Who can get couples or family therapy records under HIPAA?

Under HIPAA, each person in couples or family therapy has a right of access to their own information, acted on within 30 days, and a provider may deny access, with review, where the record names another person and access is reasonably likely to cause that person substantial harm. The AAMFT Code asks for written authorization from each competent individual.

Who can get the records from couples or family therapy?

Each individual in couples or family therapy can request their own protected health information under HIPAA's right of access in 45 CFR 164.524, and the provider must act on the request within 30 days. A client can also direct a copy to another person, such as an attorney or a new therapist, through a signed written request. A parent or guardian with authority over an unemancipated minor's health care decisions is that minor's personal representative, with exceptions. Psychotherapy notes sit outside the right of access for everyone.

A family member who asks about a client's care comes under a separate permission. Unless a patient objects, a provider can give information to the patient's family, friends or anyone else the patient identifies as involved in their care, according to the CMS fact sheet HIPAA Basics for Providers.

The table sets each kind of request beside the HIPAA rule and the professional codes, each as written.

What can be withheld when a record names another person?

A provider may deny a client access to information that refers to another person, other than a health care provider, when a licensed health care professional determines that access is reasonably likely to cause that person substantial harm. That denial carries a right of review: the client can have it reviewed by a licensed health care professional the provider designates as reviewing official, who did not take part in the original decision.

Two categories sit outside the right of access altogether under 164.524(a)(1). The first is psychotherapy notes, which 45 CFR 164.501 defines as notes by a mental health professional that document or analyze a private, group, joint or family counseling session and are kept separate from the rest of the record. The second is information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative proceeding. A separate guide answers what counts as psychotherapy notes under HIPAA.

The codes describe withholding in their own terms. AAMFT Standard 2.3 limits a client's access to records only in exceptional circumstances and has marriage and family therapists take steps to protect the confidentiality of other individuals identified in client records. ACA B.6.e gives each client in a record that holds several clients only the parts that relate directly to that client. Standard 1.08(c) of the NASW Code of Ethics asks social workers who give access to protect the confidentiality of other individuals identified or discussed in the records.

Does each person have to sign a release?

Under the AAMFT Code of Ethics, each person signs: in couple, family or group treatment, a marriage and family therapist does not disclose information outside the treatment context, or provide access to records, without a written authorization from each individual competent to give one (Standards 2.2 and 2.3). Standard 2.2 adds that verbal authorization is not sufficient except in emergency situations. It also bars revealing any individual's confidences to others in the client unit without that individual's prior written permission.

HIPAA's rule runs person by person. A HIPAA authorization carries the signature and date of the individual it covers, and a personal representative who signs adds a description of the authority to act for that individual (45 CFR 164.508). An MFT treating a couple or a family works under both texts, and the AAMFT Code holds MFTs to the code wherever it sets the higher standard. HIPAA and the AAMFT Code each apply as they state.

Standard B.4.b of the ACA Code of Ethics has counselors in couples and family counseling clearly define who is considered "the client," discuss the expectations and limits of confidentiality, and document in writing the agreement among all involved parties. Standard B.6.g has counselors obtain written permission from clients to disclose or transfer records to legitimate third parties, unless exceptions to confidentiality exist.

Two rules trip up a signed form. An authorization that has not been filled out completely for an element 164.508(c) requires is not valid. An authorization for psychotherapy notes may be combined only with another authorization for psychotherapy notes. The core elements a HIPAA authorization form must contain include an expiration date or an expiration event tied to the individual or the purpose.

Can a parent get a child's therapy records?

A parent or guardian with authority under applicable law to make an unemancipated minor's health care decisions is the minor's personal representative under HIPAA, and a provider must treat that person as the individual, with exceptions (45 CFR 164.502(g)). One exception covers a service the minor consented to, when no other consent is required by law and the minor has not asked that the parent be treated as the personal representative. Another covers a service under an agreement of confidentiality between the provider and the minor that the parent assented to.

State law can still open the record to a parent. Where state or other law, including case law, permits or requires it, a provider may disclose an unemancipated minor's information to a parent or guardian, or give the parent access under 164.524. In family treatment, AAMFT 2.3 also asks for a written authorization from each individual competent to give one before records are opened.

How long do you have, and how do you send the copy?

A provider covered by HIPAA must act on an access request within 30 days of receiving it (164.524(b)(2)(i)), may extend once by no more than 30 days on the conditions the section sets, and must send a copy meant for someone else to the person and place the client's signed request names. The provider may require access requests in writing, provided it tells individuals about that requirement.

When a client directs the copy to another person, the request must be in writing, signed by the client, and clearly identify the designated person and where to send the copy. When the destination is a fax number, the copy goes to the number written on the signed request. A delivery record showing the date and the receiving number can sit in the file beside that request. A separate guide covers how to respond to a medical records request by fax.

What should the client file show?

Under the AAMFT, ACA and NASW codes, when any part of a record is withheld, the client file shows the client's request and the reason for withholding. AAMFT 2.3 requires the client's request and the reason for withholding some or all of the record to be documented in the client's file. ACA B.6.e has counselors document the request of clients and the rationale for withholding. NASW 1.08(a) asks that the rationale for withholding some or all of a client's record be documented along with the request.

The signed papers sit beside those notes: the written agreement on confidentiality among all involved parties that ACA B.4.b asks for, each HIPAA authorization with the core elements of 164.508(c)(1), and the client's signed request that named the person and the place for a copy.

How do the counseling, MFT and social work codes compare?

The AAMFT, ACA and NASW codes each give clients reasonable access to their own records and each handles a record that holds more than one client in its own way: AAMFT asks for written authorization from each competent individual, ACA gives each client only the parts that relate directly to them, and NASW protects others identified or discussed in the record.

The table quotes each standard on records that hold more than one client.

How do you send records from a HIPAA fax account?

On Fax Pigeon, a records copy is sent from the browser or from email to the number on the client's signed request, and every delivered fax gets delivery proof to file beside that request. A PDF, a Word file or a phone photo uploads as it is, and a cover sheet is optional. Every plan includes a signed BAA at signup, unlimited people and a shared inbox with roles and assignment. Paid plans fax from the practice's own number, and plans start at $4.99 a month billed annually for 200 pages.

* Official sources (the Code of Federal Regulations at govinfo.gov, CMS, AAMFT, the ACA, NASW) were read on October 20, 2026. Fax Pigeon prices and plan terms as of October 21, 2026.