The rules about notes that nobody teaches
Most training covers what goes in a note. Far less covers when it has to be written, what happens when you need to change one, who has to sign it, and the fact that HIPAA recognises a separate category of note with substantially stronger protection that most clinicians have never deliberately used.
The content of a progress note is covered by whichever format you use — SOAP, DAP or BIRP. This page is about everything around the content, which is where most avoidable problems live.
Timeliness
There is no single national rule. Requirements come from state licensing regulations, payer contracts and, in programme settings, accreditation standards — and they vary from "same day" to "within 72 hours" to "within a reasonable period."
Some practical constants apply regardless of the specific window:
- Sooner is better clinically. Detail decays quickly, and a note written a fortnight later is a reconstruction.
- Notes must be complete before billing. Submitting a claim for a service with no note is billing for an undocumented service.
- Late entries must be labelled as late. A note written three weeks after the session, dated as though contemporaneous, is a records-integrity problem far more serious than lateness itself.
The backlog trap. Practices that fall behind face a genuine dilemma: writing twenty notes in one sitting produces notes that look — and often are — generic. The right response is to write them, label the entry dates honestly, and accept that they are weaker than contemporaneous notes. The wrong response is to backdate. One is a documentation quality issue; the other is falsification, and the distinction matters enormously if anyone ever looks.
Signatures
A note is not complete until signed. Signature requirements generally include the clinician's name, credentials and the date, and electronic signatures are broadly accepted where the system attributes them reliably and records when they were applied.
Where supervision applies, co-signature requirements come from state law, payer policy and the supervisee's licence status. Two points regularly cause problems: a co-signature is an attestation by the supervising clinician, not a formality, and where a service is billed under the supervisor's credentials the supervision arrangement must actually meet the payer's requirements. See the golden thread for how supervision gaps break the billing chain while leaving the clinical record intact.
Addenda versus alterations
This distinction is straightforward and gets practices into serious trouble when ignored.
An addendum adds information to a signed note. It is dated, attributed and clearly marked as an addition, and the original content remains visible. This is the correct mechanism for anything you need to add after signing — a lab result, a clarification, a subsequent contact.
An alteration changes what a signed note said. In a compliant system the original remains recoverable and the change is logged with who made it and when. Silent editing of signed notes — where the record simply shows different text with no trace — is the single worst property an EHR can have, because it makes the entire chart unreliable as evidence.
The practical rule: once signed, add rather than edit. If a correction is genuinely needed, make it as a clearly marked correction that leaves the original visible. Never amend a note that is under review or subject to a records request without legal advice — a late edit to a note an auditor has asked for is materially worse than whatever the note originally lacked.
Psychotherapy notes under HIPAA
This is the part most clinicians have never used deliberately, and it is worth knowing precisely.
HIPAA defines psychotherapy notes as notes recording or analysing the contents of a counselling session, kept separate from the rest of the record. They receive substantially stronger protection than ordinary progress notes — most disclosures require specific authorisation, and they are generally excluded from the client's right of access to their own records.
Critically, the definition excludes several categories, which therefore cannot be protected this way:
- Medication prescription and monitoring.
- Session start and stop times.
- Modalities and frequencies of treatment.
- Results of clinical tests.
- Diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date.
In other words, everything a payer needs and everything a treatment plan contains sits outside the protected category by definition. Psychotherapy notes are for the clinician's own process notes — hypotheses, reactions, working impressions — and they only receive the protection if they are genuinely kept separate. Notes mixed into the main record are ordinary progress notes regardless of what they contain or what you call them.
State law may provide additional protections, and some states are stricter than HIPAA. This is worth checking rather than assuming.
What does not belong in a progress note
- Other clients' identifying information. Particularly in group and family work, where the note lives in one person's chart and may be disclosed to them.
- Speculation about third parties. A note asserting that a client's partner "is clearly narcissistic" is an unassessed clinical claim about someone who is not your client, in a document that may be subpoenaed.
- Personal opinion unconnected to clinical reasoning. Charts are read by clients, lawyers, auditors and colleagues.
- Detail beyond clinical necessity on sensitive disclosures. Record what is clinically required; a verbatim account of a trauma narrative is rarely necessary and creates disclosure risk for the client.
Retention
Retention periods are set by state law and vary widely — commonly several years for adult records, and frequently longer for minors, where the clock may run from the age of majority rather than the date of service. Payer contracts impose their own obligations, which can exceed state minimums.
Two practical implications: know your own state's period rather than a general figure, and have a plan for records if the practice closes. Practice closure without a records custodian arrangement is a common and entirely avoidable regulatory problem.
Cloned notes
Worth its own heading because it is the finding most likely to convert a routine review into a serious one.
Cloning is the appearance of substantively identical documentation across multiple encounters or multiple clients. It arises from copy-forward, from templates with pre-filled content rather than empty prompts, and from genuine time pressure. Whatever its origin, the reviewer's inference is the same: the documentation does not evidence that individualised services were delivered.
The particular danger is that cloning is trivially detectable at scale. A reviewer with electronic records can compare hundreds of notes mechanically, and near-identical text across a caseload surfaces immediately without anyone reading a single note clinically. Practices are often surprised by how quickly this is found, having assumed their notes would be assessed individually.
The defence is variation that reflects reality — which is what happens naturally when notes are written from the session rather than from the previous note.
Clients read their notes
Increasingly, and often with a legal right to. Write every note on the assumption that the client will read it — not by softening clinical content, which would be its own failure, but by ensuring that what you have written is something you could defend saying to them directly. Notes that would embarrass you to have read aloud are usually notes with a problem beyond tone.
Verified 29 July 2026. Documentation standards derive from payer medical-necessity policy, state licensing-board rules and, for some settings, accreditation requirements — all of which vary by jurisdiction and contract. Retention periods and timeliness expectations are set by state law and payer agreement. Primary references: CMS regulations and guidance; HHS HIPAA Privacy Rule; APA Services. This page is documentation reference, not legal advice.