By Nicole Hovey, Expert in Behavioral Health Digital Marketing
Psychotherapy notes get stronger privacy protection under HIPAA than the rest of a client’s chart, but only when a program actually keeps them separate from the clinical record, not just labeled differently inside the same file. That separation is what lets a clinician withhold session-content notes from an insurer or another provider without a special authorization, something progress notes never qualify for. For addiction treatment programs, 42 CFR Part 2 adds a second, stricter layer on top of HIPAA, and the two rules don’t always line up the way a busy clinical team assumes, especially now that Part 2’s own enforcement has caught up with its newest changes. The rest of this piece walks through what actually has to happen in a chart, and in an EHR, for that protection to hold up, both in daily practice and in front of a surveyor or a subpoena.
What Counts as a Psychotherapy Note Under HIPAA?
A psychotherapy note, under HIPAA’s definition at 45 CFR 164.501, is the record a mental health professional keeps of their own analysis of what happened during a private, group, joint, or family counseling session, and it only counts as one if it lives apart from the rest of the client’s medical record. That second condition trips up more programs than the first. A clinician can write exactly the kind of reflective, personal content the rule has in mind, impressions about a client’s affect, a hypothesis about an underlying dynamic, a note to self about a technique to try next session, and still lose the special protection entirely if that content sits in the same file as the treatment plan and the billing-facing progress note.
The definition also draws a firm line around what can never be a psychotherapy note, no matter where it is filed. Medication prescriptions and monitoring, the start and stop time of a session, the treatment modalities used and how often, results of any clinical test, and a summary of diagnosis, functional status, treatment plan, symptoms, prognosis, or progress all count as part of the standard medical record. A program can’t relabel those items as psychotherapy notes to shield them from a routine records request, and reviewers who understand this distinction will ask to see exactly what a note contains before accepting that it qualifies for the higher protection.
How Are Psychotherapy Notes Different From Progress Notes in Practice?
Progress notes are built to be read by other people on the care team, while psychotherapy notes are built for the clinician’s own use. A progress note documents what service was delivered, how the client responded, and how that session connects to the treatment plan, since a supervisor, a covering clinician, or a utilization reviewer needs to be able to pick up the chart and understand where the client stands. A psychotherapy note, by contrast, can stay unstructured and personal, closer to a working diary of clinical impressions than a formal record, precisely because HIPAA doesn’t expect anyone outside the writing clinician to read it under normal circumstances.
| Progress notes | Psychotherapy notes | |
|---|---|---|
| Who reads them | Care team, auditors, insurers | Usually only the writing clinician |
| What they contain | Services delivered, response to treatment, plan progress | Personal reflections, hypotheses, session-content analysis |
| Storage | Part of the standard medical record | Kept physically or functionally separate |
| Disclosure without extra authorization | Yes, under standard HIPAA permitted uses | No, requires specific client authorization in most cases |
That table is also where most documentation mistakes start. A clinician who writes “client seems to be minimizing father’s role in the substance use, worth exploring in a future session” has written a psychotherapy note. A clinician who writes “client attended individual session, discussed family history, plan to continue exploring family dynamics in next session” has written a progress note, even though the two sentences describe the same fifty minutes. The difference isn’t the topic, since both notes cover the same family history conversation. It comes down to whether the note analyzes the clinician’s own thinking about the session or documents what happened for the record everyone else relies on.
How Does 42 CFR Part 2 Change Confidentiality for Addiction Treatment Programs?
For any program that is federally assisted and holds itself out as providing substance use disorder treatment, 42 CFR Part 2 applies on top of HIPAA, and it has historically been the stricter of the two rules. SAMHSA’s 2024 final rule changed a great deal of how that rule works by aligning Part 2 more closely with HIPAA, building on the earlier round of proposed Part 2 changes that programs were tracking a couple of years back, and enforcement of the updated rule began February 16, 2026, which means this is no longer a future compliance date for programs to plan around, since it is already active.
