3d:"/_next/static/chunks/24jkfr7u9s_6l.js" 3e:"/_next/static/chunks/0fv-mr63cnuzi.js" 3f:"/_next/static/chunks/2drs39ix-1ees.js" 40:I[274158,["$6","$7","$8","$9","$a","$b","$c","$d","$e","$f","$10","$11","$12","$13","$14","$15","$27","$3d","$3e","$3f"],"default"] 43:I[27201,["$6","$7","$8","$9","$a","$b","$c","$d","$e","$f","$10","$11","$12","$13","$14","$15"],"IconMark"] 41:T5bbe,# Mental Health Records Under HIPAA: Psychotherapy Notes Need Consent ![Patient writing a request about psychotherapy notes](https://media.babylovegrowth.ai/blog-images/organization-26020/1791950859036_Patient-writing-a-request-about-psychotherapy-notes.jpeg) HIPAA generally lets you request your mental health records and direct your provider to send them to a recipient you name. Providers may also share information with other treating providers for care. Psychotherapy notes need a separate signed authorization, and substance use disorder records may fall under stricter federal consent rules. Secure channels beat unvetted apps, and the steps below show how. *** > **TL;DR:** > > - Providers generally have 30 days to respond, or 60 if an extension applies; submit a signed written request naming the recipient, records, delivery point, and format. > - Diagnoses, treatment plans, medication monitoring, and session times usually belong to the accessible medical record; a therapist’s separate working notes generally require their own signed authorization. > - Before releasing addiction treatment records, ask whether Part 2 applies and complete its specific written consent form; recipients also receive a notice restricting redisclosure. > - For an app outside HIPAA’s covered entity and business associate rules, HIPAA may not govern later use; review its privacy terms before sending records. > - When available, use patient portals or certified electronic record transfers for care handoffs; plain email is not a safe default for therapy records. *** ## Table of Contents - [How does HIPAA treat mental health information, access, and timing?](#how-does-hipaa-treat-mental-health-information-access-and-timing) - [Why are psychotherapy notes different, and how do you request them?](#why-are-psychotherapy-notes-different-and-how-do-you-request-them) - [When do substance use disorder records need extra consent under 42 CFR Part 2?](#when-do-substance-use-disorder-records-need-extra-consent-under-42-cfr-part-2) - [What are the steps to direct a provider to send your records?](#what-are-the-steps-to-direct-a-provider-to-send-your-records) - [Which secure methods work best, and what are the trade-offs?](#which-secure-methods-work-best-and-what-are-the-trade-offs) - [What should you check before you hit send?](#what-should-you-check-before-you-hit-send) - [When can providers share your information without your permission?](#when-can-providers-share-your-information-without-your-permission) - [How can you verify a recipient's identity before sharing?](#how-can-you-verify-a-recipients-identity-before-sharing) - [How do you use digital consent forms and permissions management?](#how-do-you-use-digital-consent-forms-and-permissions-management) - [How do you revoke access or control ongoing sharing?](#how-do-you-revoke-access-or-control-ongoing-sharing) - [Which encryption standards and technologies protect shared mental health records?](#which-encryption-standards-and-technologies-protect-shared-mental-health-records) - [What steps help you audit and track record sharing?](#what-steps-help-you-audit-and-track-record-sharing) - [How should you share records with non-healthcare third parties like lawyers or insurers?](#how-should-you-share-records-with-non-healthcare-third-parties-like-lawyers-or-insurers) - [Why does usable, auditable sharing matter for care and family support?](#why-does-usable-auditable-sharing-matter-for-care-and-family-support) - [How can a HIPAA-ready records platform help you share with confidence?](#how-can-a-hipaa-ready-records-platform-help-you-share-with-confidence) - [FAQ](#faq) - [Sources](#sources) ## How does HIPAA treat mental health information, access, and timing? Most mental health information is handled like any other medical record under the [HIPAA Privacy Rule](https://www.hhs.gov/hipaa/for-professionals/privacy/index.html). You have a right to access it, and you can direct your provider to transmit it to a third party. Your request should identify the recipient and where the records should go. Here is what to expect from your provider: - Access covers the "designated record set": medical records, billing, lab reports, and other records used to make decisions about you, as HHS explains. - The provider must supply records in the form and format you request if they can readily produce it, and must respond within regulatory timeframes, generally within 30 days. - Providers may share information with each other for treatment, case management, and care coordination without your authorization. That includes medication lists, diagnoses, and treatment summaries, according to HHS guidance on care coordination. Put simply: your right to your records is strong, and your care team can talk to each other. What you control is where else the records go. ## Why are psychotherapy notes different, and how do you request them? Psychotherapy notes are the one category of mental health information with extra protection. HHS says they are kept separate from the rest of the medical record and generally need a separate signed authorization before disclosure. They are a therapist's private working notes, not your chart. Many things people call "therapy notes" are not psychotherapy notes under HIPAA: - Medication prescribing and monitoring - Session start and stop times - Counseling modalities and frequencies - Test results - Diagnosis, treatment plan, symptoms, and progress summaries Ask your provider directly which items fall into each group. If you want the notes themselves released to someone, expect to sign a separate authorization for them. Access to psychotherapy notes is also more limited than access to the rest of your record. **Pro Tip:** *Ask your provider in writing, "Which of these items do you treat as psychotherapy notes?" The answer tells you which form to sign.