What HIPAA Actually Requires in a Progress Note

Search for "HIPAA compliant progress notes" and you will find a lot of checklists that mix three separate things: what the Privacy Rule says about note content, what it says about who can read the note, and what it says about the vendor you use to write it.

Those are different questions with different answers. Getting them mixed up is how practices end up either over-documenting out of fear or under-documenting out of confidence.

This article separates them. It is general information, not legal advice — your state law, payer contracts, and professional board may add requirements, and you should confirm specifics with a compliance advisor.

First: is your note a progress note or a psychotherapy note?

This distinction drives almost everything else.

Under the HIPAA Privacy Rule (45 CFR 164.501), psychotherapy notes are notes recorded by a mental health professional documenting or analysing the contents of a conversation during a private counselling session, kept separate from the rest of the medical record. The definition explicitly excludes:

• Medication prescription and monitoring
• Counselling session start and stop times
• The modalities and frequencies of treatment
• Results of clinical tests
• Any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date

That exclusion list is essentially a description of a progress note. Which means: the note you write for billing and continuity is a progress note, and it belongs in the medical record. It is not a psychotherapy note, no matter how it feels.

This matters for two reasons. Psychotherapy notes have extra protection and generally require a specific authorization to disclose. Progress notes are part of the designated record set, which means the client can generally request them. If you write something in a progress note that you would not want the client to read, you have put it in the wrong document.

What the note itself should contain

HIPAA does not prescribe a note template. It regulates use, disclosure, and safeguards. But the documentation expectations that come from payers, state licensing boards, and malpractice carriers converge on the same content:

• Date of service, session length, and modality
• Presenting problem and current status
• Observable clinical findings
• Intervention provided
• Response to intervention
• Risk assessment and outcome
• Plan, including next appointment

Where HIPAA does bear directly on content is the minimum necessary principle. For treatment purposes the standard is applied loosely — treating providers generally need the full clinical picture — but the principle still argues against recording details that serve no clinical or legal purpose. The client's employer name, the names of third parties who are not clients, and incidental details from a conversation that have no bearing on treatment all add risk without adding clinical value.

Who can read it

A client can generally request their record, including progress notes. There are limited grounds for withholding, and they are narrow. Practically, this means writing every note as though the client may read it — which, in my experience of how these documents are written, tends to improve them.

Disclosures to other providers for treatment generally do not require authorization. Disclosures for anything else usually do, with the standard exceptions (serious threat, abuse reporting, court order, and so on).

The vendor question, which is where most practices get stuck

The part of HIPAA that bites when you adopt a documentation tool is the business associate rule. If a vendor creates, receives, maintains, or transmits protected health information on your behalf, that vendor is generally a business associate, and a business associate agreement (BAA) is generally required.

So the practical question for any note tool is simple and answerable: does PHI reach the vendor?

There are three possible answers, and they lead to different obligations.

Yes, PHI reaches the vendor. A BAA is needed. If the vendor will not sign one, that is the answer to your procurement question.

No PHI reaches the vendor, because de-identification happens before transmission. This is an architectural claim, and it should be verifiable rather than asserted. Ask where the redaction runs, whether the original text is ever transmitted, and whether session content is stored. If the redaction runs in the browser and only the redacted text is sent, the vendor never receives identifiers.

The vendor says it is "HIPAA compliant" and stops there. That phrase is marketing, not a legal status. It does not tell you whether a BAA exists, whether data is retained, or whether the vendor's subcontractors are covered.

Two follow-up questions are worth asking of any vendor, including the ones with badges on their homepage:

1. Do you store the note content, and for how long? Retention is the difference between a tool and a record system you now have to secure.
2. Is client data used for model training? For AI drafting tools this is the question, and the answer should be in writing.

Safeguards around the note

Once the note exists in your records, HIPAA's Security Rule applies: access controls, audit logging where appropriate, encryption in transit and at rest, and a breach notification process. Encryption is technically an "addressable" implementation specification, but unencrypted PHI triggers a presumption of breach if a device is lost, which is a practical argument for encrypting everything.

Retention periods come from state law and payer contracts, not from HIPAA itself. Most states set a minimum of several years past the last service date, and minors often have longer requirements.

A short, honest checklist

• Treat progress notes as part of the record the client can request.
• Put conjecture, personal impressions, and third-party detail in a separate psychotherapy note, not in the progress note.
• Write enough to justify the service and support continuity — no more.
• Screen for risk and record the result, every session.
• For any documentation vendor: establish whether PHI reaches them, whether a BAA is in place, whether content is retained, and whether it is used for training.
• Verify against your state board and payer contracts, which are often stricter than HIPAA.

If you want to see how a de-identified drafting workflow actually behaves, the generator runs redaction in the browser before anything is transmitted, and the HIPAA statement describes what it does and does not claim. We do not hold ourselves out as a covered entity or as a signing party for a BAA — the design goal is that no PHI reaches the server in the first place.

FAQ

Are progress notes covered by HIPAA?

Yes. Progress notes are part of the medical record and are protected health information. They are generally included in a client's right of access, unlike psychotherapy notes, which have separate and stronger protections.

Do I need a BAA with an AI note-writing tool?

If the tool receives protected health information, it is likely a business associate and a BAA is generally required. If de-identification genuinely happens before transmission and no PHI reaches the vendor, the analysis changes — which is why the architecture question matters more than the compliance badge.

Can I paste a session transcript into an AI chatbot?

A transcript containing names, dates, or other identifiers is PHI. Pasting it into a consumer chatbot with no BAA is a disclosure to a vendor without an agreement. Redact first, or use a tool whose architecture keeps identifiers on your machine.

How long should I keep progress notes?

HIPAA does not set the retention period. State law and payer contracts do, and requirements vary — commonly several years past the last date of service, longer for minors. Check your state board's rule rather than relying on a general figure.