Psychotherapy is the only corner of healthcare where HIPAA splits your documentation in two. The official chart (diagnosis, treatment plan, progress notes) is the medical record, and it follows the normal privacy rules. Your private process notes are “psychotherapy notes” in HIPAA’s eyes, and they get stricter protection — but only if you keep them separate from everything else.
That one distinction decides what goes in your EHR, what stays out of it, and what you hand over when an insurer or a client requests records.
A framing note before we get into it: this is records-management guidance for practice owners, not legal or clinical advice. HHS’s guidance on HIPAA and mental health information is the actual authority, and your licensing board or a healthcare attorney should sign off on anything you change in your own practice.
Why psychotherapy electronic medical records follow different rules
Psychotherapy electronic medical records differ from standard EMRs in one way that matters: HIPAA recognizes two kinds of therapy documentation. The medical record (diagnosis, treatment plan, progress notes, billing information) follows standard privacy rules. Separate “psychotherapy notes,” a therapist’s private analysis of what happens in session, receive extra protection under 45 CFR 164.508.
No other specialty gets this carve-out. A cardiologist’s chart is one record, releasable as one record. HHS treated therapy differently because process notes hold the rawest material in healthcare: hypotheses you haven’t tested yet, impressions of a client’s marriage, your own countertransference. Nobody wrote those lines for a claims processor’s screen.
The practical effect, straight from HHS: with few exceptions, a practice must get the client’s written authorization before disclosing psychotherapy notes for any reason. That includes disclosures to another treating provider. Your medical record doesn’t get that shield. Properly authorized requests, payer audits, and routine treatment disclosures reach the chart through the ordinary rules.
What HIPAA actually counts as “psychotherapy notes”
The definition is narrower than most therapists assume. Psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the contents of a conversation during a private, group, joint, or family counseling session — and kept separate from the rest of the record.
The definition then excludes a long list of things you might expect it to cover:
- Medication prescriptions and monitoring
- Counseling session start and stop times
- The modalities and frequencies of treatment
- Results of clinical tests
- Any summary of diagnosis, functional status, the treatment plan, symptoms, prognosis, or progress to date
Read that list twice, because it’s essentially a description of a progress note. Which is the point. Progress notes are the medical record. Psychotherapy notes are the other thing: the analysis, the hunches, the sentence you’d never want read aloud in a deposition.
And here’s the trap. Anything filed in the medical record is, by definition, not a psychotherapy note. Type your process reflections into the progress-note field of your EHR and they become part of the releasable chart. The stricter protection doesn’t follow the content. It follows the separation.
What belongs in the medical record itself
Everything an outside party could legitimately need. Diagnosis and treatment plan. Session dates and times. Progress notes showing symptoms, interventions, and response. Test results, medication information where relevant, informed-consent paperwork, billing records.
This is the record clients can generally access under HIPAA’s right of access, and the one payers review when they audit claims. Write it accordingly: factual, professional, and complete enough to defend your clinical decisions.
Here’s a gut check we suggest to therapists: picture the client reading every progress note with you in the room. If a line would damage the relationship without adding clinical value, it belongs in a separate psychotherapy note — or nowhere.
How therapy EHRs handle the two-record split
Purpose-built mental health EHRs manage the separation for you. Most offer a dedicated psychotherapy-note or process-note field that’s stored apart from the chart, excluded from record releases, hidden from the client portal, and often visible only to the clinician who wrote it. Generic medical EMRs frequently don’t, which is one honest reason to pick therapy-specific software. Our guide to the best EHR systems for therapists compares the options, and we’ve also written up how to choose a therapy EHR step by step.
Two things to verify before you trust any vendor with this:
- The vendor signs a BAA. Any EHR holding client records is a business associate, full stop. We covered what a BAA actually needs to include if you want the checklist.
- The psychotherapy-note field stays out of exports and releases by default. Ask support directly. Some systems make separation possible but not automatic, and “possible” fails at 9 p.m. on a documentation night.
The trade-off worth admitting: an EHR’s process-note feature puts your most sensitive writing on someone else’s servers. Encrypted, BAA-covered servers, but still not yours. Some clinicians keep psychotherapy notes on paper in a locked cabinet for exactly that reason, and honestly, that’s a defensible choice. Less searchable, more private.
What a solo practice actually needs to keep
Here’s the part almost nobody says plainly: HIPAA never requires you to keep psychotherapy notes at all. They’re optional. The medical record is mandatory; the private notebook is a professional choice.
Our opinion: keep psychotherapy notes lean or skip them entirely. If a reflection genuinely sharpens your clinical work, write it down. If you’re journaling out of habit, you’re manufacturing pages of sensitive material you’ll have to protect, store, and eventually destroy.
The baseline every solo practice needs:
- A complete medical record for every client, retained as long as your state and board require (periods vary widely by state, and records for minors usually must be kept longer)
- A signed BAA with every vendor that touches client data
- A written policy covering how records are stored, released, and destroyed
One retention nuance trips people up: HIPAA’s six-year retention rule applies to HIPAA compliance documents like policies and authorizations, not to clinical charts. Chart retention comes from state law and your board. Confirm your numbers with both before you shred anything.
Keep records in the EHR, not on your website
Your website and your records system have opposite jobs. The EHR stores PHI behind a BAA and access controls. Your website exists to be found, build trust, and move a visitor to book, without collecting session content along the way. Contact forms should gather the minimum (name, contact details, a general “what brings you in”), feed a BAA-covered tool, and leave clinical intake to the portal.
That division is why we argue there’s no such thing as an off-the-shelf “HIPAA-compliant website” — only HIPAA-aware builds that keep PHI out of the wrong places. We laid out the real rules on HIPAA and therapist websites in a separate post, and the same thinking runs through every private practice website design we deliver.
FAQ: psychotherapy records, notes, and EHRs
Do therapists have to keep psychotherapy notes?
Can clients read their psychotherapy notes?
Can insurance companies see psychotherapy notes?
Are progress notes and psychotherapy notes the same thing?
Where to go from here
Set the separation up once — a therapy EHR with a locked process-note field and a signed BAA — and it protects you on autopilot from then on. Then give the public side of your practice the same attention. If your records are in order but your website still isn’t bringing clients in, start a website inquiry and we’ll show you what a conversion-focused therapist site looks like.
