Revisiting Records: Guidance and Consideration on Best Practices

Record contents

State Boards are often sparse on language defining what is required of clinicians for their clients’ records. They may not offer much in the way of guidance beyond the bare minimum of dates and types of service, and that’s because many of the record content requirements are often associated with the standard of care of the profession at a whole (and in fact, some states, such as California, will explicitly state records to be kept to “the standards of the profession”).

This is because such vague language allows for the flexibility for the huge range of human experience and conditions that clinicians encounter as part of their practice. There is likely no regulation we can point to that says “Leaving a surgical sponge inside the patient is unprofessional conduct,” and yet we still know that doing so is negligent and a violation of the standard of care to which a reasonable surgeon would adhere. Similarly, there are unlikely to be regulations stating “it is unprofessional conduct to fail to include A-Y in the patient’s record.” These standards are intentionally broad to encapsulate a wider range of negligent behavior defined by the profession itself. If the Board says records must include A-Y, they could fail to envision a scenario where Z is also clinically important and should be documented. Rather than list every single criterion that could ever be medically relevant, they keep it vague. This also allows the standards to change as our understanding of medicine and what’s reasonable treatment changes. Lobotomies used to be acceptable care and treatment for various mental illnesses, but doing so today rather than talk therapy and medication management would be considered egregious and malpractice. It may be that as electronic records become more commonplace, additional or different types of information become more clinically appropriate for the record set.

If you’re still not clear on what should go into a record set, we can look at an example of state regulation. One state law specifying the mandatory content of a summary of the records gives practitioners useful information as to the possible content of the full record. The law specifies that the summary must contain information such as the chief complaint or complaints, pertinent history, findings from consultations and referrals to other healthcare providers, diagnosis (where determined), progress of treatment, prognosis (including significant continuing problems or conditions), pertinent reports of diagnostic procedures and tests and all discharge summaries, and objective findings from the most recent physical exam.

HIPAA (the “Privacy Rule”) also provides useful information regarding the content of records. The regulation describes records as including items such as medication prescription and monitoring, session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. It is always important to accurately document all billings and payments so as to avoid fee disputes with clients. AAMFT’s Code of Ethics provides that MFTs maintain accurate and adequate clinical and financial records.

Some clinicians err on the side of the less said, the better when worried about clients who will be upset by the record contents or their possible use in litigation. But this isn’t always in the best interest of the client, or the clinician. The record set is the documentation of your work with the client and their continuum of care. If a complaint or malpractice suit came from a disgruntled client, what do you have to stand on to show that you followed your profession’s clinical and ethical best practices? If a client is discriminated against at work and wants to show damages in a lawsuit involving their employer, can they rely on an accurate recounting of the symptoms they discussed with you? Is your client’s insurance company, who is tracking whether the sessions are clinically necessary, going to deny you reimbursement or your client further coverage? If the client moves (or you experience an emergency and stop practice) and requests the records be transferred, is a new clinician going to be able to orient themselves to the client’s past work and progress? How does record keeping change when you have a client who is high risk for suicidal or homicidal ideation? Are you documenting referrals to doctors or medical providers who can provide medication management? Consultations with attorneys or other clinicians on difficult cases?

Keeping accurate and thorough notes can save both of you time and stress in the long run.

Ultimately, when entering records, it’s important to remember that the information contained is an important resource for your client and FOR YOU. Is your client going to be happy seeing only one or two sentences per session when it comes time to transfer care? Are you comfortable facing a board complaint with only a dozen or so words to describe each meeting? Keeping accurate and thorough notes can save both of you time and stress in the long run.

Records and AI

As AI explodes across different industries, clinicians may wonder about whether they can use this technology in their own practice, particularly for administrative work like generating records. From a legal and ethical perspective, clinicians should take steps to be aware of whether using such software would be in violation of federal or state law on confidentiality. Even where the law doesn’t preclude AI use, therapists need to be proactive in evaluating its ethical risks.