* ## When do substance use disorder records need extra consent under 42 CFR Part 2? Records from certain substance use disorder (SUD) treatment programs can be more tightly restricted than HIPAA alone. Under 42 CFR Part 2, [SAMHSA's FAQs](https://www.samhsa.gov/sites/default/files/faqs-applying-confidentiality-regulations-to-hie.pdf) explain, disclosure generally requires specific written patient consent, and the rules carry strict redisclosure notices. What that means in practice: - A general release may not be enough to send SUD treatment records. Consent has to meet Part 2 requirements. - Part 2 programs can communicate with health information organizations and exchanges in certain circumstances, such as when written agreements called qualified service organization agreements are in place. - A notice prohibiting redisclosure travels with the record, so recipients cannot pass it along freely. Before you include anything from addiction treatment in a general release, ask the program whether Part 2 covers those records. If it does, request the Part 2 consent form and complete it separately. ## What are the steps to direct a provider to send your records? Follow these steps and your request is far less likely to stall: 1. **Write and sign your direction.** HHS says the request must be in writing, signed, and [clearly identify the recipient](https://www.hhs.gov/hipaa/for-professionals/faq/2036/can-an-individual-through-the-hipaa-right/index.html). 2. **Name the recipient and delivery point.** Include the person, clinic, or service name, plus a Direct address or secure email if one exists. 3. **List what you want.** Name specific documents or date ranges, and say whether psychotherapy notes or SUD records are in or out. 4. **Pick a format.** Ask for the form and format you want, such as a portal entry, a signed PDF, or an electronic transfer. If the provider can readily produce it, they must. 5. **Submit it in a supported way.** Paper forms, signed PDFs, portal entries, and electronically executed requests all work. Providers cannot add unreasonable verification hurdles. 6. **Confirm timing and fees.** Providers generally have [30 days](https://www.hhs.gov/hipaa/for-professionals/faq/2036/can-an-individual-through-the-hipaa-right/index.html), or 60 days if an extension applies, and fee limits apply. Ask about both upfront. 7. **Follow up.** Confirm the records left and arrived. **Pro Tip:** *If the recipient is an app, name the exact format you want and ask whether your provider can send it safely before you sign.* If you are a patient in the U.S. using these rights to gather your own records first, our guide on [using HIPAA rights to upload and secure medical records](https://medfiles.ai/en/articles/upload-medical-records) walks through it. ## Which secure methods work best, and what are the trade-offs? Not every channel protects you equally: - **Patient portals and certified EHR transfers.** These are secure and auditable, and usually the best choice for provider-to-provider or provider-to-app transfers when your provider supports them. - **Direct messaging.** A secure, standards-based messaging channel between health care addresses. It works well when both sides have one. - **Encrypted email.** Acceptable when configured correctly and agreed with the recipient. Plain email is not a safe default for therapy records. - **App transfers.** Convenient, but read the next point carefully. Here is the trade-off most people miss. If you direct your provider to send electronic records to a third-party app that is not a covered entity or business associate, HIPAA no longer governs how that app uses the data. Providers are generally not liable for what the app does afterward, though they should consider telling you about the risk. That shift in protection is why you should read an app's privacy terms before you tap send. When continuity of care is the goal, choose provider-to-provider secure channels where you can. For more on technical options, see our overview of [sharing medical records online with FHIR and SMART links](https://medfiles.ai/en/articles/medical-record-sharing-online). ## What should you check before you hit send? Run through this short list before you sign or transmit anything: - **Share the minimum.** Send only what the recipient needs for their purpose. A new primary care doctor rarely needs years of session detail. - **Separate the special categories.** Confirm psychotherapy notes and Part 2 records are handled on their own forms. - **Set the terms.** Specify recipient identity, transmission method, date range, and an expiration or revocation instruction when the form allows. - **Keep proof.** Save a copy of the signed release and note the date sent. - **Confirm receipt.** Ask the recipient to confirm the records arrived and are stored securely. If you are unsure what to redact, ask the sending provider what they typically include for treatment purposes versus psychotherapy notes. **Pro Tip:** *Keep a simple log with the date, recipient, documents sent, and method. It can help answer later questions.