Sign Up
Login
Try for Free
Login
A psychotherapy notes authorization is the standalone HIPAA authorization required before a practice may use or disclose psychotherapy notes, the private process notes a clinician keeps separate from the medical record. Under 45 CFR 164.508(a)(2) it cannot be combined with any other release. Records staff and clinicians use it whenever a third party requests these notes. Most forms run one page.
Records staff or the treating clinician; signed by the client
Client, requesting third party, privacy officer, auditors
One page, 300 to 500 words · 5 to 10 minutes by hand (clinical team estimate)
Consent and privacy form (compare: release of information, Part 2 consent)
Whenever anyone asks a practice to use or disclose psychotherapy notes
Required by law when psychotherapy notes are released (45 CFR 164.508); the elements are mandated, the layout is not
A psychotherapy notes authorization is the written permission HIPAA requires before a practice may use or disclose psychotherapy notes. The underlying category comes from the Privacy Rule, published December 28, 2000: 45 CFR 164.501 defines psychotherapy notes as a mental health professional's notes documenting or analyzing conversation during a session, kept separate from the rest of the medical record. Clinicians usually call them process notes. HHS created the category to shield a therapist's private working impressions, material other providers do not need for treatment, and the shield only applies while the notes stay separated. You may also see the form called a psychotherapy notes release or an authorization for release of psychotherapy notes.
The distinction that matters: your regular session documentation is a progress note. It lives in the medical record, payers can request it, and a standard release of information covers it. Psychotherapy notes are different by definition and by handling. They exist only if you choose to keep them, and 45 CFR 164.508(a)(2) requires this dedicated authorization before they leave the practice, even for requests that would otherwise count as routine treatment, payment, or operations. The regulation states this form "may only be combined with another authorization for a use or disclosure of psychotherapy notes" (45 CFR 164.508(b)(3)(ii)), so it always stands alone. If a request covers anything else, use two forms. The psychotherapy progress note page covers the record-set side of the boundary.
Solo therapists, group practices, and health-system records departments all reach for this form in the same situation: someone wants psychotherapy notes to leave the practice. Common triggers include a client asking you to share process notes with a new therapist, an attorney requesting a complete record, or a personal representative gathering records. Use it only when actual psychotherapy notes exist and are truly what is being requested. Most requests that say "send the therapy notes" are satisfied by progress notes under a standard release of information, and the most compliant response is often to release the record-set documents and leave the psychotherapy notes where they are. The progress note and SOAP note pages cover what belongs in the shareable record.
No official government form exists. HIPAA mandates the content, not the layout: the core elements of 45 CFR 164.508(c), three required statements, and a signature. A one-page form covers all of it:
Each element in more detail, with the pitfall that most often invalidates it:
Client and practice identification. Full client name and date of birth, plus the practice or clinician holding the notes. Pitfall: listing multiple providers or an entire health system as the source; the form should match the originator who actually keeps the notes.
Description of the information. Name psychotherapy notes explicitly and bound them, for example "psychotherapy notes from sessions between January and June 2026." Pitfall: writing "all records" or "mental health records"; a description that does not specifically identify psychotherapy notes does not authorize their release.
Who may disclose. The person or class authorized to release the notes: usually the treating clinician or the records custodian. Pitfall: leaving it blank because it feels obvious; it is a core element, and a missing core element makes the authorization invalid.
Who may receive. The specific recipient: a named clinician, practice, or attorney. Pitfall: catch-alls like "any treating provider"; recipients that vague invite over-disclosure and get forms bounced by privacy officers.
Purpose. State why the notes are being released. When the client initiates the request, HIPAA accepts "at the request of the individual" as sufficient. Pitfall: over-explaining; the purpose line is an administrative statement, not a place for clinical detail.
Expiration. A date or an event, such as "90 days from signing" or "upon completion of the records transfer." Pitfall: writing "none" or leaving it blank; an authorization without an expiration date or event is defective on its face.
Required statements. Three notices the regulation requires on the form: the client may revoke in writing (with the procedure for doing it), treatment and payment cannot be conditioned on signing, and disclosed notes may be redisclosed by the recipient and lose federal protection. Pitfall: reusing a general release's statement block that omits the revocation procedure; a missing statement invalidates the whole form.
