SESK: Stuff Everyone Should Know · sesk.info/hipaa-auth-psychotherapy-notes
What does a covered entity generally need before disclosing a patient's psychotherapy notes?
The patient's authorization.
- Just another doctor's request
- The patient's written authorization ✔
- Nothing, they're part of treatment
Why: Psychotherapy notes get extra protection: almost any use or disclosure needs the patient's authorization. Narrow exceptions include the note writer using them for treatment.
Huh, didn't know that: Psychotherapy notes are also left out of a patient's HIPAA right of access.
I'd tell you a joke about paper, but it's tearable.
Like this card?
References
Answer: The patient's written authorization. Psychotherapy notes get extra protection: almost any use or disclosure needs the patient's authorization. Narrow exceptions include the note writer using them for treatment.
- 45 CFR 164.508 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes
Checked 2026-10-10. - 45 CFR 164.508 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
Use by the originator of the psychotherapy notes for treatment
Checked 2026-10-10. - 45 CFR 164.524 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524
except for: (i) Psychotherapy notes
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Work SkillsWhich of these is NOT part of a patient's psychotherapy notes under HIPAA?Work SkillsA drug company pays a clinic to mail its patients ads for a new product. What does the clinic need?Work SkillsIs a pharmacy's refill reminder about a drug a patient is currently prescribed considered marketing under HIPAA?
That's stuff everyone should know.