* Families sharing on behalf of a loved one can find more in our [secure health information sharing tips for families](https://medfiles.ai/en/articles/secure-health-information-sharing-tips-for-families). ## When can providers share your information without your permission? The exceptions are narrow. HIPAA allows providers to share limited information to prevent a serious and imminent threat to health or safety. It also allows professional judgment when a patient is incapacitated, and HHS says family members or friends involved in care may receive information when the patient is present and does not object. - Providers may share only the minimum needed in these situations. - State law or professional ethics can impose stricter limits than HIPAA, so ask your provider how their state rules apply. - A personal representative normally has the same access you would, unless treating someone as a representative could endanger the patient. If you want to limit what family hears, tell your provider clearly and in writing. ## How can you verify a recipient's identity before sharing? Most privacy mistakes happen at the last step: sending the right records to the wrong place. Take a few minutes to check. Start by confirming who the recipient is through a channel you already trust. Look up the clinic's phone number on its official website or your insurance card, call, and ask for the correct secure address or fax. Do not rely on a number or email printed on an unsolicited message. Next, verify the delivery point itself: - For Direct or secure email, ask the recipient to send you a test message first, so you know the address is live and theirs. - For a portal upload, confirm the practice name and provider on the screen before attaching anything. - For an app or service, check who operates it, where its privacy policy sits, and whether it says it is a covered entity or business associate. Then match the recipient to the purpose. A dentist, a school, and a life insurer each need different things, and none of them needs everything. If the request comes from someone asking you to send records urgently, slow down. Urgency is a common sign of a scam. Finally, write it down. Note the name, role, contact method you verified, and the date. If something later goes wrong, that record shows you took reasonable steps and helps your provider trace the transfer. ## How do you use digital consent forms and permissions management? Digital consent forms can make sharing faster and easier to track, but only if they say what you intend. A good form names who may receive your records, which records are covered, why they are being shared, and when permission ends. Check these elements before you e-sign: - **Specific recipient.** A named person or organization, not "any provider." - **Specific scope.** Date ranges and record types, with psychotherapy notes and SUD records flagged separately. - **Purpose.** Treatment, insurance, legal, or personal use. - **Expiration.** A date or event after which permission ends. - **Revocation language.** A clear statement of how you can withdraw consent. Once signed, keep the signed copy where you can find it. A digital system should store the form, show its status, and let you see which permissions are active. Review them on a schedule, such as every few months or after a change in care, and turn off any that no longer serve a purpose. Avoid blanket permissions. Narrow, time-limited consents are easier to manage and easier to revoke. Our [Doctor Center](https://medfiles.ai/en/for-doctors) also gives clinicians a clear way to receive records you choose to share. ## How do you revoke access or control ongoing sharing? You can generally withdraw an authorization you gave, but revoking has limits. A revocation usually applies going forward. It does not undo information that was already sent under a valid permission. To revoke cleanly: 1. **Put it in writing.** Name the original authorization, the recipient, and the date. 2. **Send it to the right party.** Deliver it to the provider or organization holding the authorization, and notify the recipient too. 3. **Ask for confirmation.** Request written acknowledgment that sharing has stopped. 4. **Check ongoing feeds.** If records flow automatically through a portal or connected app, disconnect that link as well. Where a one-time right-of-access request is complete, there is nothing to revoke from your provider, but the recipient still holds the copy. For an app that now holds your data, HIPAA may not govern it, so look for the app's own deletion or account closure process and use it. Calendar a review date for every active permission. If your therapist, insurer, or caregiver situation changes, update your permissions the same week. Control over sharing is mostly maintenance: small, regular checks that keep old permissions from lingering. ![Permission path with review and revocation points](https://media.babylovegrowth.ai/blog-images/organization-26020/1791950896896_Permission-path-with-review-and-revocation-points.jpeg) ## Which encryption standards and technologies protect shared mental health records? You do not need to be an engineer, but you should know what to ask for. Look for encryption both in transit (while moving) and at rest (while stored). In plain terms, check for: - **Transport encryption.** Ask whether web portals and email use encryption while data is moving between devices. - **Strong storage encryption.** Ask how data is encrypted while stored. - **End-to-end encryption.** Where only sender and recipient can read the content. - **Strong authentication.** Multi-factor login on any account that holds records. - **Access controls and logging.** Role-based permissions and activity records. HHS does not hand patients a single product to buy, so ask providers and services to describe their safeguards in writing. A trustworthy service answers plainly. If an answer is vague, treat that as information. Also protect your own end. Use a passcode on your phone, keep software updated, avoid public Wi-Fi when opening records, and never send records through ordinary text messages or unencrypted attachments. Our [security and privacy page](https://medfiles.ai/en/security) explains the HIPAA-ready infrastructure and encryption we use. ## What steps help you audit and track record sharing? An audit trail answers three questions: who got your records, when, and by what route. You can build one even without special software. Start a simple sharing log with these columns in a notebook or spreadsheet: - Date sent - Recipient and verified contact - Documents or date range - Method used (portal, Direct, encrypted email) - Authorization reference and expiration - Confirmation of receipt Then add routine checks: 1. **Request an accounting of disclosures.