HIPAA-Compliant Therapy Notes: Rules, Storage and Tools

• Progress notes are part of the client’s record, and they can be shared for treatment and payment without a signature. Clients can get a copy within 30 days. Psychotherapy notes filed separately from the chart need the client’s authorization for almost any disclosure and are outside the right of access.
• HIPAA sets no retention period for notes. State rules do, such as seven years from discharge for California psychologists and six years for New York’s licensed professions.
• Stored notes need safeguards and a business associate agreement with any vendor holding them. HHS targets July 2027 to finalize the proposed Security Rule update that would require encryption.

HIPAA’s Privacy Rule protects everything a therapist records about a client, and its Security Rule adds technical requirements for electronic records. Psychotherapy notes, a clinician’s private notes on what was said in session, get stronger protection than the rest of the chart. SimplePractice, an EHR for private practice clinicians, stores them apart from progress notes and signs a business associate agreement with every account. A note only gets the stronger protection when its content fits the federal definition and it is filed separately.

This article is general information about federal rules, not legal advice. State law, your licensing board and a compliance attorney decide the specifics for your practice.

Try SimplePractice free, with 50% off 4 months if you upgrade within 7 days

ChoosingTherapy.com may earn a commission from the companies whose services are linked on this page.

How HIPAA separates psychotherapy notes from progress notes

HIPAA gives psychotherapy notes extra protection over the rest of the record.¹ 45 CFR 164.501 defines them as a mental health professional’s notes, in any medium, documenting or analyzing what was said in a counseling session. To qualify, they must be stored outside the main chart.²

Section 164.501 also states that content stays in the chart wherever it is typed. This clause covers medication prescribing and monitoring, when sessions start and stop, modalities and their frequency, and test results. Summaries of diagnosis, functional status, symptoms, treatment plan, prognosis and progress stay there too. Every SOAP, DAP or BIRP note is therefore chart content. Our guides to SOAP notes for therapy and the therapy progress notes cheat sheet cover what to write in them.

Psychotherapy notes keep the extra protection only when they are filed separately. CMS’s Program Integrity Manual says chart content filed in the same document as psychotherapy notes still counts as chart content.³ The American Psychiatric Association recommends a separate EHR section, a separate physical file, or both.

Sharing notes: authorization and the minimum necessary rule

Progress notes can go to an insurer without the client’s signature. Psychotherapy notes need written authorization for almost any disclosure.

Disclosures that need an authorization

Progress notes can be used and disclosed without the client’s signature for treatment, payment and health care operations (45 CFR 164.506). Claim documentation reaches insurers through this path. Psychotherapy notes need a written authorization for almost any use or disclosure under 164.508(a)(2), even to another treating provider.⁴ The few exceptions include the author’s own treatment use, disclosures required by law like abuse reporting, and preventing a serious and imminent threat.

A psychotherapy-note authorization can’t be bundled into a general release form, and a health plan can’t make enrollment depend on one.² CMS bars its Medicare review contractors from asking for psychotherapy notes. The provider must instead send other records that prove medical necessity, and claims without that proof are denied.³

How much of the record to send

The minimum necessary standard in 45 CFR 164.502(b) limits each use, disclosure or request to the information needed for its purpose.⁵ The standard covers payment, so an insurer gets what the claim needs. The standard doesn’t apply to treatment disclosures between providers, disclosures to the client or disclosures under an authorization. HHS does not set a note length. Clinicians in professional forums keep progress notes brief on purpose, since chart detail can reach insurers and courts.

Can clients see their therapy notes?

Clients can see and copy their progress notes and the rest of their designated record set under 45 CFR 164.524. HIPAA does not give patients the right to access psychotherapy notes, and a practice can deny a request for them without the usual review.⁶ A practice has 30 days to respond, plus one 30-day extension if it explains the delay in writing first. Fees are limited to reasonable copying, supply and postage costs.

OCR enforces the access deadlines against mental health practices. Counselor David Mente, LPC, paid $15,000 in 2023 after refusing a father access to his children’s records. Rio Hondo Community Mental Health Center paid a $100,000 penalty announced in November 2024.⁷ OCR announced a $50,000 access settlement with Azul Vision on August 27, 2026.⁷

How long to keep therapy notes

The Privacy Rule has no medical record retention requirement, and HHS points to state law for how long to keep charts. HIPAA’s safeguards still apply through disposal.⁸ Its six-year requirement in 45 CFR 164.530(j) covers written policies, procedures and other compliance records.⁵

Retention rules differ by state and profession. These three were verified in September and October 2026:

• California psychologists: seven years after discharge, and for a minor, seven years after the client turns 18 (Business and Professions Code 2919, in force since 2007).
• Texas licensed professional counselors: seven years from the end of services, or five years after the client reaches the age of majority, whichever is longer (22 Tex. Admin. Code 681.36, adopted September 2023).
• New York’s licensed professions, including psychology, social work and counseling: six years, and for minors until at least one year after the client turns 21 (8 NYCRR 29.2).⁹

Before leaving a vendor, check its export window. SimplePractice gives a closing account about 60 days to export records, then de-identifies all PHI so it can’t be recovered.

