Psychotherapy Notes, HIV/AIDS, Drugs/Alcohol

Psychotherapy Notes

What are psychotherapy notes?

The regulations define psychotherapy notes narrowly to include only detailed notes recorded by a mental health professional documenting or analyzing the contents of conversation during a private, family or group counseling session.

Psychotherapy notes expressly do not include medication prescription and monitoring, counseling session start and stop times or the modalities and frequencies of treatment furnished, results of clinical tests or a brief summary of diagnosis, functional status, the treatment plan, symptoms prognosis and progress to date.

  • Implementation Tip: Most mental health records will not qualify as psychotherapy notes. For example, a note in the medical record about a mental health diagnosis, treatment plan and progress is not a psychotherapy note. Providers must develop policies and procedures to determine when a record must be given the special confidentiality considerations required of psychotherapy records.
  • Implementation Tip: Mental health records that do not qualify as psychotherapy notes are subject to the same privacy and access requirements as other protected health information.

Requirements for Use and Disclosure of Psychotherapy Notes

Authorization: You must obtain a special authorization for most uses and disclosures of psychotherapy notes, including:

  • For treatment purposes, if the person using or disclosing is someone other than the person who created the notes.
  • For payment or health care operations, regardless of who is using or disclosing the information.

Consent: You may use the general consent form to support the following uses or disclosures of psychotherapy notes:

  • Use or disclosure for treatment purposes by the person who created the psychotherapy notes (and only that person).
  • To conduct training programs in which students, trainees or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family or individual counseling.
  • Defend a legal action or other proceeding brought by the patient. Note that you are allowed to release the information to your defense attorney under this provision, but disclosures to others in the course of a judicial or administrative proceeding require an authorization.

Neither consent nor authorization is required for uses or disclosures:

  • Required for enforcement purposes
  • When mandated by law
  • When needed for oversight of the provider who created the notes
  • When needed by a coroner or medical examiner
  • When needed to avert a serious and imminent threat to health or safety.

Location of psychotherapy records: Psychotherapy notes must be maintained separately from a patient's medical record and other protected health information.

  • Implementation Tip: The separation requirement does not necessarily mean the records must be maintained in a separate file from the medical record. Rather, separating the psychotherapy notes from the rest of the medical file with a tab or other conspicuous separator likely will suffice. The goal is to ensure psychotherapy notes receive the special confidentiality HIPAA requires.

Special Note
Release of psychotherapy records to the patient: HIPAA generally provides a strong patient right of access to protected health information that is used to make decisions about them. An exception is made for psychotherapy notes. The rules allow a provider to refuse patient access to their own psychotherapy notes, for any reason. The provider does not need to make a determination that release of the notes would be harmful to the patient. The patient does not have a right to have the denial reviewed. See information on the relationship to state law below.

Relationship to State Law

Generally, HIPAA likely will preempt state law.

Oregon law currently provides much the same confidentiality protections for mental health records (including psychotherapy notes) as for medical records. ORS 179.505, covering medical records of public facilities, and ORS 192.525, establishing state policy regarding medical records of private providers, require written release authorization for release of records. With the possible exception of release of information to a patient (discussed below), these statutes likely have limited, if any, relevance after HIPAA. The HIPAA regulations regarding use of consent and authorization likely will prevail. The Oregon Legislative Assembly will need to make necessary changes to the Oregon statutes in the 2003 legislative session.

Release of information to the patient: Oregon law may preempt HIPAA as it relates to release of psychotherapy notes to patients and require release unless there is a showing that release is injurious to the patient.

Oregon law requires release of all medical records to a patient upon written authorization, including what HIPAA calls psychotherapy notes, unless a physician or licensed mental health care provider believes release of the record would be:

  • Injurious to the patient (ORS 192.525);
  • Constitute an immediate and grave detriment to the treatment of the patient or be dangerous to another individual (ORS 179.505).

By requiring a showing of harm before a provider may refuse to release records to a patient, state law actually allows greater access by a patient to his/her own record than does HIPAA. Because it provides greater patient access, state law may preempt HIPAA.

As a final note, and to confuse matters even further, ORS 192.525 and ORS 179.505 may fail in their entirety due to confusion of HIPAA concepts of authorization and consent, leaving HIPAA or a possible new state law as the controlling authority.


The privacy regulations do not address HIV/AIDS records as a separate category and hence, under HIPAA, they may be released pursuant to a general consent.

Oregon law, however, requires a specific release. As the more stringent law, Oregon's requirements likely prevail over HIPAA in this circumstance. Under Oregon law, you must obtain a written, signed release from the patient that includes:


Like HIV/AIDS, the HIPAA privacy regulations do not specifically address drug and alcohol records as a separate category and hence allow release pursuant to the general consent.

Oregon and existing federal law requires specific written consent for release of records maintained for patients undergoing treatment for alcohol and drug addiction. The release must specify:

  • The name of the practitioner directed to make the disclosure
  • The name or title of the person or organization to which the disclosure is to be made, or that the information may be made public
  • The extent and the nature of the information to be disclosed
  • The purpose of the disclosure.

Implementation Tip: You may choose to combine a specific release for HIV/AIDS or drugs/alcohol with the general consent. If you do, make sure the specific consent is organizationally separate from the general consent and contains a separate signature. Combining a specific release with the consent may not be an entirely practical course of action, as the consent need be signed only once and a specific release generally expires, and must be renewed, after a relatively short period of time.

Implementation Tip: Remember that psychotherapy notes, HIV/AIDS and drug/alcohol records, like other PHI, may be released without consent or authorization to the extent necessary to meet a medical emergency or to avert a serious threat to the health of the individual or the public.

Policy Team

Sean Kolmer, MPH
Senior Vice President of Policy & Strategy

Danielle Meyer, MSS
Director of Public Policy

Rebecca Pawlak, MPH
Director of Public Policy 

The website of the company is easy to navigate, so that ordering the drug will not be a problem even for an older generation. Just browse the page, find the necessary treatment, add it to the cart, make a payment and receive it.