HIPAA Psychotherapy Notes, and You
(January/February 2003)
The Therapist
by David G. Jensen,
Staff Attorney
The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") changes the rules
a bit in terms of how you, as a psychotherapist, assuming you are a covered entity, 1 will create
and use or disclose your psychotherapy notes. Creating psychotherapy notes involves both the
physical process of documenting information in your client files as well as organizing and
maintaining such information within your files. Keep in mind that pursuant to HIPAA, the terms
"use" and "disclosure" have special meanings.2 For example, therapists "use" protected health
information, such as that contained in mental health records and psychotherapy notes, when the
information is utilized within their practices, groups, or agencies. Alternatively, therapists make
disclosures" of information when they share it with someone outside of their practices, groups, or
agencies. The purpose of this article is to apprise you of how psychotherapy notes are defined
and handled under HIPAA. Please note, however, that the compliance date set for the privacy
aspect of HIPAA, which governs the creation, use, and disclosure of psychotherapy notes, is April
14, 2003. Consequently, therapists do not legally have to incorporate this information into their
practices until then. However, it would be a good idea for therapists to begin incorporating such
information into their practices as soon as practical. Moreover, although this information
technically applies only to therapists who are covered entities under HIPAA, it’s probably
reasonable for other therapists to begin familiarizing themselves now with the applicable
principals. It is not outside the realm of possibility that California may adopt some, most, or all of
these principals as its laws to bring uniformity to the healthcare/privacy landscape.
Creating Psychotherapy Notes Under HIPAA
HIPAA defines the concept of "psychotherapy notes" very narrowly. Essentially, "psychotherapy
notes" are a unique subset of a patient’s mental health record, which, in turn, is part of a patient’s
overall medical record. This overall record constitutes a client’s protected health information.
Psychotherapy notes are given special status under HIPAA. And, as a unique subset, such notes
have special rules regarding their creation. For HIPAA, "psychotherapy notes" are defined as:
… notes recorded (in any medium) by a health care provider who is a mental health professional
documenting or analyzing the contents of conversation during a private counseling session or a
group, joint, or family counseling session and that are separated from the rest of the individual’s
medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling
session start and stop times, the modalities and frequencies of treatment furnished, results of
clinical tests, and any summary of the following items: diagnosis, functional status, the treatment
plan, symptoms, prognosis, and progress to date.3
Pursuant to the definition of psychotherapy notes set forth above, such notes must be kept
separate from the rest of the individual’s medical record. This requirement should not be a
problem for therapists in private practice who typically have only mental health information in their
files. This requirement, however, could be problematic for groups and agencies that also address
the physical problems of their patients. Clearly, however, psychotherapy notes must be kept
separate from the rest of the patient’s medical record.4 But, does that mean such information must
be kept in a separate file altogether, or just physically segregated within a file? Unfortunately, at
this time, we don’t know because there is no clear answer. All we do know is that, pursuant to the
definition of psychotherapy notes set forth in HIPAA, such notes must be "separated from the rest
of the individual’s medical record."5
1
Moreover, notice that HIPAA’s definition of "psychotherapy notes" specifically includes certain
information and specifically excludes certain other information. For instance, the notes therapists
keep from their counseling sessions are included within the definition; conversely, such things as
counseling start and stop times and the modalities and frequencies of treatment furnished, among
others, are excluded from the definition. Although such things logically pertain to the counseling
rendered, such things are not considered "psychotherapy notes" for HIPAA’s purposes. Such
things are, however, part of a patient’s medical record.
This delicate distinction between psychotherapy notes and the rest of a patient’s mental health
record leads to the question of whether such excluded information should also be kept separate
from the psychotherapy notes. Our thinking is that the federal government created these
classifications, i.e., psychotherapy notes versus other types of mental health information, for a
reason, and therapists would do well to abide by the distinctions. Hence, we recommend keeping
the notes separate from the excluded items in the definition. Again, it may not be necessary to
keep the notes in a completely separate file, but there should be some sort of boundary or line of
demarcation between the two types of information. Another possibility is to keep the
psychotherapy notes on one side of the patient file and the excluded items on the other side of the
file. Doing so will enable therapists to comply with the law and help logistically with actually
producing the information later. For instance, suppose a client wants copies of his/her records
evidencing the treatments and modalities used sent to his/her attorney. If such information is kept
separate from your notes, it will be very easy to copy the relevant information and send it to the
client’s lawyer. However, if that information is intermingled with or embedded within your notes, it’s
going to be much more difficult to copy the relevant information. And, if it can’t be copied because
the notes are not kept separate from the rest of the information in the file, it may cause your notes
to lose their special status under HIPAA because they are not kept separate from the rest of the
client’s information.
