Draft SOAP, DAP, BIRP, GIRP, and PIE progress notes in a HIPAA compliant note taking app built for therapy. Professional and Enterprise plans add a BAA to encryption, role-aware access, audit logging, and clinician review.
The distinction most software gets wrong
HIPAA separates private psychotherapy notes from the medical record. That distinction affects disclosure authorization, right-of-access requests, and subpoenas. Emosapien drafts progress notes for clinician review, while your practice remains responsible for maintaining its separate psychotherapy-note workflow.
| Aspect | Psychotherapy notes | Progress notes |
|---|---|---|
| Definition | Therapist’s personal process notes: analysis, hypotheses, countertransference, working impressions kept separate from the medical record. | The clinical record itself: what was discussed, the intervention used, the response, the plan. |
| HIPAA treatment | Defined at 45 CFR § 164.501; generally requires specific authorization for disclosure under 45 CFR § 164.508(a)(2); excluded from client right of access under 45 CFR § 164.524(a)(1)(i). | Standard PHI under HIPAA. Subject to right of access, breach-notification rules, and minimum-necessary disclosure. |
| Storage requirement | Must be separated from the rest of the medical record. | Lives inside the medical record. Available to other treating clinicians on a need-to-know basis. |
Therapist’s personal process notes: analysis, hypotheses, countertransference, working impressions kept separate from the medical record.
The clinical record itself: what was discussed, the intervention used, the response, the plan.
Defined at 45 CFR § 164.501; generally requires specific authorization for disclosure under 45 CFR § 164.508(a)(2); excluded from client right of access under 45 CFR § 164.524(a)(1)(i).
Standard PHI under HIPAA. Subject to right of access, breach-notification rules, and minimum-necessary disclosure.
Must be separated from the rest of the medical record.
Lives inside the medical record. Available to other treating clinicians on a need-to-know basis.
For a clinical reference on the private process-note category, use the psychotherapy notes sample before adding private analysis or working impressions to your documentation process.
Security controls around therapy documentation
Emosapien combines BAA availability, encryption, access controls, audit logging, a no-public-model-training policy, and clinician sign-off in one HIPAA compliant note taking app for therapists.
Session data, progress notes, and client records stay encrypted during transmission and storage.
A BAA is available on Professional and Enterprise plans before a covered entity sends PHI through Emosapien.
The Safety and Compliance Agent supports consent management and audit logging around sensitive actions.
Role-based controls help practices limit access to the clinicians and staff who need the record.
Session content is not used to train public models. Your practice or organization owns its client data.
Emosapien drafts the progress note, then the clinician reviews, edits, and signs it before it becomes part of the record.
Beyond HIPAA
HIPAA covers the federal baseline. The professional bodies you are accountable to expect more, and so do the state-specific and international rules that apply to therapy specifically.
HIPAA works alongside professional ethics, licensure rules, and your practice policies for consent and disclosure.
State law can give clients stronger privacy rights or add rules for minors, parental access, and record retention.
Some SUD treatment records fall under 42 CFR Part 2. Confirm whether Part 2 applies and document the required consent workflow before processing those records.
HIPAA does not replace GDPR, UK GDPR, or local privacy law when a practice serves clients across borders.
It’s like having an assistant that helps me keep track of each client’s needs in real time.
Progress notes are part of the clinical record. Psychotherapy notes are a therapist’s private analysis or process notes kept separately from the medical record. HIPAA defines them at 45 CFR § 164.501, generally requires specific authorization for disclosure under 45 CFR § 164.508(a)(2), and excludes them from the client right of access under 45 CFR § 164.524(a)(1)(i).
A BAA is available on Professional and Enterprise plans. Covered entities should review the HHS business associate guidance and put the agreement in place before sending PHI through Emosapien.
Emosapien drafts SOAP, DAP, BIRP, GIRP, and PIE progress notes from the session. The clinician reviews, edits, and signs each note before it becomes part of the record.
HIPAA’s right of access generally applies to progress notes in the designated record set. Psychotherapy notes maintained separately are excluded from that right under 45 CFR § 164.524(a)(1)(i). Your practice remains responsible for reviewing and responding to each request.
Yes. Emosapien drafts SOAP progress notes from the session, then you review, edit, and sign. Professional and Enterprise plans add a BAA for covered-entity workflows. You can test the format with the free SOAP note generator using de-identified information.
Yes. On Professional and Enterprise plans, Emosapien works as a HIPAA compliant note taking app for therapists with BAA availability, encryption in transit and at rest, role-aware access, audit logging, no public-model training on session content, and clinician review before signing.
HIPAA does not govern UK therapy records. UK practices should treat therapy notes as special-category health data and review processor contracts before sending client data through AI notes. US practices can use the HIPAA regulations for AI therapy guide to review privacy, security, and vendor requirements.
The free plan does not include a BAA. Covered entities should use it only to evaluate the workflow with de-identified or non-PHI material until an agreement is in place. Start free.
Encrypted in transit and at rest, with SOC 2 Type II audited infrastructure, ISO 27001 certification, and BAA availability on Professional and Enterprise plans.
