AhaBulb: Stuff Everyone Should Know · ahabulb.com/hipaa-auth-psychotherapy-notes
What does a covered entity generally need before disclosing a patient's psychotherapy notes?
The patient's authorization.
- Just another doctor's request
- The patient's written authorization ✔
- Nothing, they're part of treatment
Why: Psychotherapy notes get extra protection: almost any use or disclosure needs the patient's authorization. Narrow exceptions include the note writer using them for treatment.
Huh, didn't know that: Psychotherapy notes are also left out of a patient's HIPAA right of access.
I'd tell you a joke about paper, but it's tearable.
Like this card?
References
Answer: The patient's written authorization. Psychotherapy notes get extra protection: almost any use or disclosure needs the patient's authorization. Narrow exceptions include the note writer using them for treatment.
- 45 CFR 164.508 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes
Checked 2026-10-11. - 45 CFR 164.508 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
Use by the originator of the psychotherapy notes for treatment
Checked 2026-10-11. - 45 CFR 164.524 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524
except for: ( i ) Psychotherapy notes
Checked 2026-10-11.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Healthcare Privacy (HIPAA)Does a hospital need a patient's signed authorization to use PHI for treatment, payment or health care operations?Healthcare Privacy (HIPAA)Which of these is NOT part of a patient's psychotherapy notes under HIPAA?Healthcare Privacy (HIPAA)A drug company pays a clinic to mail its patients ads for a new product. What does the clinic need?
That's stuff everyone should know.