Signature and date. The client signs and dates the form; a personal representative also records their authority, such as parent of a minor or healthcare power of attorney. Pitfall: accepting a representative's signature without documenting the authority; note it on the form or attach it.
AUTHORIZATION FOR RELEASE OF PSYCHOTHERAPY NOTES (Standalone form. May not be combined with any other authorization.) Client name: DOB: Practice / clinician holding the notes: Information to be released: Psychotherapy notes kept by the clinician named above, from sessions between ____ and ____ May be disclosed by: May be released to (name, organization, contact): Purpose: [ ] At the request of the individual [ ] Other: This authorization expires (date or event): I understand that: (1) I may revoke this authorization in writing at any time, except where the practice has already acted on it; the revocation procedure is: ____________ (2) Treatment, payment, enrollment, or eligibility for benefits may not be conditioned on signing this form. (3) Notes disclosed under this authorization may be redisclosed by the recipient and may no longer be protected by federal privacy law. Client signature: Date: Personal representative and authority (if applicable):
Free to use and share, no signup. The PDF includes a one-page cheat sheet with element-by-element pitfalls and a pre-release checklist; the DOCX is the blank form, ready to adapt.
Scenario: an adult client relocating to another city asks their psychologist to share psychotherapy notes with the new treating psychologist. All details are fictional.
AUTHORIZATION FOR RELEASE OF PSYCHOTHERAPY NOTES · Standalone form; not combined with any other authorization
Client: R.L. · DOB: 04/12/1991
Practice holding the notes: M. Okafor, PsyD, Lakeside Psychology, Austin, TX
Information to be released: Psychotherapy notes kept by Dr. Okafor from individual sessions between 01/14/2026 and 06/30/2026. No other records are covered by this authorization.
May be disclosed by: M. Okafor, PsyD
May be released to: S. Patel, PhD, Cedar Counseling Group, Denver, CO
Purpose: Continuity of care, at the request of the individual
Expires: Upon completion of the records transfer or 90 days from signing, whichever comes first
I understand that: (1) I may revoke this authorization in writing at any time, except where Lakeside Psychology has already acted on it, using the practice's written revocation procedure. (2) My treatment, payment, enrollment, or eligibility for benefits cannot be conditioned on signing this form. (3) Notes disclosed under this authorization may be redisclosed by the recipient and may no longer be protected by federal privacy law.
Client signature: R.L. · Date: 07/09/2026
Personal representative and authority: Not applicable
This sample is fictional and for educational purposes. It does not describe a real client or practice.
Writing these after every session? BastionGPT drafts complete notes from bullets, dictation, or a transcript.
Generate a note from bulletsPsychotherapy notes sit outside the designated record set. Clients have no HIPAA right of access to them (45 CFR 164.524), and payment reviews run on the record set, not on process notes. That protection depends on real separation: keep them physically or electronically apart from the chart, and keep diagnosis, medications, session times, test results, and treatment-plan content out of them, because material in those categories is record-set content no matter where you write it. Mixed notes lose the shield. If what you keep is really a working conceptualization that informs treatment, the case formulation page covers the record-set way to hold it.
The authorization itself is paperwork with teeth. HIPAA prohibits conditioning treatment, payment, enrollment, or eligibility on signing one (45 CFR 164.508(b)(4)). Honor written revocations, and keep every signed form: HIPAA's documentation rule (45 CFR 164.530(j)) requires retaining authorizations for six years. Requests that arrive as subpoenas deserve special care: a records subpoena is not a court order, and psychotherapist-patient privilege may apply. Consult your attorney or licensing board before responding; state rules vary. If you or a client needs immediate support: call or text 988 (US), 9-8-8 (Canada), or Lifeline 13 11 14 (Australia).