** HIPAA gives you the right to ask for a list of certain disclosures your provider made. Ask which are included. 2. **Review portal activity.** Many portals show recent downloads, shares, and logins. 3. **Match permissions to the log.** Every active consent should have a reason and an end date. 4. **Review on a schedule.** Quarterly works for most people. 5. **Act on surprises.** If you find an unexpected disclosure, contact the provider's privacy officer in writing. A platform that records sharing events automatically reduces the burden. Whatever you use, the principle is the same: if you cannot see where your records went, you cannot control them. ## How should you share records with non-healthcare third parties like lawyers or insurers? Once records leave the health care system, HIPAA often stops protecting them. A lawyer, insurer, employer, or school is generally not bound by HIPAA the way your doctor is, so your own choices carry more weight. Use extra caution: - **Ask what they truly need.** Request the narrowest set of documents that satisfies the purpose. A claim for one episode rarely needs your full history. - **Use a purpose-specific authorization.** State the purpose, the records, and an end date. - **Keep psychotherapy notes out** unless there is a compelling reason and you have taken advice. - **Use secure delivery.** An encrypted portal or encrypted file transfer beats email attachments. - **Get terms in writing.** Ask how they will store, use, and destroy the records. - **Consider professional advice.** For legal or insurance disputes, a lawyer can tell you what to release and what to hold back. If the request comes through your provider, they must follow HIPAA and any signed authorization. If you send records yourself, you become the gatekeeper. Keep copies and log what you sent. ## Why does usable, auditable sharing matter for care and family support? Mental health information is among the most sensitive a person owns, and that is exactly why control matters. In our view, the best privacy is not a locked door. It is a door you can open on purpose, for the right person, for a limited time, and see who walked through. When records can move smoothly between a therapist, a new doctor, and a trusted family member, care transitions get easier and fewer people are forced to retell their story. Careful steps, like the ones above, protect dignity while still letting help arrive. > *— Team* ## How can a HIPAA-ready records platform help you share with confidence? We built Medfiles so you can keep your records in one place and decide who sees them. You can store and organize documents, manage separate profiles for yourself and your family, and share through [secure document sharing](https://medfiles.ai/en/secure-sharing) built on HIPAA-ready, encrypted infrastructure. Our security and privacy page explains how we protect your data. Our [pricing page](https://medfiles.ai/en/pricing) shows Understand Your Health at 2.99 $ per month and Protect Everyone at 4.99 $ per month. Create your free account and take control of your records today. ![Medfiles](https://csuxjmfbwmkxiegfpljm.supabase.co/storage/v1/object/public/blog-images/organization-26020/1775900480670_medfiles.jpg) This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here. ## FAQ ### Can I send my therapist's records to another provider? Yes. HIPAA lets you direct your provider to send your records to another provider, and providers can also share for treatment without your authorization. Psychotherapy notes are the exception and need a separate signed authorization. ### Do psychotherapy notes need a separate authorization? Generally yes. HHS explains that psychotherapy notes are kept apart from the medical record and usually require their own signed authorization. Routine items like diagnoses, medication monitoring, and session times are not psychotherapy notes. ### Does HIPAA still protect my records after I send them to an app? Often not. If the app is not a covered entity or business associate, HHS says HIPAA does not govern its use of your data. Read the app's privacy terms before you share. ### Are substance use disorder records shared the same way? Not always. Records from Part 2 programs generally require specific written consent and carry redisclosure notices, per SAMHSA's guidance. Ask the program which rules apply before you sign. ### How long does a provider have to send my records? Providers generally must respond within 30 days, with a possible extension, as described in HHS guidance. Ask about timing and fees when you submit the request. ## Sources - Hhs - [Can an individual, through the HIPAA right of access, have his or her health care provider or health plan send the individual’s PHI to a third party?](https://www.hhs.gov/hipaa/for-professionals/faq/2036/can-an-individual-through-the-hipaa-right/index.html) - FREQUENTLY ASKED QUESTIONS ## Recommended - [U.S. Patients: Use HIPAA Rights to Upload and Secure Medical Records](https://medfiles.ai/en/articles/upload-medical-records) - [6-Step Plan to Combine Medical Records for Patients, Preserve Metadata](https://medfiles.ai/en/articles/combine-medical-records) - [For Patients: Share Medical Records Online Fast With FHIR, SMART Links](https://medfiles.ai/en/articles/medical-record-sharing-online) - [Set Up Caregiver Access to Medical Records in 5 Steps](https://medfiles.ai/en/articles/caregiver-access-medical-records)42:T7411,

