Clinical records are one of the most important aspects of clinical practice — and one of the areas that generate the most questions for therapists.

What should I document?
How long do I need to retain records?
Can I use electronic health records (EHR)?
How do I ensure compliance with HIPAA and APA guidelines?
What happens if I don't keep proper records?

If you've asked yourself any of these questions, this guide is for you.

We've compiled 15 questions and answers about clinical documentation for therapists, based on APA Record Keeping Guidelines, HIPAA regulations, and state licensing board requirements.

What you'll learn:

Definition and importance of clinical records
What must be included in documentation
HIPAA and APA requirements
Paper vs. electronic records
How to organize and maintain clinical records

Reading time: 10 minutes

📑 Questions and Answers About Clinical Records for Therapists

1. What Are Clinical Records in Psychotherapy?

Clinical records (also called the clinical chart or client file) are the official documentation of the entire therapeutic process, from intake through termination.

A complete clinical record typically includes:

Client demographic and contact information
Intake assessment and biopsychosocial history
Progress notes for each session (DAP, SOAP, or narrative format)
Diagnostic impressions and clinical formulation (when applicable)
Treatment plan with goals and objectives
Ancillary documents (consent forms, referral letters, correspondence)

Purpose: Ensure continuity of care, document the treatment process, and protect both clinician and client in the event of ethical complaints, audits, or legal proceedings.

2. Are Clinical Records Required?

Yes. The APA Record Keeping Guidelines (2007) strongly recommend that psychologists create and maintain adequate records. Most state licensing boards require it by law.

APA Guideline 1: "Psychologists strive to maintain accurate, current, and pertinent records of professional services as required by law, institutional requirements, or the nature of the service."

Failure to maintain proper records can result in:

Disciplinary action by your state licensing board
License suspension or revocation
Fines and sanctions
Inability to defend yourself in malpractice claims or ethics complaints

3. What Should I Document in Clinical Records?

According to the APA Record Keeping Guidelines and standard clinical practice, your records should contain:

Essential Documentation:

Client identifying information (full name, date of birth, contact information, emergency contact)
Clinician identifying information (name, license number, NPI)
Date and duration of each session
Progress notes (presenting concerns, clinical observations, interventions used)
Interventions and techniques applied (CBT techniques, EMDR, etc.)
Clinical progress and outcomes (improvements, setbacks, goal tracking)
Treatment plan (goals, objectives, modality, estimated timeline)
Informed consent documentation
Risk assessments (suicidality, homicidality, abuse)

💡 Practical rule: Document information that is clinically relevant and that would help any qualified clinician understand the case and continue care if needed.

4. How Long Must I Retain Clinical Records?

It varies by state, but typically 7 years after the last date of service for adults.

Key guidelines:

APA recommendation: Full records for at least 7 years after the last date of service
Minors: Until the client reaches age 18 (or 21 in some states) PLUS the applicable retention period
HIPAA: Requires covered entities to retain records for at least 6 years
State laws: Check your state's specific requirements — some require 10+ years

After the retention period: You may destroy records, but many clinicians choose to retain them longer for safety — especially with electronic records where storage costs are negligible.

⚠️ Important: The clock starts from the last date of service, not the first. If a client returns after 3 years, the retention period resets.

5. Can I Use Electronic Health Records (EHR)?

Yes. Both the APA and HIPAA permit electronic records, provided they meet specific security and privacy requirements:

Client confidentiality and privacy protections
Data security (encryption at rest and in transit)
Data integrity (audit trails for any changes)
Access controls (role-based access, authentication logs)
HIPAA-compliant hosting and Business Associate Agreements (BAAs)

Advantages of electronic records:

✅ Automatic cloud backup (no loss from fire, theft, or hardware failure)
✅ Fast search and retrieval of information
✅ Secure access from anywhere (with proper authentication)
✅ Simplified HIPAA compliance
✅ Automatic organization by client

Disadvantages:

❌ Monthly subscription cost (for dedicated EHR platforms)
❌ Initial learning curve
❌ Technology dependence

6. How Do I Ensure HIPAA Compliance?

The Health Insurance Portability and Accountability Act (HIPAA) sets the federal standard for protecting sensitive health information. Mental health records are considered Protected Health Information (PHI) — subject to strict regulations.

