If you write notes after a session, HIPAA cares which kind you wrote. The two categories look similar from the outside, but they have completely different legal protections, required content, and storage rules. Get the line wrong and your “psychotherapy notes” lose the extra HIPAA protection they were supposed to have.

This guide is the working clinician’s reference for the difference, what HIPAA § 164.501 actually says, what to put in each, how to keep them separate, and the questions that come up at every consultation table.

At a glance: psychotherapy notes vs progress notes

Are psychotherapy notes and process notes the same thing?

Yes. Psychotherapy notes, process notes, and private notes are three names for the same artifact. HIPAA defines the legal category as “psychotherapy notes” in 45 CFR § 164.501. Clinicians more often say “process notes” in supervision. “Private notes” is the older term still used in some training programs and ethics codes. All three refer to the therapist’s personal session notes, kept separate from the chart, with extra HIPAA protections.

Where it gets confusing in practice: some clinicians use “process notes” to mean any reflective journaling about a case, including content that wouldn’t legally qualify as a psychotherapy note under HIPAA (for example, anything that summarizes diagnosis or treatment plan). If you want HIPAA’s extra protections, your notes have to meet HIPAA’s definition, not just the loose clinical use of the term.

What is a progress note?

A progress note is the official record of what happened in a session. Every mental health profession requires them, and they live inside the client’s medical record. They document medical necessity, what you did, how the client responded, and where treatment is going next.

Progress notes typically include:

• Session date, start and stop times, location
• Client’s presenting concerns and current symptoms
• Diagnosis
• Mental status (appearance, mood, affect, safety risk)
• Treatment modalities and interventions used
• Client response and progress toward goals
• Homework, referrals, recommendations
• Medications discussed or prescribed
• Results of any tests or assessments
• Plan for next session
• Your signature and credentials

Documentation formats give you a structure for the above. The common ones are SOAP notes, DAP notes, BIRP notes, GIRP notes, and PIRP notes. Each state and each payer can add its own requirements on top, so check your licensing board and your contracts.

Because progress notes are part of the chart, clients can request copies, insurance companies can audit them, and they get subpoenaed. They are meant to be readable by other providers, not your personal shorthand.

For a deeper walk-through of how to write them well, see our progress notes pillar.

What is a psychotherapy note (process note, private note)?

A psychotherapy note is your private record of what you were thinking, feeling, and noticing about a session. It is not part of the chart. It is for you.

HIPAA § 164.501 defines psychotherapy notes as notes recorded by a mental health professional documenting or analyzing the content of conversation during a private, group, joint, or family counseling session, that are kept separate from the rest of the individual’s medical record.

Typical content of a psychotherapy note:

• Questions to bring to supervision or consultation
• Your hypotheses about what’s driving the client’s pattern
• Countertransference reactions you want to track
• Themes you want to come back to in future sessions
• Reminders to yourself about the alliance, ruptures, or shifts
• Notes from supervision that should inform your next session

There is no required format. You can write in full sentences, bullet points, shorthand, code names, or doodles. The only rule that matters is that the note has to stay outside the medical record. Stored in the same chart as the progress note (even on a different colored page or under a different tab in the same EHR record), it loses its protected status and becomes regular PHI.

A few clinical examples of what a real psychotherapy note looks like:

“Client minimized the conflict with her sister again. Third week. Worth flagging in supervision, wondering if this is avoidance of attachment material from the intake. Try a circular question next session instead of asking directly.”

“Felt myself getting impatient at minute 40. Probably my stuff, I had a hard week. Watch for this pattern. Don’t let it bleed into the alliance.”

“Need to read up on perinatal OCD before next week. Asked Sarah for a reading recommendation in our consult.”

Three things to notice: none of those examples contain diagnosis, treatment plan, medication, or symptom summary. They are about the session and about the clinician’s process. That’s the line.

What to keep out of psychotherapy notes

HIPAA draws a hard line. Under 45 CFR § 164.501, psychotherapy notes exclude the following nine categories. If any of these end up in your “psychotherapy note,” HIPAA stops treating it as a psychotherapy note and it becomes regular PHI in the medical record:

1. Medication prescription and monitoring
2. Counseling session start and stop times
3. The modalities and frequencies of treatment furnished
4. Results of any clinical tests or assessments
5. Diagnosis
6. Functional status
7. Treatment plan
8. Prognosis
9. Symptom summary, treatment summary, and progress to date

This is the most-missed rule in documentation training. Therapists assume that anything they write privately is a psychotherapy note. It isn’t. The legal category is defined by what’s in the note, not where you stored it. A “psychotherapy note” with diagnosis and treatment plan in it isn’t a psychotherapy note in the eyes of HIPAA, it’s a regular progress note that you happened to file separately.

This is also why “process notes for supervision” sometimes lose their protection: if you’ve written down diagnosis or treatment plan content to discuss with your supervisor, those passages need to be in the chart, not in a privately filed note.

How to separate psychotherapy notes from the medical record

The separation requirement is the part most therapists underestimate. Same chart with a different label is not separation. Same EHR record with a different tab is not separation if access controls don’t actually restrict it. Color-coded pages in the same folder are not separation.

Real separation looks like:

• A different physical file, in a different locked location, from the client’s chart
• Or a separate, encrypted, access-restricted folder in a HIPAA-compliant EHR, one that only the treating clinician can open, with administrative and billing staff actively blocked
• Files labeled clearly enough that no one accidentally pulls a psychotherapy note into a records release (“Psychotherapy Notes, Confidential”)
• A written policy that staff know about and follow

If your EHR doesn’t natively separate psychotherapy notes from the chart with real access control, you don’t have separation. That’s the single most common documentation mistake in private practice, and the reason a lot of “psychotherapy notes” wouldn’t survive a privacy audit.