The most visible change is consent. Under the prior version of Part 2, a program needed a separate patient consent for nearly every treatment, payment, or operations disclosure, each one naming the specific recipient. The 2024 rule allows a single consent to cover future treatment, payment, and operations disclosures, matching how HIPAA has always worked. The rule also extends HIPAA’s breach notification requirements to Part 2 records and applies HITECH-level civil penalties, up to two million dollars, where Part 2 violations previously carried much lighter federal penalties. What hasn’t changed is the core protection: Part 2 records still can’t be used in a civil, criminal, administrative, or legislative proceeding against the client without written consent or a court order paired with a subpoena, and that bar is still higher than what HIPAA requires for a typical progress note. A program’s psychotherapy notes on a substance use disorder client sit at the intersection of both rules, and the stricter of the two controls.
When Can Psychotherapy Notes Be Disclosed, and When Can They Not?
Psychotherapy notes can be disclosed without a specific client authorization in a narrow set of circumstances: to the originating clinician for their own continued treatment use, in some cases for the clinician’s own training and supervision, to defend against a legal action the client has brought, when a health oversight agency needs them to investigate the originating clinician, or when a serious and imminent threat to health or safety requires it. Every other use, including a request from an insurance company, a request from a different treating provider, or a subpoena on its own, requires the client’s written authorization naming psychotherapy notes specifically. A general medical records release doesn’t cover them.
Insurers ask for psychotherapy notes more often than most programs expect, usually during a utilization review or an appeal, and the correct answer isn’t to send the file because a records request arrived. It is to check whether the specific authorization on file actually names psychotherapy notes, and if it doesn’t, to send only the progress notes that answer the reviewer’s question about medical necessity. A reviewer deciding whether to continue authorizing a level of care needs frequency, response to treatment, and progress toward the plan, all of which live in the progress note. They rarely need the clinician’s private clinical hypotheses to make that call, and sending them anyway, out of habit or to save time, is one of the more common ways a program gives up protection it never had to give up.
What Do Joint Commission and CARF Surveyors Check About Note Separation?
Surveyors check whether the separation is real in the file, not just claimed in policy. That means a surveyor pulling a chart will look for a distinct note type or a distinct location for anything labeled a psychotherapy note, and will ask a staff member to show, on the spot, how a psychotherapy note gets kept apart from the treatment plan and progress notes inside your actual system. A written policy that describes separation, sitting next to a chart where every note type lives in one continuous timeline with no functional distinction, doesn’t satisfy either accreditor.
Both Joint Commission and CARF surveyors also look at access, asking who can open a psychotherapy note beyond the writing clinician and whether that access is actually restricted in the system rather than merely discouraged by policy. Programs that already work through a Joint Commission documentation checklist or that have looked at what to expect during CARF accreditation will recognize this pattern: surveyors trust what the system enforces far more than what the staff manual instructs, because a system enforces the rule even on a chart nobody expects to be reviewed that day.
How Should an EHR Actually Keep Psychotherapy Notes Separate From the Clinical Record?
An EHR keeps psychotherapy notes separate by giving them their own note type, their own storage location within the chart, and access controls that restrict them to the writing clinician by default, rather than relying on a naming convention inside a shared note feed. That distinction has to be structural, meaning the software itself prevents a psychotherapy note from appearing in the same view, export, or printout as the treatment plan and progress notes unless someone deliberately and specifically pulls it.
Billing is the part programs most often get wrong, since a psychotherapy note should never be the note a claim ties back to. The service documentation that supports a billing code, frequency, modality, and duration, belongs in the progress note, while the psychotherapy note stays outside that chain entirely. Programs running multiple levels of care, or IOP and PHP documentation alongside individual sessions, need this distinction to hold across every clinician and every program, not just for the one therapist who happens to understand the rule well. That is the specific gap BestNotes’ documentation tools are built to close: a note-type field that keeps psychotherapy notes structurally apart from the record everyone else on the care team, and every auditor, actually sees.
What Mistakes Put Psychotherapy Note Protection at Risk?
The most common mistake is writing psychotherapy-note content inside a progress note because it was faster in the moment, then treating the whole entry as protected after the fact. Once analysis and reflection sit inside the same note as service documentation, the entire note is a progress note under HIPAA’s definition, and none of it gets the extra protection, regardless of what the clinician intended when writing it.