Patient writing a request about psychotherapy notes

HIPAA generally lets you request your mental health records and direct your provider to send them to a recipient you name. Providers may also share information with other treating providers for care. Psychotherapy notes need a separate signed authorization, and substance use disorder records may fall under stricter federal consent rules. Secure channels beat unvetted apps, and the steps below show how.

TL;DR:

Providers generally have 30 days to respond, or 60 if an extension applies; submit a signed written request naming the recipient, records, delivery point, and format.

Diagnoses, treatment plans, medication monitoring, and session times usually belong to the accessible medical record; a therapist’s separate working notes generally require their own signed authorization.

Before releasing addiction treatment records, ask whether Part 2 applies and complete its specific written consent form; recipients also receive a notice restricting redisclosure.

For an app outside HIPAA’s covered entity and business associate rules, HIPAA may not govern later use; review its privacy terms before sending records.

When available, use patient portals or certified electronic record transfers for care handoffs; plain email is not a safe default for therapy records.

Medfiles

Keep Mental Health Records Organized

MedFiles lets you securely store medical documents and share them with healthcare providers, with access to records when you need them.

Visit MedFiles

How does HIPAA treat mental health information, access, and timing?
Why are psychotherapy notes different, and how do you request them?
When do substance use disorder records need extra consent under 42 CFR Part 2?
What are the steps to direct a provider to send your records?
Which secure methods work best, and what are the trade-offs?
What should you check before you hit send?
When can providers share your information without your permission?
How can you verify a recipient’s identity before sharing?
How do you use digital consent forms and permissions management?
How do you revoke access or control ongoing sharing?
Which encryption standards and technologies protect shared mental health records?
What steps help you audit and track record sharing?
How should you share records with non-healthcare third parties like lawyers or insurers?
Why does usable, auditable sharing matter for care and family support?
How can a HIPAA-ready records platform help you share with confidence?
FAQ
Sources

How does HIPAA treat mental health information, access, and timing?

Most mental health information is handled like any other medical record under the HIPAA Privacy Rule. You have a right to access it, and you can direct your provider to transmit it to a third party. Your request should identify the recipient and where the records should go.

Here is what to expect from your provider:

Access covers the “designated record set”: medical records, billing, lab reports, and other records used to make decisions about you, as HHS explains.
The provider must supply records in the form and format you request if they can readily produce it, and must respond within regulatory timeframes, generally within 30 days.
Providers may share information with each other for treatment, case management, and care coordination without your authorization. That includes medication lists, diagnoses, and treatment summaries, according to HHS guidance on care coordination.

Put simply: your right to your records is strong, and your care team can talk to each other. What you control is where else the records go.

Why are psychotherapy notes different, and how do you request them?

Psychotherapy notes are the one category of mental health information with extra protection. HHS says they are kept separate from the rest of the medical record and generally need a separate signed authorization before disclosure. They are a therapist’s private working notes, not your chart.

Many things people call “therapy notes” are not psychotherapy notes under HIPAA:

Medication prescribing and monitoring
Session start and stop times
Counseling modalities and frequencies
Test results
Diagnosis, treatment plan, symptoms, and progress summaries

Ask your provider directly which items fall into each group. If you want the notes themselves released to someone, expect to sign a separate authorization for them. Access to psychotherapy notes is also more limited than access to the rest of your record.

Pro Tip: Ask your provider in writing, “Which of these items do you treat as psychotherapy notes?” The answer tells you which form to sign.

Records from certain substance use disorder (SUD) treatment programs can be more tightly restricted than HIPAA alone. Under 42 CFR Part 2, SAMHSA’s FAQs explain, disclosure generally requires specific written patient consent, and the rules carry strict redisclosure notices.

What that means in practice:

A general release may not be enough to send SUD treatment records. Consent has to meet Part 2 requirements.
Part 2 programs can communicate with health information organizations and exchanges in certain circumstances, such as when written agreements called qualified service organization agreements are in place.
A notice prohibiting redisclosure travels with the record, so recipients cannot pass it along freely.

Before you include anything from addiction treatment in a general release, ask the program whether Part 2 covers those records. If it does, request the Part 2 consent form and complete it separately.

What are the steps to direct a provider to send your records?

Follow these steps and your request is far less likely to stall:

Write and sign your direction. HHS says the request must be in writing, signed, and clearly identify the recipient.
Name the recipient and delivery point. Include the person, clinic, or service name, plus a Direct address or secure email if one exists.
List what you want. Name specific documents or date ranges, and say whether psychotherapy notes or SUD records are in or out.
Pick a format. Ask for the form and format you want, such as a portal entry, a signed PDF, or an electronic transfer. If the provider can readily produce it, they must.
Submit it in a supported way. Paper forms, signed PDFs, portal entries, and electronically executed requests all work. Providers cannot add unreasonable verification hurdles.
Confirm timing and fees. Providers generally have 30 days, or 60 days if an extension applies, and fee limits apply. Ask about both upfront.
Follow up. Confirm the records left and arrived.

Pro Tip: If the recipient is an app, name the exact format you want and ask whether your provider can send it safely before you sign.

If you are a patient in the U.S. using these rights to gather your own records first, our guide on using HIPAA rights to upload and secure medical records walks through it.

Which secure methods work best, and what are the trade-offs?

Not every channel protects you equally:

Patient portals and certified EHR transfers. These are secure and auditable, and usually the best choice for provider-to-provider or provider-to-app transfers when your provider supports them.
Direct messaging. A secure, standards-based messaging channel between health care addresses. It works well when both sides have one.
Encrypted email. Acceptable when configured correctly and agreed with the recipient. Plain email is not a safe default for therapy records.
App transfers. Convenient, but read the next point carefully.

