Are psychotherapy notes protected under HIPAA?

Yes. 45 CFR 164.508(a)(2) requires an authorization for any use or disclosure of psychotherapy notes, with narrow exceptions, and 45 CFR 164.501 defines which notes count. A note qualifies only when a mental health professional recorded it to document or analyze a counseling conversation and kept it separate from the rest of the record.

In plain words, the rule covers a mental health professional's notes about a counseling conversation, in any medium, kept apart from the rest of the record.

What counts as psychotherapy notes under HIPAA?

Under 45 CFR 164.501, psychotherapy notes are notes recorded in any medium by a mental health professional who documents or analyzes the contents of a private or group, joint or family counseling conversation. The notes must also be kept separate from the rest of the record. The definition turns on who recorded the notes and what they record, so the test has more than one part.

Which sections of 45 CFR govern psychotherapy notes?

45 CFR 164.501 defines psychotherapy notes, and 45 CFR 164.508(a)(2) sets the authorization requirement for their use or disclosure. The definition says which notes are covered, and the requirement says what must happen before those notes are used or disclosed. The exceptions sit in the same paragraph of the rule as the requirement.

Does the psychotherapy notes rule apply to a small practice?

The requirement in 164.508(a)(2) names no exception based on practice size. The three narrow cases and the required or permitted uses apply the same way in a practice with one therapist as in a larger group. The test looks at the notes themselves, and practice size plays no part in it.

What must happen before psychotherapy notes are used or disclosed?

A covered entity must obtain an authorization before any use or disclosure of psychotherapy notes, unless an exception applies. The table below lists the definition, the requirement, and each exception with its citation.

Do electronic psychotherapy notes count?

The definition covers notes in any medium, so electronic and handwritten notes are both included. The medium does not change whether a note meets the other parts of the definition.

Which uses of psychotherapy notes do not need an authorization?

Psychotherapy notes need no authorization for three narrow cases: the originator's own treatment use, the covered entity's own training programs, and its defense of a legal action the individual brought. Uses required or permitted by 164.502(a)(2)(ii), 164.512(a), 164.512(d) (oversight of the originator), 164.512(g)(1), or 164.512(j)(1)(i) are also excepted from the requirement in 164.508(a)(2).

Do notes kept in the main chart count as psychotherapy notes?

Notes kept in the main chart do not count as psychotherapy notes under 45 CFR 164.501, because the definition requires notes kept separate from the rest of the record.

How does this rule apply before a therapist faxes records?

Before a therapist faxes psychotherapy notes, a valid authorization must cover that disclosure, unless one of the narrow cases or required or permitted uses applies.

Fax questions for therapists are covered in HIPAA fax rules for therapists. Patient consent to send records is covered in patient consent to fax medical records. Evaluation reports from a psychologist are covered in how psychologists fax evaluation reports.

* The regulation text was read at law.cornell.edu on October 13, 2026.