A second mistake is granting broad chart access by role rather than by note type, so that anyone who can open a client’s chart at all can also open every psychotherapy note inside it. A third, especially common where a program has recently gone through an EHR migration, is importing years of notes into a single undifferentiated note history, which erases whatever separation existed in the old system and forces a program to rebuild it from scratch. A fourth mistake shows up during staff turnover, when a departing clinician’s psychotherapy notes get reassigned to a new access holder along with the rest of the caseload, quietly widening who can read years of personal clinical reflections that were never meant for a second reader. None of these mistakes require bad intent. They are usually workflow shortcuts that made sense on a busy day, and they tend to surface only when a subpoena, an audit, or a survey asks a program to prove a separation that was never actually built into the system in the first place, the same pattern behind many of the real HIPAA breaches and penalties programs have faced for far more ordinary reasons than a hack or a lost laptop.
Frequently Asked Questions
Are psychotherapy notes and HIPAA’s regular medical record the same thing? No. Under HIPAA’s definition, a note only counts as a psychotherapy note if it is kept separate from the rest of the medical record. If it sits inside the standard record, it is treated as a progress note, whatever the content.
Under HIPAA, can insurance companies request psychotherapy notes directly? Insurers can ask, but they can’t require you to release them without a specific client authorization that names psychotherapy notes. A general authorization to release medical records doesn’t cover them, and a program can supply progress notes to answer a medical necessity question instead.
Do clients have a right to see their own psychotherapy notes? In most cases, no. HIPAA generally excludes psychotherapy notes from a client’s right of access under the Privacy Rule, though state law can differ, so it is worth checking the specific rule in your state before denying a request.
How does 42 CFR Part 2 interact with psychotherapy notes for substance use disorder clients? Part 2 applies its own confidentiality rule to any record identifying someone as a substance use disorder patient at a federally assisted program, on top of whatever HIPAA protection the note already carries. Since the 2024 final rule, enforced starting February 16, 2026, Part 2 aligns more closely with HIPAA on consent and breach notification, but it still requires a court order and subpoena, not just a request, before Part 2 records can be used against a client in a legal proceeding.
Does a group practice need one psychotherapy notes policy or one per clinician? One shared policy, applied consistently, works better than letting each clinician decide individually, mainly because a surveyor or an auditor will ask to see the same separation hold up across every clinician’s chart, not just the ones written by someone who already understood the rule.
Keeping the Separation Real as Your Program Scales
The rule itself isn’t complicated once a program sees it clearly: keep psychotherapy notes apart from the clinical record, restrict who can open them, and never let them anchor a billing code. What gets complicated is holding that line across a growing caseload, multiple clinicians, and more than one level of care, especially once a program adds IOP or PHP programming on top of individual therapy or brings on new staff who haven’t yet internalized where the line sits.
That is a system problem more than a policy problem. A written policy can’t enforce itself in the middle of a busy Tuesday, but a note-type field, a default-restricted access setting, and a billing workflow that never touches a psychotherapy note can. It also holds up better under the kind of scrutiny a program can’t fully predict in advance, whether that is a routine CARF survey, an insurer’s utilization review, or a subpoena tied to a client’s own legal matter, because the separation was built into how the chart works rather than into a policy binder nobody opens between surveys. See how BestNotes helps behavioral health and addiction treatment programs keep psychotherapy notes structurally separate from the clinical record, with access limited by default and a documentation workflow built around how surveyors and auditors actually check it.
About the Author
Nicole Hovey is a marketing and communications leader at BestNotes, where she helps behavioral health and addiction treatment organizations discover tools that streamline workflows, strengthen outcomes, and support clinical excellence. With a background in behavioral health program operations, digital strategy, and customer engagement, Nicole brings a unique blend of industry insight and practical experience to her writing.
At BestNotes, Nicole develops educational content, webinar programs, and product-focused resources that empower providers to stay ahead of regulatory changes, leverage emerging technologies, and deliver more efficient, data-driven care. She is especially passionate about helping organizations understand how EHRs, AI, and outcomes tracking work together to improve client experiences and reduce clinician burnout.
