July 19, 2026
10 min read
By Albert Wong, PhD · Clinical Psychologist
The short answer
HIPAA recognizes two kinds of therapy documentation. Progress notes are the official medical record: diagnosis, treatment plan, interventions, session times, progress. They support billing, clients generally have a right to see them, and insurers can require them for payment. Psychotherapy notes — your private process notes analyzing the conversation — get extraordinary federal protection: nearly every disclosure requires the client's separate authorization, insurers cannot condition payment on obtaining them, and they're excluded from the client's federal right of access. But the protection only exists if you keep them physically or electronically separate from the chart. Mix the two in one document, and the whole thing is the record.
The email arrives on a Tuesday. A client — maybe one in the middle of a custody dispute, maybe one who's just curious — writes: "I'd like a copy of everything you've written about me."
And there it is, the cold-water moment. You think about your charts, and then you think about the other things: the half-formed hunches, the countertransference you were working out on paper, the note where you wondered whether the marriage would survive. Which of your words are they entitled to? Which words could a lawyer pull out of you with a subpoena? You're not sure. Most therapists aren't.
The good news is that the map exists, and it's clearer than the anxiety suggests. Federal law draws one bright line through everything you write: progress notes are the official record — billable, generally accessible to the client, shareable with authorization, and reachable by lawful process. Psychotherapy notes are your protected thinking space, with the strongest privacy protection HIPAA gives any category of health information. But that protection has one non-negotiable condition, and it's the one most therapists miss: the notes must be kept separate from the rest of the record. Not labeled differently. Separate.
The definition lives at 45 CFR 164.501. Psychotherapy notes are "notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record."
Read that twice, because both halves matter. The notes must analyze the conversation — your impressions, hypotheses, the process of the session — and they must be separated from the chart. Then the regulation does something unusual: it lists, item by item, what psychotherapy notes are not. Excluded from the definition:
Walk that list concretely. If the sentence you wrote records what medication the client takes, when the session started and ended, that you used EMDR or CBT, how the PHQ-9 came back, what the diagnosis is, what the symptoms are, what the plan is, or how treatment is going — it is not a psychotherapy note, no matter what you name the file. All of that belongs to the regular record. All of that is progress-note material. The psychotherapy-note category is reserved for the layer underneath: your analysis of what happened in the room.
What does the protected status buy? Three big things. First, under 45 CFR 164.508, nearly any disclosure of psychotherapy notes — even to another treating provider — requires the client's specific, separate authorization; the handful of exceptions are narrow (your own use in treatment, supervised training, defending yourself in an action the client brings, and a few required-by-law situations). Second, a health plan may not condition treatment, payment, enrollment, or eligibility on getting that authorization — the insurer cannot hold reimbursement hostage to your process notes. Third, psychotherapy notes are carved out of the client's federal right of access, which we'll come back to.
| Progress notes | Psychotherapy notes | |
|---|---|---|
| Purpose | The official clinical and billing record; continuity of care | Your private analysis of the session; a thinking tool |
| Contents | Diagnosis, symptoms, treatment plan, interventions, session times, test results, medications, progress | Impressions, hypotheses, process observations, countertransference — the conversation itself |
| Who can demand it | Client (right of access), other providers with authorization, payers, lawful process | Almost no one without the client's specific separate authorization |
| Insurance access | Yes — payers can require records that support the claim | No — plans cannot condition payment or eligibility on obtaining them |
| Client access | Yes, under the federal right of access (limited exceptions) | Excluded from the federal right of access; some state laws grant more |
| Subpoena posture | Generally reachable through lawful process, subject to privilege rules | Stronger footing, but a court order can still reach them; state privilege law varies |
One caution on that last row: HIPAA's extra protection is not an invisibility cloak in court. A judge's order can compel production of psychotherapy notes, and psychotherapist–patient privilege is a matter of state (and federal) evidence law with real variation. Treat the protection as a strong seawall, not open water no wave can cross — and get a lawyer involved the moment legal process shows up.
Here's where most therapists run aground. You write one note per session, and it does double duty: the top half covers the billing essentials — diagnosis, interventions, plan — and the bottom half drifts into process: what you felt, what you suspect, the thing the client said that you're still turning over. It feels efficient. It feels thorough.