Here is the trade-off most people miss. If you direct your provider to send electronic records to a third-party app that is not a covered entity or business associate, HIPAA no longer governs how that app uses the data. Providers are generally not liable for what the app does afterward, though they should consider telling you about the risk. That shift in protection is why you should read an app’s privacy terms before you tap send.

When continuity of care is the goal, choose provider-to-provider secure channels where you can. For more on technical options, see our overview of sharing medical records online with FHIR and SMART links.

What should you check before you hit send?

Run through this short list before you sign or transmit anything:

Share the minimum. Send only what the recipient needs for their purpose. A new primary care doctor rarely needs years of session detail.
Separate the special categories. Confirm psychotherapy notes and Part 2 records are handled on their own forms.
Set the terms. Specify recipient identity, transmission method, date range, and an expiration or revocation instruction when the form allows.
Keep proof. Save a copy of the signed release and note the date sent.
Confirm receipt. Ask the recipient to confirm the records arrived and are stored securely.

If you are unsure what to redact, ask the sending provider what they typically include for treatment purposes versus psychotherapy notes.

Pro Tip: Keep a simple log with the date, recipient, documents sent, and method. It can help answer later questions.

Families sharing on behalf of a loved one can find more in our secure health information sharing tips for families.

The exceptions are narrow. HIPAA allows providers to share limited information to prevent a serious and imminent threat to health or safety. It also allows professional judgment when a patient is incapacitated, and HHS says family members or friends involved in care may receive information when the patient is present and does not object.

Providers may share only the minimum needed in these situations.
State law or professional ethics can impose stricter limits than HIPAA, so ask your provider how their state rules apply.
A personal representative normally has the same access you would, unless treating someone as a representative could endanger the patient.

If you want to limit what family hears, tell your provider clearly and in writing.

Most privacy mistakes happen at the last step: sending the right records to the wrong place. Take a few minutes to check.

Start by confirming who the recipient is through a channel you already trust. Look up the clinic’s phone number on its official website or your insurance card, call, and ask for the correct secure address or fax. Do not rely on a number or email printed on an unsolicited message.

Next, verify the delivery point itself:

For Direct or secure email, ask the recipient to send you a test message first, so you know the address is live and theirs.
For a portal upload, confirm the practice name and provider on the screen before attaching anything.
For an app or service, check who operates it, where its privacy policy sits, and whether it says it is a covered entity or business associate.

Then match the recipient to the purpose. A dentist, a school, and a life insurer each need different things, and none of them needs everything. If the request comes from someone asking you to send records urgently, slow down. Urgency is a common sign of a scam.

Finally, write it down. Note the name, role, contact method you verified, and the date. If something later goes wrong, that record shows you took reasonable steps and helps your provider trace the transfer.

Digital consent forms can make sharing faster and easier to track, but only if they say what you intend. A good form names who may receive your records, which records are covered, why they are being shared, and when permission ends.

Check these elements before you e-sign:

Specific recipient. A named person or organization, not “any provider.”
Specific scope. Date ranges and record types, with psychotherapy notes and SUD records flagged separately.
Purpose. Treatment, insurance, legal, or personal use.
Expiration. A date or event after which permission ends.
Revocation language. A clear statement of how you can withdraw consent.

Once signed, keep the signed copy where you can find it. A digital system should store the form, show its status, and let you see which permissions are active. Review them on a schedule, such as every few months or after a change in care, and turn off any that no longer serve a purpose.

Avoid blanket permissions. Narrow, time-limited consents are easier to manage and easier to revoke. Our Doctor Center also gives clinicians a clear way to receive records you choose to share.

You can generally withdraw an authorization you gave, but revoking has limits. A revocation usually applies going forward. It does not undo information that was already sent under a valid permission.

To revoke cleanly:

Put it in writing. Name the original authorization, the recipient, and the date.
Send it to the right party. Deliver it to the provider or organization holding the authorization, and notify the recipient too.
Ask for confirmation. Request written acknowledgment that sharing has stopped.
Check ongoing feeds. If records flow automatically through a portal or connected app, disconnect that link as well.

Where a one-time right-of-access request is complete, there is nothing to revoke from your provider, but the recipient still holds the copy. For an app that now holds your data, HIPAA may not govern it, so look for the app’s own deletion or account closure process and use it.

Calendar a review date for every active permission. If your therapist, insurer, or caregiver situation changes, update your permissions the same week. Control over sharing is mostly maintenance: small, regular checks that keep old permissions from lingering.

Permission path with review and revocation points

Which encryption standards and technologies protect shared mental health records?

You do not need to be an engineer, but you should know what to ask for. Look for encryption both in transit (while moving) and at rest (while stored).

In plain terms, check for:

Transport encryption. Ask whether web portals and email use encryption while data is moving between devices.
Strong storage encryption. Ask how data is encrypted while stored.
End-to-end encryption. Where only sender and recipient can read the content.
Strong authentication. Multi-factor login on any account that holds records.
Access controls and logging. Role-based permissions and activity records.