What You Need to Do:

📝 Notice of Privacy Practices (NPP)

You must provide clients with a written Notice of Privacy Practices explaining how their PHI is used, stored, and disclosed.

Your NPP should explain: what information is collected, how it's used, when it may be disclosed (e.g., court orders, duty to warn), and the client's rights regarding their records.

🔒 Administrative, Physical, and Technical Safeguards

Paper: Locked filing cabinet, restricted access, secure office
Electronic: Encryption, strong passwords, HIPAA-compliant software with signed BAA

👤 Access Controls

Only authorized individuals can access records. Maintain audit logs showing who accessed what and when.

🗑️ Secure Disposal

When records are no longer needed (after the retention period), they must be destroyed securely — shredding for paper, certified data wiping for electronic files.

📄 Business Associate Agreements (BAAs)

Any third-party vendor who handles PHI on your behalf (EHR, cloud storage, billing service) must sign a BAA.

⚠️ Warning: HIPAA violations can result in civil penalties ranging from $100 to $50,000 per violation, with annual maximums of $1.5 million. Criminal penalties can include fines up to $250,000 and imprisonment.

7. Who Can Access a Client's Clinical Records?

Access is restricted:

You (the treating clinician) — always
The client — has a right to access their records under HIPAA
Other providers — only with a signed release of information (ROI) from the client
Courts — via valid subpoena or court order
Insurance companies — for claims processing (with client authorization)
State licensing boards — during investigations

⚠️ Important: Family members do NOT automatically have access, even spouses or parents of adult clients. A signed authorization is required.

Exception: For minors, legal guardians generally have access — but clinicians may withhold certain information if disclosure could harm the child (varies by state).

8. Should I Let Clients Read Their Records?

Yes, if they request it.

Under HIPAA's Privacy Rule, clients have a right to access their own health records, including psychotherapy notes (though you may restrict access to process/psychotherapy notes in some cases).

How to handle a records request:

Client submits a written request
You provide a copy (not the original) within 30 days
You may offer a session to review the records together and address questions
Do not alter or omit information, but you may provide clinical context

⚠️ Exception: HIPAA allows you to deny access if disclosure would reasonably endanger the life or physical safety of the client or another person. This must be documented and is subject to review.

9. How Should I Organize Paper Records?

Recommended system:

One file per client (never combine multiple clients in a single notebook)
Individual folder or binder for each client
Organized filing by alphabetical order or client ID number
Locked filing cabinet (physical security is required by HIPAA)
Discreet labeling (don't put the client's full name on the exterior in plain view)

Recommended file structure:

Client File [Name/ID]
├── Informed Consent & Practice Policies
├── Notice of Privacy Practices (signed)
├── Intake Assessment / Biopsychosocial
├── Treatment Plan
├── Progress Notes (chronological)
├── Risk Assessments
└── Ancillary Documents (referrals, correspondence, releases)

10. How Should I Organize Electronic Records?

Options:

❌ Option 1: Folders on Your Computer (NOT Recommended)

Risk of data loss (hard drive failure, theft)
Difficult to ensure HIPAA compliance
No automatic backup
No audit trail

✅ Option 2: HIPAA-Compliant EHR Software (Recommended)

Automatic cloud backup with encryption
Built-in data encryption (at rest and in transit)
Automatic organization by client
Fast search and retrieval
HIPAA compliance built in (with signed BAA)

💡 Example of EHR organization: Each client has an individual record, progress notes are organized chronologically, documents are linked to the client profile, and the system generates access logs automatically for HIPAA compliance.

11. What Should I NOT Write in Clinical Records?

Avoid:

❌ Personal judgments or non-clinical opinions

"Client is annoying" → ❌
"Client demonstrates resistance to the therapeutic process" → ✅

❌ Gossip or clinically irrelevant information
Do not document details that have no bearing on clinical care or treatment planning.

❌ Third-party information without clinical relevance
If a client discusses others, only record what's relevant to understanding the clinical picture.

