule actually means

The federal definition sits at 45 CFR 164.501, and it is worth reading in close to its own words: psychotherapy notes are notes recorded in any medium by a health care provider who is a mental health professional, documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session, and that are separated from the rest of the individual's medical record.

Two conditions, both of which have to hold. The first is content: these are process notes, your working hypotheses, your reaction to the material, the thing you noticed but are not ready to assert. The second is location. They are maintained apart from the medical record.

The carve-outs are the part people miss

The same definition excludes a specific list. These are not psychotherapy notes even when the treating therapist wrote them, even when they concern the session, and even when they sit in the folder you labeled private. The exclusion, quoted in relevant part:

The term "psychotherapy notes" excludes:

• "medication prescription and monitoring"
• "counseling session start and stop times"
• "the modalities and frequencies of treatment furnished"
• "results of clinical tests"
• "any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date"

45 CFR 164.501, definition of "psychotherapy notes," quoted in relevant part. Text current as of September 2026; the regulation is amended from time to time, so check the current eCFR text before relying on this wording.

Read that last item again. The exclusion reaches any summary of those items, which is the content of essentially every session note anyone writes. What survives is not a shorter version of the session note, it is a different kind of writing altogether. A note saying how the client presented, what you worked on, how they responded, and where the goals stand is the medical record, whatever the file is called.

So what is a progress note

Everything else, which is to say almost all of it. Intake and evaluation, progress notes, the treatment plan, risk assessments, mental status findings, medications, test and scale results, correspondence, collateral contacts, discharge summaries. This is what a payer reviews, a receiving clinician gets, and a court sees.

Structured session formats make the point clearly. A note in DAP, BIRP, GIRP, or SOAP form is medical record documentation in all but the rarest case, because its sections map onto the excluded list: behavior or data is symptoms and functional status, intervention is modality and frequency, response is progress to date, and plan is the treatment plan. Choosing a format does not make a note private, and neither does writing in the first person. For the formats themselves, see DAP, BIRP, and GIRP note examples, and the annotated psychiatric progress note example.

Keeping them apart is what earns the protection

Practices lose this on operations, not on principle. Process notes typed into the same field as the progress note, into a free-text box the chart exports, or into a document the release workflow sweeps up anyway are hard to characterize as separately maintained. So is a progress note that quotes or paraphrases the process note, which pulls the content into the record.

If you keep them, keep them in one place, apply matching access controls, and never quote or paraphrase the process file inside the record. The rule does not run the other way as a reason to withhold care information: if something in the process file turns out to be clinically necessary, write it into the record in your own words as a current clinical finding, rather than pasting the process text across or leaving the finding only in the process file. Then make sure whoever fulfills records requests knows the separate location exists and routes any request that touches it to the privacy officer rather than deciding alone. Withholding is only defensible if the material actually meets both prongs of the definition, and because most process notes fail one of them, the default on a patient right-of-access request should be escalation, not exclusion. Improperly withholding record content from a patient is a larger enforcement exposure than releasing more of the record than you strictly had to.

Authorization: a general release does not reach them

Here the protection becomes concrete. A standard authorization for release of records does not cover psychotherapy notes. They require their own specific authorization, and the federal rule (45 CFR 164.508) is flat on this point: an authorization for psychotherapy notes may be combined only with another authorization for psychotherapy notes. There is no version of a single all-in-one form that works. That means a second form, a release process that looks for it, and staff who do not treat a general release as a green light.

A narrow, conditional set of uses and disclosures is allowed without authorization. Paraphrasing: the originator using their own notes for treatment; use in the entity's own mental health training programs, where students, trainees, or practitioners learn under supervision to practice or improve their counseling skills; defense in a legal action or other proceeding brought by the individual, which is the clause that covers a licensing board complaint; disclosure to HHS when the Secretary requests the notes for a compliance investigation, review, or enforcement action, which is required rather than optional and reaches psychotherapy notes along with the rest of the protected health information (45 CFR 164.502(a)(2)(ii)); certain health oversight activity directed at the originator of the notes; disclosures required by law; disclosures to avert a serious and imminent threat; and disclosure to a coroner or medical examiner. Each carries conditions, and none is a permission slip. The HHS item is the one that runs the other way: a practice that has internalized "psychotherapy notes never leave without a specific authorization" and applies that to an OCR investigator is obstructing an investigation, not protecting a patient. Take a real situation to counsel rather than reasoning from a bullet list, including this one.