First, clinicians need to evaluate whether using the software itself is a violation of either state or federal law. Federally, one would need to examine whether the software is HIPAA compliant. Much of AI is data aggregation, mining, and pattern recognition, which builds off other user’s input. If you are passing client information into a software that then stores it, unprotected and unencrypted for later search and reuse by other parties, that’s a clear violation of confidentiality. Additionally, whenever a covered entity is passing any PHI to a third-party entity for healthcare operations, they need to have a Business Associate Agreement in place. And HIPAA is the absolute floor for client confidentiality and privacy—your state could be stricter on that front and have a code or regulation which would prevent the use of even HIPAA-compliant AI software.

Even if those hurdles have past, clinicians need to do an evaluation of its ethical use. How is the AI obtaining this data? Is it obtaining the data through use of audio/video recording? Have they gotten permission to record the sessions and let the clients know what is being done with the recordings and how their privacy is maintained? How is the accuracy of transcription confirmed and by whom? Anecdotally, there are many cases where AI is giving confidently incorrect answers with false citations. If AI starts plugging incorrect information into your client’s health record, this creates a liability for practitioners and a health issue for the clients who now have an inaccurate history to give to other health professionals, employers, or courts.

Ultimately, AAMFT is not opposed to the lawful and ethical use of technology to empower clinicians, and to expand access to mental health. But, like any new tool/modality/practice, clinicians need to take a comprehensive approach before adding it to their repertoire. What are state and local laws that might affect its use? What are the ethical or legal implications and risks of using it and what steps can be taken to mitigate these risks? Ultimately, it’s a question of a clinician’s personal choice and willingness to accept the risk of AI use after balancing these considerations and developing clear policies to ensure safe and ethical compliance with appropriate standards of care.

Record keeping procedures

Just as there is no standard on what is in a record, clinicians would be hard-pressed to find official documentation on when a record must be entered. Ethically, notes are best entered as soon after the session as possible, to ensure accuracy and completeness. In practice, therapists will probably not be facing hard deadlines or board complaints for running a bit behind in note entry, but if there is too much of a delay between session and record generation, they could encounter problems entering notes to an accurate and thorough standard.

Confidentiality on records is a big concern and could be its own series of articles. Your client is entitled to your due diligence in keeping their confidentiality in all aspects, including physical or electronic record keeping. Locked filing cabinets, password protection, encryption, and proper vetting and business associate agreements with third-party contractors/software are essential to the practice of mental health. Take a look at the HHS’s guidance on security for records and Protected Health Information here.

Negligence in record keeping is not only subject to penalties for violation of state or federal law, but can also lead to malpractice claims for damages. Clients come into therapy with expectations of confidentiality, expectations you reinforce with your intake paperwork and conversations about confidentiality, privilege, and its exceptions. If you fail to make appropriate safeguards for physical or electronic information, you could face a vast array of consequences on multiple fronts.

If you are a covered entity under HIPAA, you may also have certain obligations to inform clients when a breach occurs, and information is lost, stolen, or destroyed. If you suspect client records have been subject to unauthorized access, you should consult with an attorney or your liability carrier in a timely fashion, as the discovery of a breach usually starts the clock on strict statutory timelines for informing clients and government regulators.

Record retention

The length of time a record must be retained post-client departure is often state specific, and can run the gamut from five to seven, or 10 years. Usually, the countdown begins from the client’s last date of service. For minors, laws will generally specify a time frame to maintain records for a period after the client attains the age of majority.

Although state interpretation may vary, a client who drifts in and out of treatment may require a lengthy record, retained for a significant period. Generally, clinicians do not incur penalties or problems for retaining past these statutory minimums, and for the in-and-out-again client, it may be best to keep the record set for a longer period.

