Psychotherapy notes are treated exactly the same as other health care information.

How to Maintain HIPAA Compliant Psychotherapy Notes

HIPAA compliance is a topic that is always on a therapist’s mind–after all, it impacts almost every aspect of running a private practice. Not only is HIPAA important for protecting clients’ rights, but it also grants therapists powerful protections as well. The most common questions we get here at TheraNest, often have to do with HIPAA compliance–especially as it pertains to psychotherapy note-taking. In this post, we’re discussing the HIPAA privacy rule and how it applies to your notes, including both progress and psychotherapy (or process) notes. 

We’ll be answering questions like:

• How does HIPAA impact my psychotherapy notes?
• Can my psychotherapy notes be subpoenaed?
• Are therapy note-taking apps HIPAA complaint?
• Can my clients see the psychotherapy notes I take on their case?
• Is TheraNest HIPAA complaint?

Plus many more. This information will help you achieve a note-taking system that will work for you and your practice, while also being HIPAA compliant.

As defined by HIPAA, psychotherapy notes are records created by a mental health professional. Psychotherapy notes contain any of the following:

• Documentation of what was discussed during a private counseling session
• Documentation of what was discussed during a group, joint, or family counseling session
• Analysis of a conversation during one of the above such sessions

Your psychotherapy notes may contain your observations after a session or particular questions you’d like to explore in your next therapy session. However, psychotherapy notes do not contain:

• A prescription for medication
• Monitoring of a medication
• A recording of when you start and stop the counseling session
• The modality of a treatment
• The frequency of a treatment
• Results from any clinical test
• Or a summary of the following:
  • Diagnosis
  • Functional status
  • Prognosis
  • Progress to date
  • Symptoms
  • The treatment plan

If you’ve been in mental health for a while, you may recognize psychotherapy notes by another name, either as process or private notes. Process and private notes are defined in exactly the same way as psychotherapy notes, as detailed above. Psychotherapy notes must always be kept separate from a client’s record. This way, you are able to hand over essential client records to a third party payer without compromising on privacy for either you or your client. Carefully separating your psychotherapy from your progress notes also protects your private records from being passed on accidentally to a third party without the express consent of your client. When it comes to documenting your psychotherapy notes, you can choose whichever method is convenient for you. You may choose to handwrite your notes, speak your notes to a recorder, or store them securely on a HIPAA compliant note-taking app like TheraNest.

How are Psychotherapy Notes Different from Progress Notes?

Progress notes are basic records that include the assessment, diagnosis, and treatment plan. Progress notes can be structured following the SOAP format: Subjective, Objective, Assessment and Plan. However, progress notes can be unstructured, too. Progress notes will contain information not included in your psychotherapy notes, such as medication prescription, the type of treatment, and how frequently this treatment is administered. Progress notes will also contain symptoms and progress. Think of a progress note as a shareable record that’s accessible to clients, upon their request, and to an invested third party, such as an insurance provider. While psychotherapy notes are protected by HIPAA, progress notes are not. Progress notes can be released to a third party either without explicit consent from the client or after the client signs a generalized consent form. In fact, many insurance companies may ask to see progress notes to approve services and provide payments. Psychotherapy notes, however, require a separate and specific inquiry, and their access can be restricted from everyone. This restriction extends even to your client.

What is HIPAA?

HIPAA is short for Health Insurance Portability and Accountability Act of 1996. This privacy act protects and prohibits access to a client’s personal record by another party (this can at times even include the client themselves). It’s important to remember that state law takes precedence over HIPAA. Your state may offer even more privacy protection of your psychotherapy notes, so it is always important to stay in the know about state regulation.

What Role Does HIPAA Play in Your Psychotherapy Note Taking?

Unlike process or private notes of the past, psychotherapy notes enjoy greater protection under HIPAA. Your private psychotherapy notes can remain just that– private. Before HIPAA, third-party payers could demand an entire client record, including your private notes or analyses. Then, upon reading your private notes, the payer could determine whether or not to cover a certain service or procedure. Of course, the client could also refuse to give access to their insurance provider, but that was often met with backlash. Insurance companies would refuse to cover a service when not given unfettered access to the entire client record, including your private notes. Fortunately, HIPAA’s privacy provisions put an end to this. HIPAA protects and empowers mental health professionals as well. Privacy rights do not only belong to the client, but also to mental health providers. In many states (but not all), you can choose whether or not to release your private psychotherapy notes to your clients upon their request. While HIPAA’s privacy provisions can protect your private notes from undue scrutiny, there are times when you may be required by law to turn over your psychotherapy notes. Here are the reasons for compulsory compliance:

• A warrant issued by a court
• A subpoena issued by a judicial officer
• A subpoena issued by a grand jury
• A summons issued by a judicial officer
• An administrative subpoena or summons requested from a government agency
• Civil or authorized investigative demand requested from a government agency
• Any other similar process authorized by law

Though your private psychotherapy notes can be subpoenaed, all administrative requests for such notes must be narrow in scope and relevant to the law enforcement inquiry. They also cannot reveal the client’s identity and the agency is prohibited from reasonably using de-identified data about the client. The reason for this compulsory compliance is to immediately aid in saving someone’s life. For more information on how government agencies can access your private psychotherapy notes, take a look at this informative post by Psyche Central.

Are Your Psychotherapy Notes HIPAA Compliant?

Now to take a look at the real question: are your psychotherapy notes HIPAA compliant? For your psychotherapy notes to be HIPAA compliant, they must abide by all of the rules outlined in this post. Most importantly, to take advantage of the protections HIPAA offers you and your clients, you have to ensure that your psychotherapy notes are separate from your progress notes. Additionally, you also have to make sure all your notes are in a secure location and are accessible to only you. Certain practice management software programs can take the stress of security off your plate. TheraNest is a HIPAA compliant note-taking application, that also helps you manage your practice. TheraNest’s software stores your progress notes and psychotherapy notes separately, allowing you to easily comply with the HIPAA privacy rule. There’s no need to shuffle through handwritten notes that could be accessed by an unauthorized third party. Along with offering you peace of mind, TheraNest also centralizes your practice and allows you to handle all private practice-related tasks in one HIPAA compliant software. You can take therapy notes, bill insurance companies, accept credit card payments, and schedule appointments in one easy to use application. Start a free 21-day trial of TheraNest’s HIPAA compliant therapy note software, and leave the worry of HIPAA security breaches in the past.

Which of the following is considered part of a designated record set select all that apply?

What safeguard limits access to location where PHI is kept and maintained?

Which of the following are true statements about limited data sets?

What is the Hipaa officer quizlet?