One further difference, and it is narrower than it is often described. A health plan may in limited circumstances condition enrollment or eligibility on a signed authorization, but never on an authorization for psychotherapy notes. The separate prohibition on conditioning treatment on a signed authorization applies the same way to psychotherapy notes as it does to everything else in the record. Both limits sit at 45 CFR 164.508(b)(4), and nothing in it lets you condition a patient's treatment on their signing a psychotherapy notes authorization.

Records requests, subpoenas, and court orders

The answer depends on your state, the posture of the matter, and who is asking, so hedge everything.

Treatment and payment requests. Federal rules generally permit disclosure of the medical record to another treating clinician for that clinician's treatment of the patient, and for payment, without a separate authorization. Psychotherapy notes sit outside that permission, and in many states a written consent is not optional: state mental health confidentiality statutes require it even for treatment disclosures, and the stricter state rule controls. Records from a federally assisted substance use disorder program need consent under 42 CFR Part 2 whatever HIPAA permits. HIPAA is the floor, not the answer: confirm your state's requirement and your Part 2 status before treating the federal permission as sufficient, which is why most practices obtain a signed release at transfer as a matter of course.

Payer audits. Payment-side reviewers read the medical record, and psychotherapy notes generally sit outside what a payer may compel for payment purposes. That is not blanket immunity: health oversight activity directed at the originator of the notes is one of the narrow federal exceptions, and a licensing board investigation sits in exactly that posture. Practically, a thin progress note is not rescued by a rich process note. The medical record is what a reviewer requests and reads, and material kept outside it cannot be counted on to support medical necessity.

Subpoenas. A subpoena issued by an attorney is not an order signed by a judge, and the two are handled differently. Federal privacy rules (45 CFR 164.512(e)) set conditions, chiefly satisfactory assurance of notice to the individual or of a qualified protective order, before a covered entity responds to a subpoena unaccompanied by a court order, and state confidentiality and privilege law sit on top, often more strictly. And note the asymmetry: the federal subpoena procedure that permits release of the rest of the record is not among the exceptions that permit release of psychotherapy notes. Absent a specific authorization or a narrow exception such as a disclosure required by law, a subpoena alone does not reach them, which is exactly why the two piles must be answered separately, and why counsel answers both. Do not respond alone, do not produce anything before counsel has reviewed the demand, and do not alter or destroy anything. Note the return date the moment it arrives, because objections and motions to quash have deadlines, and missing one can waive the very protection you are trying to assert and expose you to a motion to compel or sanctions besides. Escalating slowly is not the same as responding carefully. Route it to your privacy officer and a healthcare attorney the day it lands.

Court orders. Privacy law and evidentiary privilege are different bodies of law, and the federal category does not decide what a court will order produced. Privilege depends on the forum: state law governs in state court, while federal common law governs in federal question cases, where the courts recognize a psychotherapist-patient privilege of their own that does not depend on any state statute. In either forum, whether the patient has put their mental condition at issue can waive protections that would otherwise hold. That analysis is counsel's call, not yours, and no article can tell you how a given motion comes out. What you control is coherent storage, a consistent policy, and counsel involved before anything leaves the office.

Patient right of access

The federal right of access (45 CFR 164.524) generally does not extend to psychotherapy notes. It reaches the rest of the protected health information held in the designated record set, including the diagnosis, symptom, treatment plan, prognosis, and progress content the excluded list pulls back into the record. Clinicians who assume their session notes are unreadable by the patient usually assume it about material the patient has a right to see.