The concerns most clinicians have with records and storage tend to be around the costs of storage, maintenance, liability, and lawsuits. Destroying records after the lawful retention period has lapsed could prevent clinicians from being pulled into court, cut down on storage fees, and reduce the pool of clients that have data compromised in the event of a breach. It’s on individual therapists to know the record retention period for their respective states, to safeguard information until that point, and to balance the pros and cons of destruction vs storage for when it becomes legal to dispose of record sets.

Records access

Even if they don’t own records, clients usually have very strong rights under state and federal law to access, inspect, and receive copies of their own records or those of minors over whom they have legal custodianship. Clinicians frequently call in with concerns about releasing full records, whether summaries are permissible in lieu of progress notes, and who can access records for what reasons. Again, state laws vary, but usually come down very strongly in favor of the client’s rights to access records, so long as the necessary client (or clients) have given authorization for release. When dealing with multiple clients and who must consent, consult both AAMFT’s own Code and State law.

Summaries vs. Record Sets:

Under Federal Law, specifically HIPAA, clients do have the right to request and receive almost the entirety of their record. Summaries are only acceptable if the individual who is requesting them:

(1) chooses to receive the summary or explanation (including in the electronic or paper form being offered by the covered entity); and

(2) agrees to any fees (as explained below in the Section describing permissible Fees for Copies) that may be charged by the covered entity for the summary or explanation [From the HHS]

The psychotherapy notes exception

There is a psychotherapy notes exception to HIPAA, which allows clinicians to hold back these notes even from the client who is the subject of them, but this exception is very limited in scope and circumstances. If you store psychotherapy notes with the entirety of the record (not kept in a separate folder or separate documentation area on an EHR), it becomes part of the record and can’t be withheld. Additionally, some states will not recognize this exception and require full disclosure of records when requested.

For those states that do recognize the exception, here is context on what is considered psychotherapy notes and what is not:

Psychotherapy notes mean notes recorded (in any medium) by a healthcare provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual‘s medical record.

Psychotherapy notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

These are direct quotes from Federal Law (CFR 45 -164.501) with my emphasis added. As you can see, clients are still entitled to records of all diagnoses, treatment plans, treatment types/modalities, symptoms and progress notes, which aren’t considered privileged. Moreover, as mentioned previously, psychotherapy notes that are not kept apart from these other records no longer have the same privilege, and they become part of the whole of the record to which the client is entitled.

Grounds for denial

Generally, there is an exception to record release if you believe that there is imminent risk of physical harm to the client, e.g., they would commit suicide if they received these records, or if you have grounds to believe that the requestor has or will use the records to abuse, neglect, or perpetrate violence on the subject of the record. These exceptions should be very rare and cannot be based on a clinician’s concerns that the records or their contents might be upsetting. Again, to quote the HHS’s stance on HIPAA, denials can be made when:

• The access requested is reasonably likely to endanger the life or physical safety of the individual or another person.  This ground for denial does not extend to concerns about psychological or emotional harm (e.g., concerns that the individual will not be able to understand the information or may be upset by it).
• The access requested is reasonably likely to cause substantial harm to a person (other than a healthcare provider) referenced in the PHI.

If you deny for your client’s life or physical safety, the client can appeal or file a complaint. Be prepared to back up why you think this release would trigger your client to commit self-harm (such as recent suicidal ideation, recent inpatient hospitalization for suicide, etc.).

The safest route for you and your license is to release the records in their entirety. Trying to withhold records from clients can open legal issues, including claims that the client’s rights are being violated. Expect every denial to lead to a complaint. Would you have clear evidence you would be able to present, showing that you didn’t release because of 1) the risk of the client’s or another’s physical safety, or 2) that you withheld psychotherapy notes and can prove that such notes both: A) didn’t include any information or notes considered exempt from the definition of psychotherapy notes and B) were kept bifurcated and separate from the rest of the treatment record. Again, withholding anything is usually inadvisable and risky, from a legal standpoint.