This concept of separateness is explicitly required by HIPAA.6 As a result, we recommend that
therapists keep their psychotherapy notes separate from any other information in patient files.
And, just to be on the safe side, until we get further clarification under HIPAA, we also recommend
that therapists keep their psychotherapy notes separate from the information excluded from
HIPAA’s definition of psychotherapy notes, such as counseling start-stop times, the modalities and
treatment furnished, the results of any clinical tests, and any summaries of treatment.
Using or Disclosing Psychotherapy Notes Under HIPAA
As mentioned, HIPAA specifically defines the terms "use" and "disclosure." A use of information
occurs when individually identifiable health information is shared, employed, applied, utilized,
examined, or analyzed within an entity.7 A disclosure of information, on the other hand, occurs
when information is released, transferred, provided
access to, or divulged outside of the entity holding the information. And, as you can well imagine,
HIPAA has special rules for using and disclosing psychotherapy notes with and without
authorizations.
In general, therapists must obtain authorizations8 for any uses or disclosures of psychotherapy
notes, except as summarized below:
1.To carry out the following treatment, payment, or healthcare operations: (A) use by the originator
of the psychotherapy notes for treatment; (B) use or disclosure by therapists for their own training
programs in which students, trainees, or practitioners in mental health learn under supervision to
practice or improve their skills in group, joint, family, or individual counseling; or, (C) use or
disclosure by therapists to defend themselves in legal actions or other proceedings brought by
their patients.9
2
2.When required by the Secretary of Health and Human Services (or any other officer or employee
of HHS to whom the authority involved has been delegated), for compliance or enforcement
purposes, to investigate or determine the covered entity’s compliance with HIPAA. 10
3.When required by law and the use or disclosure complies with and is limited to the relevant
requirements of such law, i.e., child abuse reporting.11
4.Therapists may disclose protected health information to a health oversight agency for oversight
activities authorized by law, including audits; civil, administrative, or criminal investigations;
inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or
actions; or other activities necessary for appropriate oversight of the health care system. 12
5.Therapists may disclose protected health information to a coroner or medical examiner for the
purpose of identifying a deceased person, determining a cause of death, or other duties as
authorized by law.13
6.Therapists may, consistent with applicable law and ethical standards, use or disclose protected
health information, if they, in good faith, believe the use or disclosure, is necessary to prevent or
lessen a serious and imminent threat to the health or safety of a person or the public and the use
or disclosure is to a person or persons reasonably able to prevent or lessen the threat, including
the target of the threat.14
Of the 6 exceptions listed above, numbers 1, 3, and 6 will probably be the ones that come into
play most often for therapists. However, therapists who are covered entities must analyze the
question of whether to use or disclose psychotherapy notes without authorizations in light of
applicable California law as well as HIPAA. Be advised that this is a fairly complex analysis
because the laws are not synonymous and the exceptions listed above have only been
summarized for teaching purposes. Consequently, therapists who are covered entities under
HIPAA should consult with CAMFT or their own attorneys before releasing any psychotherapy
notes, or for that matter any client information, without written authorizations.
______________________
September/October 2002 issue of The Therapist.
2 45 CFR 164.501
3 45 CFR 164.501
4 45 CFR 164.501
5 45 CFR 164.501
6 45 CFR 164.501
7 45 CFR 164.501
8 For a sample authorization, see the Member’s Only
section of CAMFT’s website at www.camft.org.
9 45 CFR 164.508
1045 CFR 164.502 and 45 CFR 160.103
1145 CFR 164.512(a)
1245 CFR 164.512(d)
1345 CFR 164.512(g) (1)
1445 CFR 164.512(j)(1)(i)
This article appeared in the January/February 2003 issue of The Therapist, the publication of the
California Association of Marriage and Family Therapists, headquartered in San Diego, California.
This article is intended to provide guidelines for addressing difficult legal dilemmas
3