Do Patients Have Access to Therapy or Personal Notes?

The Privacy Rule under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) was created to provide standards for protecting the confidentiality of patients' individually identifiable health information. While the Privacy Rule gives patients a right to access their medical records, it permits psychiatrists who are covered by HIPAA to deny patients access to strictly defined psychotherapy notes. It's important to note, however, that under HIPAA psychiatrists are obligated to release these same notes to a third party if the patient requests that this be done. Moreover, laws in some states may allow patients firsthand access to those same psychotherapy notes, and such state laws continue to apply, notwithstanding HIPAA.

Many Fine Points to Consider

HIPAA's Privacy Rule permits covered psychiatrists who choose to keep psychotherapy notes to deny patients access to those notes. The Privacy Rule definition of psychotherapy notes is “notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's record.”

The following information is considered part of the medical record and is excluded from the definition of psychotherapy notes: medication prescribing and monitoring; counseling session start and stop times; modalities and frequencies of treatment furnished; results of clinical tests; and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date. According to the Department of Health and Human Services (HHS), the agency that enforces the Privacy Rule, psychotherapy notes are limited to information that psychiatrists keep separate for their own purpose and that contains sensitive information relevant to no one else. HHS equates psychotherapy notes with process notes.

It is important to keep in mind, however, that although the Privacy Rule allows psychiatrists to deny patients access to psychotherapy notes, it also states that patients may authorize the release of their psychotherapy notes to a third party such as an attorney, another provider, or even a friend, and that psychiatrists must comply with this authorization.

State laws differ regarding patient access to their medical records. In some states, patients have access to the entire record; other states prevent patients from accessing therapists' “personal notes” (or similar term). Additionally, some state laws may have other requirements for restrictions on the use and disclosure of these “personal notes.”

The issue of which law to follow (state or federal) will ultimately be determined by the courts. Until this issue has been resolved, the following provides a starting point for analyzing questions about patient access to psychotherapy notes. Because this is a complex and developing area of the law, an attorney should be consulted for specific legal advice.

Patients may be entitled to access psychotherapy notes as defined by the Privacy Rule and/or personal notes (or similar term) as defined under state law

The legal concept of preemption basically means that the federal Privacy Rule preempts (trumps) a contrary state law and must be followed, unless the state law is “more stringent.” More stringent state laws have been defined to include those that grant patients greater rights of access to the record. So, state laws granting greater rights of access to records (including psychotherapy notes, as defined by the Privacy Rule), will not be preempted and are to be followed.

In other words, if state law does not deny patients access to the notes, state law provides greater rights of access to the patient, and state law will apply. This is true even if a psychiatrist covered by HIPAA keeps separate psychotherapy notes that fit the Privacy Rule's definition, because patients have access to those notes under state law, regardless of the Privacy Rule's restrictions.

In contrast, if state law does deny or restrict patients from accessing personal notes, but those notes do not fit the Privacy Rule's definition of psychotherapy notes (that is, the notes are not kept separate from the rest of the medical record or the notes are kept separate but contain information relevant to other providers), then the Privacy Rule's provision requiring release of the entire record to the patient applies. That is, the exception under the Privacy Rule whereby patients may be denied access to their psychotherapy notes does not apply because the notes are not“ psychotherapy notes” as defined by the Privacy Rule. State law restricting patients from accessing notes does not apply because the Privacy Rule's provisions provide greater rights of access for the patient. However, if the personal notes do fit the definition of psychotherapy notes under the Privacy Rule, then patient access to the notes can be denied, since the state and federal laws are consistent in terms of restricting patient access.

Practical Guidance Offered

When trying to navigate this complicated issue, psychiatrists may find the following series of questions useful in determining what records patients are entitled to access.

1. Are you covered under (required to comply with) HIPAA's Privacy Rule?

IfNO—Follow state law. Do not continue to subsequent questions, but proceed to“ cautionary note” below.

IfYES—The Privacy Rule applies unless state law is “more stringent” than the Privacy Rule. “More stringent” is defined to include giving patients greater rights of access to their record. Follow the law giving greatest rights to patients. Proceed to Question 2.


2. Does your state law have a provision for denying patient access to“ personal notes” (or a similar term)?

IfNO—Follow state law. Patients have access to their entire record, including psychotherapy notes as defined by the Privacy Rule. State law is more stringent because it provides patients greater rights of access than the Privacy Rule and thus is not preempted by the Privacy Rule. Do not continue to subsequent questions, but proceed to “cautionary note” below.

IfYES—Continue to Question 3.


3. Do your personal notes fit the Privacy Rule's definition of“ psychotherapy notes”?

IfNO—For example, if you keep process notes that are of value to no one else, but they are not kept separate from the rest of the record, or the notes contain information that would be of value to subsequent treaters, follow the Privacy Rule. Patients have the right to access the notes, regardless of state law. The Privacy Rule restricts patient access only to psychotherapy notes. Proceed to “cautionary note” below.

IfYES—Follow the Privacy Rule. Patients do not have the right to access the notes. Proceed to “cautionary note” below.

Cautionary note

One thing is clear, and has been clear even prior to HIPAA, for both covered and noncovered psychiatrists: there is no such thing as absolute confidentiality. Notes may not be protected from discovery, regardless of what state law says. Even notes protected under the HIPAA Privacy Rule and under state law may have to be released pursuant to a court order.

Example - New York

Under New York law, “personal notes and observations” (defined as “a practitioner's speculations, impressions [other than tentative or actual diagnosis] and reminders...”) are excluded from “patient information,” which must be released to patients and others.

For covered providers practicing in New York who have chosen to keep“ personal notes,” do patients have the right to access these notes?

With reference to the three questions at left, the issue for New York HIPAA-covered providers with “personal notes” is whether the“ personal notes” fit the definition of “psychotherapy notes” under the Privacy Rule (including being kept separate from the rest of the record).

IfNO—For example, if you keep process notes that are of no value to anyone else, but they are not kept separate from the rest of the record, or the notes contain information that would be of value to subsequent treaters, then follow the Privacy Rule's provision granting patients the right to access their entire record. Since the personal notes do not fit the definition of psychotherapy notes, access to the personal notes cannot be denied.

IfYES—Follow the Privacy Rule's provision allowing denial of patient access to psychotherapy notes, but remember that patients may be able to authorize the release of psychotherapy notes to others, and psychotherapy notes may be discoverable in litigation.

In Other Words...

The Privacy Rule allows covered psychiatrists to deny patient access to psychotherapy notes (as defined by the Privacy Rule). But if state law allows patients to access the entire record, state law is not preempted, so patients have the right to access psychotherapy notes.

State law denying patient access to personal notes (or a similar term) is preempted by the Privacy Rule, because the Privacy Rule does not restrict access to “personal notes” (unless personal notes fit the Privacy Rule's definition of psychotherapy notes). The Privacy Rule is to be followed, and patients have the right to access personal notes, unless the personal notes fit the Privacy Rule's definition of psychotherapy notes.

For personal notes that patients cannot access under state law and that fit the Privacy Rule's definition of psychotherapy notes, patients cannot access the notes under both state law and the Privacy Rule. But patients may be able to authorize the release of psychotherapy notes under the Privacy Rule, and a court could always order the release of the notes.

If you have any questions about the information, call your malpractice carrier or Ellen Jaffe in APA's Office of Healthcare Systems and Financing at (800) 343-4671. ▪