❌ Verbatim session transcripts
Not necessary or recommended. Document key themes, interventions, and clinical observations instead.

💡 Rule of thumb: If it's not clinically relevant, don't write it. Ask yourself: "Would I be comfortable if this note were read by a judge, a licensing board, or the client?"

12. What's the Difference Between Progress Notes and Psychotherapy Notes?

This is a critical distinction under HIPAA:

Progress notes (part of the medical record): Document the session date, interventions, diagnosis, treatment plan progress, and clinical observations. These are subject to standard HIPAA disclosure rules.
Psychotherapy notes (also called "process notes"): Your private notes about session content, impressions, and hypotheses. Under HIPAA, these receive extra protection — they cannot be released without specific client authorization, even to insurance companies.

💡 Key point: Progress notes go in the official client record. Psychotherapy notes should be stored separately and have additional protections under HIPAA.

13. What Are Common Progress Note Formats?

Popular formats used in therapy:

📝 DAP Notes (Data, Assessment, Plan)

Data: What the client reported and what you observed
Assessment: Your clinical interpretation and impressions
Plan: Next steps, homework, and goals for next session

📝 SOAP Notes (Subjective, Objective, Assessment, Plan)

Subjective: Client's self-reported experiences and concerns
Objective: Your observations (affect, behavior, appearance)
Assessment: Clinical interpretation and diagnostic impressions
Plan: Treatment modifications, referrals, next session focus

📝 BIRP Notes (Behavior, Intervention, Response, Plan)

Behavior: Observable behavior and presenting issues
Intervention: Techniques and strategies used
Response: Client's response to interventions
Plan: Goals and plan for future sessions

💡 Tip: Choose one format and use it consistently. DAP notes are the most popular among therapists in private practice for their simplicity and thoroughness.

14. How Do I Transfer Records to Another Clinician?

Process:

Client requests the transfer (verbally or in writing)
Client signs a Release of Information (ROI) authorizing disclosure to the new provider
You send a copy of relevant records to the new clinician (via secure, HIPAA-compliant method)
You retain the originals (your retention obligation continues)

Sample ROI language:

"I, [Client Name], authorize [Your Name, License #] to release my clinical records to [New Provider Name] for the purpose of continuity of care. This authorization expires on [date] and may be revoked in writing at any time."

15. Can I Destroy Old Records?

Yes, after the retention period required by your state and federal law has passed.

How to destroy records securely:

📄 Paper Records:

Cross-cut shredding (don't just throw them away)
Professional document destruction services (with certificate of destruction)

💻 Electronic Records:

Permanent deletion (not just moving to the recycle bin)
Removal from all backups
Use certified data wiping tools that overwrite the data
Physical destruction of storage media if decommissioning hardware

💡 Important: Even after the required retention period, many clinicians choose to keep records indefinitely — especially electronic records where storage is virtually free. When in doubt, keep them.

Conclusion

Clinical records are fundamental to your professional practice. They:

✅ Are required by law and professional standards
✅ Protect you legally and professionally
✅ Ensure continuity of care
✅ Document your clinical work
✅ Support HIPAA compliance

Quick checklist:

I maintain a clinical record for every client
I document every session with progress notes
I store records securely (physical or electronic)
I have signed informed consent and HIPAA acknowledgment for each client
I know my state's record retention requirements

Keep Clinical Records Secure and Organized with DOPU

DOPU offers electronic clinical records built for therapists with compliance in mind:

✅ Templates designed for therapy (intake, progress notes, treatment plans)
✅ Encryption and automatic cloud backup
✅ Automatic organization by client
✅ Fast search and retrieval
✅ Built-in consent and intake forms
✅ Access logs for compliance auditing

💡 Free trial:

Try DOPU free for 14 days and see how it simplifies your clinical documentation.

Secure, Organized Clinical Records

Try DOPU free for 14 days and keep your clinical records fully compliant and organized.

Start Your Free Trial

✓ HIPAA-Ready · ✓ Encrypted · ✓ Automatic Backup

Clinical Records for Therapists: Complete Guide (APA + HIPAA)