Record ownership and the end of practice/employment

What if the client, upon termination of the relationship, requests that the therapist destroy all treatment records? If the therapist is considered to be the owner of the records, as is the case in most jurisdictions, the therapist will usually tell the client that the records will not be destroyed or “handed over.” While clients often have certain rights regarding access to the records (e.g., inspection and copying), they usually have no right to compel therapists to destroy or “return” all records. When clients make such requests, they generally do so either because of a concern about their privacy and confidentiality, or because they are upset with the results or direction of therapy and want possibly negative evidence suppressed. Neither reason is generally sufficient to warrant destruction or “returning” of the records.

Ownership of records often becomes an issue when an employee or independent contractor, after working for an agency (non-profit) or for any individual or entity, leaves the employment voluntarily or is fired. Does the departing therapist take the files with her? Does the agency or other entity keep a copy of the records?  The answers to these questions depend upon whether the client decides to stay at the agency (the employer) and have a new therapist assigned to the case, or whether the client decides to leave the agency and continues to be seen by the same therapist in a new setting.

>>Pick up a copy of AAMFT’s new Systemic Ethics Textbook today!

It is important to determine whom the client pays (the treating therapist or the employer) because often that will be the person or entity who “owns” the records. If the client decides to continue treatment with the departing therapist, it is important for the therapist to have at least a copy of the records so that treatment is not impaired. The employer should keep at least a copy of the record since it is important for them to have documentation of the treatment that was provided while the client was in their care. In the event that the client were to decide to stay at the agency and to see another therapist, the departing therapist would ordinarily not need and not be entitled to take a copy of the records to their new location. Were the clielnt to later transfer from the agency back to the departing therapist, a copy of the agency’s records could then be obtained.

Of course, as time passes, some records will qualify for destruction simply because of the amount of time that has passed since the termination of treatment.

Because the clinician or their practice is frequently the owner of a record set, when a therapist ends practice, records should be protected and not destroyed, especially with respect to current or recently terminated clients. Even if a therapist has passed away, records must still be maintained by statute. This duty usually devolves to the spouse or partner of the deceased therapist, who may be named executor or trustee, or to the attorney hired to represent the estate. There are several reasons to protect the records. The client may need the records for litigation or for continued treatment purposes. Additionally, the estate may be subjected to liability for the acts of the therapist when alive, and the records might help the estate defend an action that may be brought. In some states, statutes allow for the destruction of records within a certain period of time following the death of the practitioner, or within a period of time specified in a notice of death published under specified guidelines in a newspaper of general circulation. Of course, as time passes, some records will qualify for destruction simply because of the amount of time that has passed since the termination of treatment.

Survivors of employed therapists usually have no problems with respect to records, since generally, the records belong to the employer. The survivors of those in solo private practice, however, if not prepared, can be left confused and without direction. They can be more prepared if therapists talk with the attorney who has prepared or will prepare the therapist’s will or trust. Those documents can be drafted so as to instruct the executor or trustee to gather all client records and to protect them so that confidentiality is preserved. Unless the therapist has informed the attorney drafting the will or trust, or the spouse or partner, regarding applicable law, the executor or trustee (or perhaps the attorney representing the estate) must take responsibility for ascertaining whether there are any requirements for publication of a notice of death in a newspaper or for directly notifying clients of the therapist’s death and the whereabouts of the records.

There are other steps that therapists can take that will make it easier for their survivors. For instance, a therapist can enter into an agreement with one or more colleagues who have similar concerns so that each will assume the responsibility, in the event of the death of one of them, to safeguard records and to inform current clients of the therapist’s death. The agreement can also provide for help with an appropriate referral, and where necessary, for meeting with the client in order to deal with any emotional reaction and to assist with the transition to another therapist. When this kind of mutual arrangement is made, clients can be informed, at some point in the therapy, of the arrangements made. Such mutual agreements should be in writing and should be carefully drafted.

See more on AAMFT’s legal and ethical information here.