Mentalyc’s AI Note Taker was built to keep this line clean. Progress notes are structured into SOAP, DAP, or BIRP formats and stored in the chart. Your private notes stay in a separate, encrypted space that only you can open. The separation is the default, not a setting you have to remember to turn on.

For the full HIPAA picture, encryption, retention, BAAs, breach response, see our HIPAA and mental health practice guide.

Are psychotherapy notes required?

No. Psychotherapy notes are optional. Progress notes are required by every licensing board and every payer. Most clinicians do not keep psychotherapy notes at all, and that is a perfectly defensible practice. Some clinicians find them useful for cases that need a lot of self-reflection, complex transference, or active supervision. That’s a personal call.

If you do keep them, the rule of thumb is: only write things you would want to write down. Once a note exists, it can theoretically be compelled in some narrow legal scenarios (we cover that next). The decision to keep a psychotherapy note should be deliberate, not automatic.

Can psychotherapy notes be subpoenaed or disclosed?

Yes, but rarely. The Privacy Rule requires that a covered entity get specific written authorization from the client before disclosing psychotherapy notes, separate from any general authorization the client signed for the rest of their PHI. There are narrow exceptions where authorization isn’t required: law enforcement purposes or legal mandates, certain oversight activities authorized by federal law, use by a coroner or medical examiner, or avoidance of a serious and imminent threat to health or safety.

In practice, most subpoenas you’ll receive ask for progress notes, not psychotherapy notes, because progress notes are what actually exists in the official record. For the full procedural walk-through of what to do when you get a subpoena, see can psychotherapy notes be subpoenaed and when can psychotherapy notes be disclosed.

How long do you need to keep psychotherapy notes?

State law and your licensing board set this, not HIPAA directly. HIPAA’s 6-year rule applies to administrative documentation (privacy policies, training records, business associate agreements), not to patient notes.

For patient notes, the working standard is:

• APA’s Record Keeping Guidelines: retain full records for 7 years after the last date of service for adults, or 3 years after a minor reaches the age of majority, whichever is later
• State licensing boards: range from 3 years (Wyoming) to 20 years (Massachusetts hospitals), with most states at 5–10 years for adults and longer for minors
• The stricter standard wins: if your state requires 10 years and APA suggests 7, you keep for 10

Check your state board for the exact number. If you’re unsure, default to APA’s 7-year guideline as a floor and your state requirement as the actual rule.

Common documentation mistakes to avoid

Five things that come up over and over in supervision and audits:

1. Mixing the two. Writing diagnosis, treatment plan, or progress toward goals into a “psychotherapy note.” The note loses its protection and becomes regular PHI, usually the worst of both worlds, because the content is now legally part of the record but stored where no one can find it.

2. Same-chart storage. Filing the psychotherapy note under a different tab in the same EHR record as the progress note. If access controls don’t separate them, neither does HIPAA.

3. Treating supervision notes as automatically protected. Notes you took for supervision, your impressions, hypotheses, countertransference, are psychotherapy notes. Notes you took during supervision about clinical decisions (diagnosis change, medication adjustment, treatment plan revision) belong in the progress note.

4. Letting psychotherapy notes drift toward facts. “Client’s husband called this week and said she’s been drinking again” is a fact about treatment, not your reflection. It belongs in the progress note. Reflective journaling about how the call affected you is the psychotherapy note.

5. Quoting psychotherapy notes in disclosed records. If you summarize themes from your private notes into a records release, you’ve effectively disclosed them. Summarize from the progress note instead, or get specific authorization for the psychotherapy notes.

Quick reference: similarities and key differences

What the two have in common:

• Both contain PHI and must be kept confidential
• Both must be stored securely
• Both can inform your clinical thinking

What’s different (psychotherapy notes only):

• Not part of the official medical record
• Extra HIPAA protection (separate authorization required to disclose)
• Excludes diagnosis, treatment plan, medication, modalities, test results, prognosis, symptom and progress summaries
• For the clinician’s benefit only
• Not subject to routine insurance audits
• Clients generally cannot access them
• Must be physically or digitally separated from the chart
• Not required to be kept
• No required format

What’s different (progress notes only):

• Official part of the client’s record
• Document what occurred in the session
• Required for billing and clinical continuity
• Can be audited by insurance
• Clients have the right to access them
• Use standardized formats (SOAP, DAP, BIRP, etc.)
• Include diagnosis, treatment plan, modalities, and progress

Frequently asked questions

References

• U.S. Department of Health and Human Services, HIPAA Privacy Rule: 45 CFR § 164.501 (definition of psychotherapy notes).
• Office for Civil Rights (HHS): Does HIPAA Provide Extra Protections for Mental Health Information compared with Other Health Information?
• American Psychological Association, Record Keeping Guidelines (retention standards for adult and minor records).

Disclaimer: All examples of clinical documentation are fictional and for educational purposes only. This article does not constitute legal advice. State laws vary and may impose stricter requirements than federal law. Consult your licensing board or attorney for state-specific guidance.

Ready to start your free trial?

15 free notes for 14 days • No credit card required

Try for FREE View Pricing

Why other mental health professionals love Mentalyc

“By the end of the day, usually by the end of the session, I have my documentation done. I have a thorough, comprehensive note … It’s just saving me hours every week.”

“It’s so quick and easy to do notes now … I used to stay late two hours to finish my notes. Now it’s a breeze.”

“It takes me less than 5 minutes to complete notes … it’s a huge time saver, a huge stress reliever.”

“A lot of my clients love the functionality where I can send them a summary of what we addressed during the session, and they find it very helpful and enlightening.”