HHS does not hand patients a single product to buy, so ask providers and services to describe their safeguards in writing. A trustworthy service answers plainly. If an answer is vague, treat that as information.

Also protect your own end. Use a passcode on your phone, keep software updated, avoid public Wi-Fi when opening records, and never send records through ordinary text messages or unencrypted attachments.

Our security and privacy page explains the HIPAA-ready infrastructure and encryption we use.

An audit trail answers three questions: who got your records, when, and by what route. You can build one even without special software.

Start a simple sharing log with these columns in a notebook or spreadsheet:

Date sent
Recipient and verified contact
Documents or date range
Method used (portal, Direct, encrypted email)
Authorization reference and expiration
Confirmation of receipt

Then add routine checks:

Request an accounting of disclosures. HIPAA gives you the right to ask for a list of certain disclosures your provider made. Ask which are included.
Review portal activity. Many portals show recent downloads, shares, and logins.
Match permissions to the log. Every active consent should have a reason and an end date.
Review on a schedule. Quarterly works for most people.
Act on surprises. If you find an unexpected disclosure, contact the provider’s privacy officer in writing.

A platform that records sharing events automatically reduces the burden. Whatever you use, the principle is the same: if you cannot see where your records went, you cannot control them.

Once records leave the health care system, HIPAA often stops protecting them. A lawyer, insurer, employer, or school is generally not bound by HIPAA the way your doctor is, so your own choices carry more weight.

Use extra caution:

Ask what they truly need. Request the narrowest set of documents that satisfies the purpose. A claim for one episode rarely needs your full history.
Use a purpose-specific authorization. State the purpose, the records, and an end date.
Keep psychotherapy notes out unless there is a compelling reason and you have taken advice.
Use secure delivery. An encrypted portal or encrypted file transfer beats email attachments.
Get terms in writing. Ask how they will store, use, and destroy the records.
Consider professional advice. For legal or insurance disputes, a lawyer can tell you what to release and what to hold back.

If the request comes through your provider, they must follow HIPAA and any signed authorization. If you send records yourself, you become the gatekeeper. Keep copies and log what you sent.

Mental health information is among the most sensitive a person owns, and that is exactly why control matters. In our view, the best privacy is not a locked door. It is a door you can open on purpose, for the right person, for a limited time, and see who walked through. When records can move smoothly between a therapist, a new doctor, and a trusted family member, care transitions get easier and fewer people are forced to retell their story. Careful steps, like the ones above, protect dignity while still letting help arrive.

— Team

We built Medfiles so you can keep your records in one place and decide who sees them. You can store and organize documents, manage separate profiles for yourself and your family, and share through secure document sharing built on HIPAA-ready, encrypted infrastructure. Our security and privacy page explains how we protect your data. Our pricing page shows Understand Your Health at 2.99 $ per month and Protect Everyone at 4.99 $ per month. Create your free account and take control of your records today.

Medfiles

This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.

FAQ

Can I send my therapist’s records to another provider?

Yes. HIPAA lets you direct your provider to send your records to another provider, and providers can also share for treatment without your authorization. Psychotherapy notes are the exception and need a separate signed authorization.

Do psychotherapy notes need a separate authorization?

Generally yes. HHS explains that psychotherapy notes are kept apart from the medical record and usually require their own signed authorization. Routine items like diagnoses, medication monitoring, and session times are not psychotherapy notes.

Does HIPAA still protect my records after I send them to an app?

Often not. If the app is not a covered entity or business associate, HHS says HIPAA does not govern its use of your data. Read the app’s privacy terms before you share.

Are substance use disorder records shared the same way?

Not always. Records from Part 2 programs generally require specific written consent and carry redisclosure notices, per SAMHSA’s guidance. Ask the program which rules apply before you sign.

How long does a provider have to send my records?

Providers generally must respond within 30 days, with a possible extension, as described in HHS guidance. Ask about timing and fees when you submit the request.

Sources

Hhs
Can an individual, through the HIPAA right of access, have his or her health care provider or health plan send the individual’s PHI to a third party?
FREQUENTLY ASKED QUESTIONS