Storage, encryption and business associate agreements

The Privacy Rule requires administrative, technical and physical safeguards for health information in any form, paper included, under 45 CFR 164.530(c).⁵ Electronic notes also need a Security Rule risk analysis.

Encryption and paper records

Encryption is an “addressable” safeguard under 45 CFR 164.312 today. Per HHS, a practice uses an addressable safeguard where reasonable, or documents why not and adopts an equivalent measure. HHS treats properly encrypted information as secured under the breach notification rules if the key is stored apart and uncompromised.¹⁰ OCR has settled for $3 million over unencrypted mobile devices (2019) and $1,040,000 with Lifespan over a stolen unencrypted laptop (2020).⁷

Paper notes need the Privacy Rule safeguards in 164.530(c), and paper psychotherapy notes stay protected when filed on their own. HHS counts paper as secured once it is shredded or destroyed beyond reconstruction, and redaction doesn’t count.¹⁰

Business associate agreements

A business associate is any vendor that creates, receives, maintains or transmits client information for you. Each one needs a business associate agreement (BAA). HHS’s cloud guidance says this holds even when the vendor stores only encrypted data it can’t read. A practice violates HIPAA if it stores records with a cloud service that hasn’t signed a BAA.¹¹

AI scribes and session recordings

HIPAA covers health information recorded in any form or medium, so session audio and AI transcripts are protected. HHS’s guidance treats a company whose app transcribes sessions for a provider as a business associate. State law governs consent to record. California and Washington bar recording a confidential or private conversation without every party’s consent. In Illinois, clinicians must give written notice and get client consent before using AI on recorded or transcribed sessions. The law took effect August 1, 2025. Our AI notes for therapists roundup compares tools.

SimplePractice’s Note Taker deletes session audio as soon as it has generated the transcript. The transcript is erased at sign-and-lock or after 7 days, whichever is sooner. Since June 17, 2026, clinicians who switch Note Taker on are opted in to transcript retention by default. SimplePractice keeps a de-identified copy to improve the product. Earlier users stay opted out by default, and retention can be switched off per clinician, client or session. Therapist forums criticized the new default from June to August 2026.

Status of the proposed HIPAA Security Rule update

HHS proposed a Security Rule overhaul on December 27, 2024, and published it on January 6, 2025.1112 The proposal would make every implementation specification required, with limited exceptions. It would add rules such as encryption at rest and in transit, multi-factor authentication and a yearly compliance audit. It would also add vulnerability scans every six months and recovery of certain systems within 72 hours.

As of October 18, 2026, HHS has published no final Security Rule update. The Unified Agenda lists final action for July 2027, moved from May 2026.⁴ The current Security Rule stays in effect meanwhile.¹² HHS also hasn’t finalized a 2021 Privacy Rule proposal to cut the access deadline to 15 days.

Best therapy notes software for HIPAA compliance

SimplePractice, Jane, TherapyNotes and Healthie all sign a BAA with practices.

Checked on vendor sites, September to October 2026.

SimplePractice’s BAA takes effect when you open the account, trial included. Its HIPAA Audit Log shows when a team member viewed, printed or downloaded client information. Unlocking a signed progress note requires a typed reason that goes into the activity log. Psychotherapy notes come on Starter, Essential and Plus ($49, $79 and $99 a month).

Our SimplePractice review and SimplePractice vs TherapyNotes comparison go into more detail.

Start a SimplePractice free trial

When SimplePractice is not the right fit

Other EHRs suit some practices better than SimplePractice:

• Psychotherapy notes hidden from staff: Jane shows each one only to its author and leaves it out of chart exports. This comes on all plans with no add-on, up to 5,000 characters per note.
• Long process notes: TherapyNotes gives psychotherapy notes an unlimited blank field and warns before a chart download includes one.
• SOC 2 and HITRUST R2 certification: Healthie lists both on its HIPAA page. We found no Healthie help article on a separate psychotherapy notes area, so ask how it stores them before moving yours.
• AI notes with no copy kept by the vendor: opt out of SimplePractice’s retention, or run Upheal beside your EHR. See our Upheal review for its privacy and AI-training settings. Upheal deletes recordings by default and includes a BAA on its free plan.

Our list of SimplePractice alternatives compares more options.

See SimplePractice’s plans and HIPAA features