OCR has published no enforcement action aimed specifically at psychotherapy notes authorizations, and no national statistics exist on how often these requests fail. That absence is itself useful: the failures that surface in privacy-office reviews and records disputes are element failures, defects in the form rather than exotic legal questions. The BastionGPT Clinical Advisory Board sees the same errors most often in psychotherapy notes authorization reviews:
| Aspect | United States | Canada | Australia |
|---|---|---|---|
| Status | Required by law: 45 CFR 164.508(a)(2) mandates a standalone authorization before psychotherapy notes are used or disclosed | No equivalent category; consent for any health record follows PIPEDA and provincial acts such as Ontario's PHIPA | No equivalent category; the Privacy Act 1988 treats all health information as sensitive and the APPs govern release |
| Terminology | Psychotherapy notes, process notes | Process notes, part of the clinical record | Process notes, part of the health record |
| What changes | Notes sit outside the record set; clients have no HIPAA right of access | Clients generally have a right of access to the full record, including therapist notes, subject to limited exceptions | APP 12 gives clients access to their health information, with harm-based exceptions |
| Retention | Keep the signed authorization 6 years (45 CFR 164.530(j)); the notes themselves follow state record rules | Provincial rules; Ontario's CRPO expects 10+ years from the last interaction | State rules; NSW requires 7 years for adults and until age 25 for minors |
The US concept does not travel. In Canada and Australia the same private notes are usually just part of the health record: clients can typically access them, and the paperwork is the standard consent. The separate-authorization workflow on this page is a US legal requirement first, and a useful discipline anywhere.
BastionGPT is specifically trained, tuned, and clinically tested on psychotherapy notes authorizations.
See how clinicians use it day to day on the AI therapy notes page.
Many BastionGPT users report saving more than 90 minutes per day on documentation.
HIPAA-compliant with a signed BAA on every plan. Your data is never used to train models. BastionGPT drafts, you review and sign.
No. A standard release covers the designated record set: progress notes, treatment plans, test results, billing records. A psychotherapy notes authorization covers only the private process notes a clinician keeps separate from that record, and HIPAA requires it to stand alone. If a request covers both, use two forms. The psychotherapy progress note page covers the record-set side.
HIPAA gives clients no right of access to psychotherapy notes: 45 CFR 164.524 excludes them from the access right that covers the rest of the record. A clinician may still choose to share them, and some state laws grant more access than HIPAA does, so check your state before refusing. Most requests for "my records" are satisfied by the record set.
No. The regulation allows a psychotherapy notes authorization to be combined only with another psychotherapy notes authorization (45 CFR 164.508(b)(3)(ii)). A combined form is invalid for the notes, even when it works for everything else it covers.
No. Payment and audit reviews run on the record set, and HIPAA prohibits conditioning treatment, payment, enrollment, or eligibility on signing a psychotherapy notes authorization (45 CFR 164.508(b)(4)). When a payer asks for "therapy notes," send progress notes under the appropriate release. The progress note page covers what payers actually review.
Only in the narrow cases listed in 45 CFR 164.508(a)(2): use by the clinician who wrote them for treatment, supervised training inside the practice, the practice defending itself in an action brought by the client, HHS enforcement, disclosures required by law such as mandatory abuse reporting, health oversight of the clinician who wrote them, coroners and medical examiners, and a serious and imminent threat. Everything else needs the signed form.
Usually not. A records subpoena is not a court order, and psychotherapist-patient privilege, recognized in federal courts since Jaffee v. Redmond (1996), may apply on top of HIPAA. Route any subpoena for psychotherapy notes to your attorney before responding; state procedures vary.
No. No law requires creating or keeping them. HIPAA only defines the protection they receive if you choose to keep them. Many clinicians document fully in progress notes and keep no separate process notes, which also means there is nothing extra to fight over in a records dispute.
Six years. HIPAA's documentation rule (45 CFR 164.530(j)) covers authorizations along with other required paperwork. Retention for the psychotherapy notes themselves is a separate question governed by your state's record rules and your board's standards.
Yes. Paste the form and the request, and it checks the required elements, flags a combined or expired form, and drafts the response letter. BastionGPT is HIPAA-compliant with a signed BAA on every plan, and your data is never used to train models.
The compliance claims on this page trace to these authorities, last verified July 2026:
Educational content, not legal or billing advice. Sample notes are fictional. Follow your organization's policies and your board, payer, and jurisdiction requirements.