The psychotherapy note exclusion is not the only limit sitting on that right. Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding is outside it as well. And there are narrow, reviewable grounds for denial, including a licensed professional's determination that access is reasonably likely to endanger the life or physical safety of the individual or another person. Those grounds are exercised through your privacy officer, on the record, with the review rights the rule requires, and never informally at the front desk.

Two qualifiers. State law can grant broader access than the federal floor, and where a state provision is more protective of the individual it controls. And nothing stops a clinician from sharing process notes voluntarily, a policy decision best made in advance rather than improvised under pressure. If you believe part of a record should be withheld, raise it with your privacy officer or counsel before withholding it.

State law, and the other layers underneath it

The federal rule is a floor. Many states have stricter mental health confidentiality statutes, some define their own protected note category with different boundaries, and some do not track the federal category at all. Records from federally assisted substance use disorder programs fall under 42 CFR Part 2, a separate federal scheme that the 2024 final rule largely aligned with HIPAA as of its February 2026 compliance date, while keeping tighter limits on redisclosure and on use in legal proceedings. If any part of your practice may be a Part 2 program, confirm your current obligations with counsel rather than assuming either the old regime or the new one. Minors add another layer, since who may authorize disclosure varies by state and by service type.

The instruction is the same in each case: get your state's rules in writing from an attorney who practices health law there, apply them the same way for every patient, and revisit the policy on a schedule rather than when a demand letter forces it.

Why vague process notes are not a substitute for a defensible record

Here is the failure I see most often. A clinician learns that psychotherapy notes are protected, concludes that substance is safest out of the chart, and writes progress notes that say almost nothing. "Client presented with anxiety. Supportive therapy provided. Client responsive. Continue plan." Four visits look identical, and the real thinking sits in a separate file.

That trade goes badly in every direction. The medical record is what a payer reviewer will read, what a receiving clinician normally gets, and what most reliably shows a board or a court what you assessed and why. An empty record cannot support medical necessity, show continuity, or demonstrate that a risk assessment happened. The separate file, meanwhile, may still be reachable depending on jurisdiction and posture, so the content was not made safe, only unavailable to the people whose job it is to read it.

Write the record as the complete clinical document it is meant to be: presenting problem and current symptoms in specific terms, observed mental status, the interventions used, the response to them, movement against the goals in the plan, risk status, and what happens next. Goals in measurable terms carry most of that weight, and treatment plans with measurable goals covers how to write them. Keep the language behavioral, describing what the person said and did rather than characterizing who they are.

Then let the process note hold only what has no business in a clinical record: the untested hypothesis, your countertransference, the thread you want to pull next session. If content is clinically necessary for another clinician to know, it belongs in the record. That test resolves most hard cases.

A workable practice policy

• Decide whether you keep psychotherapy notes at all. Many practices decide not to, and that is defensible. Half-kept process notes scattered across locations are worse than none.
• If you keep them, use one storage location for every clinician and every client, with matching access controls and no pasting of text between the two in either direction.
• Two authorization forms. One for the record, a separate specific one for psychotherapy notes if they are ever released at all.
• One route for legal process. Every subpoena, court order, or attorney letter goes to the same named person, the same day, before anything is produced, and the return date is calendared the moment it arrives.
• Escalate withholding, do not delegate it. Release staff never decide alone that something is a psychotherapy note. Any request touching the separate location goes to the privacy officer, because improperly withholding record content from a patient is the more common enforcement problem.
• Know that HHS is not on the list of people you refuse. When the Secretary requests records for a compliance investigation, psychotherapy notes are included and production is required.
• Write the policy down and review it with counsel on a schedule, since the state layer moves most.

Family sessions, groups, and collateral

The definition reaches a private counseling session as well as a group, joint, or family counseling session, so a couples or family process note can qualify on the content test the same way an individual one can. What it cannot absorb is the clinical substance: presenting problems, who attended, what was worked on, and the plan are record content regardless of format. Contact with people outside the session is a separate question, since what a school counselor or a prior prescriber tells you is clinical information you acted on: see documenting collateral contacts in psychiatric care.

Frequently asked questions

Are my DAP or BIRP session notes psychotherapy notes?