Legally, it's a single document in the medical record, and the whole thing is the record. The tender paragraph at the bottom has exactly the same status as the CPT code at the top: accessible to the client, requestable by the payer, reachable by records requests. There is no highlighter you can run over a paragraph that converts it into a psychotherapy note. The protection comes from separation, not from labeling. Two documents, two stores, or it's one record.
The practical test before you write a sentence into the chart: would I be comfortable if the client, their insurer, and a future attorney all read this? For a progress note, the answer should be yes — that's what it's for. Everything else either goes in a genuinely separate psychotherapy note or doesn't get written down at all.
Back to that Tuesday email. Under HIPAA's right of access, clients are entitled to a copy of their designated record set — the records used to make decisions about their care and billing. Progress notes: yes. Treatment plans, test results, billing records: yes. Psychotherapy notes, properly kept: no — they're expressly excluded from the federal access right. (You may choose to share them; HIPAA generally leaves that to your discretion. And some states grant clients broader access than federal law does, so check your state before you promise anything.)
The same carve-out shows up in the 21st Century Cures Act information-blocking rules — the "open notes" requirements that push providers to share records electronically. Psychotherapy notes as defined in 164.501 are excluded from the definition of electronic health information those rules cover, so the open-notes tide does not sweep your separated process notes out with it.
So the calm answer to "send me everything" is: "Of course — you're entitled to your record, and I'll get it to you promptly." Then you produce the designated record set, within the federal timeline, without panic — because you built the chart knowing the client might someday read it. That's not a burden. It's the discipline that makes good progress notes good.
You don't need a compliance department. You need three habits.
Whatever you choose, mind retention: your state sets how long clinical records must be kept (commonly around seven years for adults, longer for minors — check your board's rule), and if you do keep psychotherapy notes, decide deliberately how long they live and destroy them systematically, not selectively. Your EHR's job in all this is to make the official record easy to keep complete, secure, and exportable — the broader compliance picture is in our HIPAA-compliant documentation guide. Practice Harbor is built on that philosophy: the notes you write there are the official record, structured so the chart stands on its own — clean, insurance-ready, and shareable when you authorize it, with nothing in it you'd be afraid to have read back to you.
The two-record rule, in the end, is a gift. It gives your clinical thinking a harbor the law actually respects — and it asks only one thing in return: keep the channel between the two records clearly marked. Write the chart for daylight. Keep the process notes, if you keep them at all, behind their own wall. Then, when the Tuesday email comes, you'll know exactly which of your words belong to whom.
This article is educational, not legal advice. Federal rules are summarized here; state law can differ, and your situation may have wrinkles a licensed attorney should look at.
Practice Harbor's notes are built for the official record — clean, complete, insurance-ready, and shareable the moment you authorize it. Free for pre-licensed clinicians, $19/mo licensed.
Progress notes are the official medical record under HIPAA: diagnosis, symptoms, treatment plan, interventions, session start and stop times, test results, medications, and progress to date. Psychotherapy notes are a mental health professional’s private notes analyzing the conversation during a session, and they only qualify for HIPAA’s special protection if they are kept separate from the rest of the medical record. Anything on the 45 CFR 164.501 exclusion list — meds, times, modalities, test results, diagnosis, symptoms, plan, prognosis, progress — belongs in the progress note regardless of what the document is called.
Not under federal law. HIPAA’s right of access covers the designated record set, which includes progress notes, but psychotherapy notes are expressly excluded, and they are also excluded from the 21st Century Cures Act information-blocking (open notes) requirements. Providers may still choose to share them, and some state laws give clients broader access than HIPAA does, so check your state’s rules.
Health plans can require the records that support a claim — progress notes, treatment plans, billing records. But under HIPAA, disclosing psychotherapy notes requires the client’s specific, separate authorization, and a plan may not condition treatment, payment, enrollment, or eligibility on obtaining that authorization. In practice, properly separated psychotherapy notes stay out of the insurer’s reach.
No. Psychotherapy notes are optional; nothing in HIPAA or standard practice requires them. What is required is a complete official record — the progress notes documenting diagnosis, treatment, and progress. Many experienced therapists keep no separate process notes at all, which is a legitimate choice: fewer documents to store, produce, or defend.