I’ve seen comments in various threads about having access to your therapy records that contained some misinformation due to the federal/state law division. It's a bit complicated, but I went thru this in depth a couple of years ago (caveat: my info is a couple of years old, but I don’t HIPAA has been amended re: psychotherapy since then), so I'll offer what I know and paste info from a APA document for what psychologists need to know about patient records and privacy re: HIPAA rules.

HIPAA sets a national standard of what states must allow. But HIPAA also says that those standards are a minimum, and that whenever a state has laws that provide greater patient privacy protection OR greater patient access rights, that those state provisions are the governing standard. My state, for instance, allows for more patient access than HIPAA requires, so I might have more access rights than someone in another state. T's can provide access to patients beyond those laws if they so choose.

HIPAA refers to 4 types of record information:

From APA:
“1. Health Information: Any information, whether oral or recorded in any form, created or used by health care professionals or health care entities.

2. Individually Identifiable Health Information: A subset of Health Information that either identifies the individual or that can be used to identify the individual.

3. Protected Health Information (PHI): Individually Identifiable Health Information
becomes Protected Health Information (PHI) when it is transmitted or maintained in any form or medium. More specifically, PHI is information that relates to the past, present or
future physical or mental health condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and that identifies the individual or could reasonably be used to identify the individual.

4. Psychotherapy Notes: Notes recorded in any medium by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint or family counseling session, and that are separated from the rest of the individual’s medical record. The definition in the privacy rule specifically excludes information pertaining to medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests and any summary of the following
items: diagnosis, functional status, the treatment plan, symptoms, prognosis and
progress to date.”

HIPAA, per APA, says:

" Patients Do Not Have The Right to: Inspect or obtain a copy of psychotherapy notes."

HIPAA grants rights to other parts of your records--"medical and billing records maintained by the provider and used to make decisions about the patient."

There's discussion in HIPAA of different kinds of records for therapists, and I don't know how they differentiate between psychotherapy notes and "medical records"--you can look up the legalese on that, but traditional therapy note record access isn’t guaranteed. APA and others have discussion of how T's should keep notes to comply with HIPAA and protect privacy. I don’t have anything on hand --and haven't looked at it in a couple of years--about trying to distinguish between "medical" and psychotherapy records to keep them out of the hands patients (if that's what they want). It seems that having notes as "psychotherapy notes" affords greater patient privacy from insurers and other 3rd parties, and the APA stuff I read offers focuses on that issue.

[There some tricky technical issues about how a T or facility transmits info to insurers or other 3rd parties as to how privacy is handled, but it’s not germane here. The impression I’ve gathered is that record-keeping is a major, major hassle for T’s in trying to keep records that service the multiple purposes, in particular in trying to safeguard patient’s privacy from third-parties (HMOs, etc) by keeping info as barebones as possible in certain types of records that 3rd parties can see rather than having just one info record that covers everything. Not to mention APA requirements, facility requirements, and insurer requirements, in addition to HIPAA and state laws. (As a health policy person I’d like to put in a plug for my favored type of health system that would eliminate so many bureaucratic levels from the picture, but I’ll refrain from politics. But imagine how much more time T's could devote to helping people if they didn’t have to spend so much time with paperwork).]

My state does allow T’s to refuse to release records to a patient if they think it might cause harm, but they are required to release them to another qualified mental health professional (however they define that) with patient permission and that other T’s request. Then that T can decide whether to let the patient see them or not. But that’s not part of HIPAA, that’s my state law that grants me that right.

I thought I’d read about states where you can see them but not have copies.

HIPAA doesn’t grant an automatic right to submit your own comments in amendment. T’s can stop you, per whatever reasons they allow in the laws.

I haven't hung around here or elsewhere before to hear about anyone’s absolute inability from HIPAA in getting his or her records, but, per HIPAA, that you aren't guaranteed the right as a national right.

Bottom line: You do not necessarily have a right to psychotherapy records per HIPAA. You might have access to them via your state laws, but that doesn't mean you do for sure because states differ.

All below quoted from APA:
“PATIENT ACCESS TO RECORDS

With limited exception, a patient is allowed to inspect and obtain a copy of PHI in a designated record set. The privacy rule defines a “designated record set” as the medical and billing records maintained by the provider and used to make decisions about the patient. Psychologists can require that the request be made in writing. In most cases, the request must be fulfilled within 30 days. Patients do not have the right to: A. Inspect or obtain a copy of psychotherapy notes B. Inspect information compiled in “reasonable
anticipation” of, or for use in, a civil, criminal or administrative action C. Access information systems that are used for quality control or peer-review analysis.

Psychologists will be required to have policies and procedures for assuring individuals’ access to their PHI. This will include putting a process in place to document the records that are accessed and by whom. It is important to note that in states that have laws
guaranteeing patient access to all the psychologist’s records, including psychotherapy notes, these laws will apply since they enhance a patient’s right of access to information.

PATIENT AMENDMENT OF RECORDS
“Right of amendment” refers to patients’ ability to request a change in their PHI if they feel the PHI is incorrect. A psychologist can deny requests for record amendments if he or she is not the originator of the information or if the information is accurate and complete.

Exception: If an individual provides a reasonable basis to believe that the originator of PHI is no longer available to act on the request, the psychologist must address the request as though he or she created the information. There will be a formal process for granting and denying requests to amend records.

Providers will be required to develop a procedure for granting and denying requests to amend records, which are governed by a relatively complex set of rules.* All communication relating to granting and denying requests must be included in a patient’s record. Any changes resulting from an amendment to the record do not expunge any prior information or part of the record; it is simply added to it.”