1b:[null,null,["$","$L40",null,{"article":{"id":971697,"title":"Mental Health Records Under HIPAA: Psychotherapy Notes Need Consent","slug":"securely-share-mental-health-records","languageCode":"en","content_markdown":"$41","content_html":"$42","meta_description":"Learn when HIPAA lets you share mental health records, which notes need separate consent, and how to choose secure channels for sensitive information.","excerpt":"Mental Health Records Under HIPAA: Psychotherapy Notes Need Consent\n\n! Patient writing a request about psychotherapy notes\n\nHIPAA generally lets you request your mental health records and direct your provider to send them to a recipient you name.","hero_image_url":"https://media.babylovegrowth.ai/blog-images/organization-26020/1791950859036_Patient-writing-a-request-about-psychotherapy-notes.jpeg","orgWebsite":"https://medfiles.ai","created_at":"2026-10-14T04:08:24.438Z","updated_at":"2026-10-14T04:08:26.944Z","published_at":"2026-10-14T04:08:24.438Z","published":false,"published_url":"","seedKeyword":"securely share mental health records","keywords":["share mental health information","best practices for data sharing","privacy in mental health records","digital mental health privacy","safeguarding mental health information","how to share therapy notes securely","confidential mental health sharing","secure patient records","mental health data sharing","HIPAA compliant data transfer","secure electronic health records","securely share mental health records"],"jsonLd":null,"faqJsonLd":null}}]] 1e:null 24:[["$","title","0",{"children":"Mental Health Records Under HIPAA: Psychotherapy Notes Need Consent | MedFiles.ai"}],["$","meta","1",{"name":"description","content":"Learn when HIPAA lets you share mental health records, which notes need separate consent, and how to choose secure channels for sensitive information."}],["$","meta","2",{"name":"keywords","content":"medical history,digital health,medical documents,telemedicine,clinical records,personal health,historial médico,salud digital"}],["$","link","3",{"rel":"canonical","href":"https://medfiles.ai/ca/articles/securely-share-mental-health-records"}],["$","link","4",{"rel":"alternate","hrefLang":"es","href":"https://medfiles.ai/es/articles/securely-share-mental-health-records"}],["$","link","5",{"rel":"alternate","hrefLang":"en","href":"https://medfiles.ai/en/articles/securely-share-mental-health-records"}],["$","link","6",{"rel":"alternate","hrefLang":"pt","href":"https://medfiles.ai/pt/articles/securely-share-mental-health-records"}],["$","link","7",{"rel":"alternate","hrefLang":"fr","href":"https://medfiles.ai/fr/articles/securely-share-mental-health-records"}],["$","link","8",{"rel":"alternate","hrefLang":"ca","href":"https://medfiles.ai/ca/articles/securely-share-mental-health-records"}],["$","link","9",{"rel":"alternate","hrefLang":"x-default","href":"https://medfiles.ai/en/articles/securely-share-mental-health-records"}],["$","meta","10",{"property":"og:title","content":"Mental Health Records Under HIPAA: Psychotherapy Notes Need Consent"}],["$","meta","11",{"property":"og:description","content":"Learn when HIPAA lets you share mental health records, which notes need separate consent, and how to choose secure channels for sensitive information."}],["$","meta","12",{"property":"og:site_name","content":"MedFiles.ai"}],["$","meta","13",{"property":"og:image","content":"https://media.babylovegrowth.ai/blog-images/organization-26020/1791950859036_Patient-writing-a-request-about-psychotherapy-notes.jpeg"}],["$","meta","14",{"property":"og:image:alt","content":"Mental Health Records Under HIPAA: Psychotherapy Notes Need Consent"}],["$","meta","15",{"property":"og:type","content":"article"}],["$","meta","16",{"property":"article:published_time","content":"2026-10-14T04:08:24.438Z"}],["$","meta","17",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","18",{"name":"twitter:title","content":"Mental Health Records Under HIPAA: Psychotherapy Notes Need Consent"}],["$","meta","19",{"name":"twitter:description","content":"Learn when HIPAA lets you share mental health records, which notes need separate consent, and how to choose secure channels for sensitive information."}],["$","meta","20",{"name":"twitter:image","content":"https://media.babylovegrowth.ai/blog-images/organization-26020/1791950859036_Patient-writing-a-request-about-psychotherapy-notes.jpeg"}],["$","link","21",{"rel":"shortcut icon","href":"/favicon.ico"}],["$","link","22",{"rel":"icon","href":"/favicon.ico","sizes":"48x48"}],["$","link","23",{"rel":"icon","href":"/favicon.png","type":"image/png","sizes":"any"}],["$","link","24",{"rel":"icon","href":"/favicon.png","type":"image/png","sizes":"32x32"}],["$","link","25",{"rel":"icon","href":"/favicon.png","type":"image/png","sizes":"16x16"}],["$","link","26",{"rel":"apple-touch-icon","href":"/apple-touch-icon.png","sizes":"180x180","type":"image/png"}],["$","$L43","27",{}]]

Mental Health Records Under HIPAA: Psychotherapy Notes Need Consent

Table of Contents

How does HIPAA treat mental health information, access, and timing?

Why are psychotherapy notes different, and how do you request them?

When do substance use disorder records need extra consent under 42 CFR Part 2?

What are the steps to direct a provider to send your records?

Which secure methods work best, and what are the trade-offs?

What should you check before you hit send?

When can providers share your information without your permission?

How can you verify a recipient’s identity before sharing?

How do you use digital consent forms and permissions management?

How do you revoke access or control ongoing sharing?

Which encryption standards and technologies protect shared mental health records?

What steps help you audit and track record sharing?

How should you share records with non-healthcare third parties like lawyers or insurers?

Why does usable, auditable sharing matter for care and family support?

How can a HIPAA-ready records platform help you share with confidence?

FAQ