If your client were to ask to see your session notes, chances are you would feel a bit like the proverbial deer in the headlights. So, today’s article will give you some background on the topic, how to respond if this happens, and when you can refuse. This is NOT meant to be a comprehensive analysis of a complex legal topic, just a quick overview.

Since I’m not an expert on this topic, I interviewed the wise and wonderful Liath Dalton, Director of PersonCenteredTech.com, who has written a lot about this topic, and put to her your Frequently Asked Questions:

“My client asked to see her session notes. Do I have to let her see them?” The short answer, says Dalton, is that with certain limitations, clients have the right to view their records. This is because of two major pieces of legislation: The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Information Blocking Rule of the 21st Century Cures Act – often referred to as the Open Notes Rule – where the Final Rule went into effect in 2022.

HIPAA granted clients the right to inspect or obtain copies of the information in their health care provider’s records, whether maintained in paper or electronic systems. Clients could access a wide array of information in their medical records, including billing and payment records, insurance information, and all clinical records. The provider was required to make the information available within a maximum of 30 days of the request. The client could also ask the provider to transmit a copy to another designated person or entity.

“So, what was the ‘Open Notes’ Rule all about?” With HIPAA, explained Dalton, the right to note access only applied if the provider was a HIPAA-covered entity (click here for a Covered Entity Decision Tool). The Information Blocking / Open Notes Rule extended these access rights to clients of all healthcare providers, regardless of HIPAA-covered entity status.

Also, the Open Notes Rule (ONR) specified that healthcare providers could not take any action that would interfere with the client’s access, exchange, or use of electronic health information (EHI), except as required by law.

“Is there any information I DON’T have to share?” “The main exclusion from the HIPAA Rights of Access were psychotherapy notes,” says Dalton. Also sometimes called “process notes,” these are optional notes some therapists keep in addition to their progress notes, defined by HIPAA as personal notes documenting or analyzing the contents of a counseling session, that are maintained separate from the rest of the client’s medical record (see my article on Progress vs. Psychotherapy notes – click here). These might include therapist thoughts about the client, about countertransference or transference, but can’t include factual details about treatment or from the session that should be in progress notes.

“HIPAA said the psychotherapy notes of HIPAA-covered entities don’t have to be released if kept separate from the medical record and if state law also protects them from release,” says Dalton. “But it’s important to note that psychotherapy notes can be subpoenaed, and states have different laws about whether psychotherapy notes are protected from release or not. Since many states do not protect psychotherapy notes from release, you need to check your state law,” she says. “And if you keep psychotherapy notes, it must be specified in your HIPAA Notice of Privacy Practices (NPP), and you should customize your NPP to your state law.”

“Are there any situations where I could refuse to share a client’s progress notes or chart when requested?” Dalton acknowledges “under certain limited circumstances outlined in HIPAA, a request for access may be denied.” Examples include when a licensed healthcare professional has determined in their professional judgment that it is reasonably likely to cause immediate danger to life or physical safety of the client or to another person, or when the release has come from someone other than the client and might lead to a breach of client confidentiality.

“If you do deny access, you have to thoroughly document this, state the reasons for the denial, and provide details to the client about their rights to appeal.” The client may be able to have another independent provider review the record and evaluate the denial.

“What if I think it would just cause emotional harm to the client?” “No, the harm prevention exception is very narrow,” says Dalton. “A client’s emotional distress is not grounds to deny access under the Information Blocking Rule,” she says.

“Do my state laws supersede HIPAA?” “Yes, if more restrictive,” says Dalton. “HIPAA is the floor, not the ceiling; HIPAA is a federal law, but does not override any State laws that provide individuals with greater rights of access to their health information than HIPAA does. So, it’s a good idea to research your state laws on client access.”

“I heard I don’t need to provide access to clients if my health record is not ONC-certified.” “Not true,” says Dalton. “No matter what kind of health record you use, you must follow the Information Blocking Rule and provide records when requested,” she states. “While ONC-certified systems give clients immediate and automatic access to records, there is no requirement to use an ONC-certified electronic health record.”

“Must I send clients a copy of each session note after I write it, or just if they ask for it?” “Only if the client requests it,” says Dalton. “You can require that a Release of Information (ROI) request be in writing, but that then needs to be disclosed in your HIPAA Notice of Privacy Practices (NPP).”

“So, I should treat record requests as routine?” Richard Leslie, attorney at CPH Insurance, writes that while some record requests are non-problematic, others come when there is some dissatisfaction with the services rendered. “One time when such dissatisfaction occurs is when a child is being treated during the course of a marital or custody dispute and one parent requests or demands a copy of the child’s records. In order to deal with such requests successfully it is important to know, among other things, when the time for compliance begins to run (for example, upon receipt of a written request), when a summary may be provided in lieu of providing the actual and full record, when a denial may or must be made, and when the child legally controls parental access to his or her records – even where the requesting parent has court-ordered sole or joint legal custody. A patient request for records should be distinguished from a subpoena for records – they present separate issues.”

“So Barbara, what tips do you and Liath have for writing notes, knowing that my client might ask to read them tomorrow?”

• Keep in mind when writing notes that the client might read it. Watch your wording. Be as objective in your descriptions as possible, and don’t use judgmental language, particularly about a client’s mental status.
• Consider using quotes in order to capture client issues accurately.
• “You might try collaborative documentation, where you write notes in session with your client’s input,” suggests Dalton.
• “However, avoid ‘sugarcoating’ a client’s symptoms out of concern for the client’s reaction if they were to read your notes,” says Dalton. “The record is part of the client’s treatment and must be accurate or else it can limit the client’s ability to receive appropriate care from other treating providers,” she says. Accuracy is also essential when documenting the medical necessity for treatment in order to ensure insurance coverage.

“Remember,” says Dalton, “it is the client’s medical record, part of their treatment. Their right of access is basically a human right of autonomy and choice. If all the information about the work you are doing with them is not accessible to the client, then they are limited in their ability to receive and make informed decisions about their own care.”

Have more questions? Don’t ask me! Contact the experts at PersonCenteredTech.com or check out the resources below:

• PCT Consultation: get direct support & consultation from PCT and Eric Ström, JD, PhD, LMHC, through their Office Hours and Group Practice Office Hours sessions, part of PCT’s Practice Care Premium service.
• PCT webinars:
  • How We Need to Give Clients Access to Their Records, Now and in the Future (2 legal-ethical CE credit hours), presented by Eric Ström, JD, PhD, LMHC, and Roy Huggins, LPC, NCC
  • The “Open Notes” Rule and Your EHR Choice: Legal Compliance and Client Safety Now and in The Future (2 legal-ethical CE credit hours), presented by Eric Ström, JD, PhD, LMHC, Rob Reinhardt, LCHMCS, M.Ed., NCC, and Roy Huggins, LPC, NCC
• PCT articles:
  • What do you need to know about the Information Blocking Final Rule?
  • Busting A Few Myths About Information Blocking, aka the “Open Notes Rule”
• PCT’s Group Practice Tech podcast: Episode 439: What Info is Actually Part of the Client’s Record
• Richard Leslie, CPH Insurance Avoiding Liability Bulletin, May 2025, Licensing Boards: It IS About Enforcement.