Almost certainly not. A structured session note documents the client's presentation, the interventions used, the response, and the plan, which is the summary content the federal definition excludes (45 CFR 164.501). If it also lives in the chart, it fails the separation condition too. Those notes are the medical record. Educational information, not legal advice; state law can be stricter, so confirm with a healthcare attorney licensed in your state.

Does a signed release of information cover my psychotherapy notes?

A general authorization for records does not reach them. Under the federal rules, psychotherapy notes require their own specific authorization, and that authorization may be combined only with another authorization for psychotherapy notes. It can never be bundled into the same form that authorizes release of the rest of the record. In practice that means a second, separate form, and release staff who know the difference before they process a request. Educational information, not legal advice; state confidentiality statutes and 42 CFR Part 2 can add consent requirements the federal rule does not, so confirm with a healthcare attorney licensed in your state.

Can a patient demand a copy of my psychotherapy notes?

The federal right of access generally does not extend to psychotherapy notes, though it reaches the rest of the protected health information in the designated record set. Two cautions. State law can give patients broader access than the federal floor, and where it is more protective of the individual it controls. And a provider may share process notes voluntarily, a policy decision best settled in advance. Withholding is only defensible if the material truly meets both prongs of the definition, and improper withholding is the more common enforcement problem, so route a contested request to your privacy officer rather than deciding at the desk. Educational information, not legal advice; confirm your own position with a healthcare attorney licensed in your state.

What happens if I keep process notes inside the chart?

You most likely lose the protection. Separation is written into the definition rather than added as a best practice, so notes sitting in the chart, in the same note field, or in the same export a records request produces are hard to characterize as separately maintained. Test what your system actually exports before relying on any assumption about it. Educational information, not legal advice; confirm with a healthcare attorney licensed in your state.

A subpoena arrived asking for the entire file. What do I do?

Do not respond alone, and do not alter or destroy anything. A subpoena issued by an attorney is not the same instrument as an order signed by a judge, and privacy rules, state confidentiality statutes, and privilege law sit on top of each other in ways that vary by jurisdiction and by the posture of the case. Do not let the return date pass either: subpoenas carry deadlines, and missing one can bring a motion to compel or sanctions even when the objection was valid, so escalate immediately and let counsel object, move to quash, or negotiate scope within the time allowed. Route it the same day to your privacy officer and a healthcare attorney licensed in the relevant state. Educational information, not legal advice.

Does an AI scribe create psychotherapy notes?

Being AI-generated does not decide the question, because content and separate maintenance do. In practice, a scribe that drafts a structured session note is producing medical record documentation: the output is the chart note you review, edit, and sign. Process notes remain something a clinician writes and stores outside any system that feeds the chart. Confirm how your vendor stores audio and drafts, and treat consent and business associate obligations as separate questions from this one. Educational information, not legal advice; confirm with a healthcare attorney licensed in your state.

Related guides

• DAP, BIRP, and GIRP note examples: three formats compared
• Psychiatric progress note example: an annotated medication management follow-up
• Writing psychiatric treatment plans with measurable goals: why "patient will feel better" fails an audit and what to write instead
• Documenting collateral contacts in psychiatric care
• AI scribe patient consent: what to say, what to record, and what your state requires

This article is educational and reflects one clinician's understanding of federal privacy requirements at the time of writing. It is not legal advice, and it is not billing, payer-specific, or medical advice; consult a qualified attorney or compliance professional licensed in your jurisdiction about your practice's specific obligations, and involve counsel before responding to any subpoena, court order, or contested records request. Privacy laws, state confidentiality statutes, privilege rules, enforcement practices, and payer policies vary and change, and nothing here guarantees any legal, payer, or audit outcome. No product, including ours, makes a practice HIPAA compliant by itself. Always verify current requirements with your own counsel and compliance advisors. The federal requirements described here come from the HIPAA Privacy Rule at 45 CFR Parts 160 and 164, and the substance use disorder paragraphs from 42 CFR Part 2; both were checked against the current eCFR text on September 7, 2026, and both are amended from time to time.