Documentation Ethics — Apply ethical documentation and record-keeping standards - Eppp Knowledge

SECTION 1

Historical Context & Motivation

The ethical standards governing clinical documentation did not emerge in a vacuum; rather, they evolved in direct response to well-documented abuses, shifting professional norms, and landmark legislation that redefined the relationship between clinicians and the records they create. In the early decades of modern psychology, record-keeping was largely idiosyncratic—practitioners maintained notes according to personal preference, with minimal external oversight. The consequences of this unregulated approach became apparent as legal proceedings increasingly demanded clinical records, patients sought access to their own files, and third-party payers required documentation to authorize reimbursement. These pressures collectively motivated the profession to establish formal ethical and legal frameworks for documentation.

Understanding the historical trajectory of documentation ethics is essential for contemporary practitioners because many of the standards codified in the APA Ethics Code and federal regulations directly reflect lessons learned from past failures. From Tarasoff to HIPAA, each milestone addressed a specific gap in how records were handled, shared, or protected, and these developments continue to shape the ethical landscape of behavioral health practice today.

1953 • First APA Ethics Code Published

The American Psychological Association adopted its inaugural Ethical Standards of Psychologists, which included early references to confidentiality obligations but lacked detailed guidance on record-keeping practices.

1976 • Tarasoff v. Regents (Tarasoff II)

The California Supreme Court's landmark ruling established a duty to protect identifiable third parties, which had profound implications for what clinicians must document—particularly risk assessments, clinical decision-making, and steps taken to warn potential victims.

1992 • APA Ethics Code Revision

The revised code introduced Standard 6 (Record Keeping and Fees), explicitly addressing clinicians' obligations to create, maintain, and dispose of records in a manner that facilitates continuity of care and protects client confidentiality.

1996 • HIPAA Enacted

The Health Insurance Portability and Accountability Act established national standards for the protection of health information, requiring covered entities to implement administrative, physical, and technical safeguards for all protected health information (PHI) including psychotherapy notes.

2002–2017 • APA Ethics Code Amendments & Record Keeping Guidelines

The current APA Ethics Code (2002, amended 2010 and 2017) refined documentation standards, and the APA published comprehensive Record Keeping Guidelines (2007) offering detailed, aspirational guidance on creating, maintaining, disseminating, and disposing of records across diverse practice contexts.

The central question that this historical evolution addresses is deceptively straightforward: What must a clinician document, how must those records be safeguarded, and under what conditions may they be shared or destroyed? The answers to these questions sit at the intersection of ethical codes, federal and state law, institutional policy, and professional judgment—a convergence that makes documentation ethics one of the most practically consequential topics on the EPPP.

SECTION 2

Core Principles & Definitions

Ethical documentation in behavioral health rests on several foundational principles drawn from the APA Ethics Code (particularly Standards 4 and 6), HIPAA regulations, and the APA Record Keeping Guidelines. These principles govern the entire lifecycle of a clinical record—from the moment information is first recorded through its eventual retention or destruction. Mastery of these principles requires understanding both the mandatory ethical standards (enforceable rules) and the aspirational guidelines that represent best practices in the field.

Accuracy & Objectivity

Clinicians must ensure that records are factually accurate, distinguish between observed behavior and clinical interpretation, and avoid misleading, deceptive, or biased entries. Records should reflect what actually occurred in a session rather than retrospective reconstructions or unsubstantiated inferences.

Confidentiality & Privacy

Under APA Standard 4.01, clinicians have a primary obligation to protect confidential information. Documentation must be stored securely—physically and electronically—and disclosed only with proper authorization, legal mandate, or within recognized exceptions such as imminent danger to self or others.

Informed Consent for Records

Clients must be informed about the nature and extent of documentation, who may access their records, and any limitations on confidentiality at the outset of the professional relationship. This includes explaining the distinction between the official clinical record and psychotherapy notes under HIPAA.

Retention & Disposal

Records must be retained for a period consistent with applicable statutes, regulations, and institutional requirements. The APA recommends maintaining complete records for at least 7 years after the last date of service (3 years after a minor reaches the age of majority). Disposal must be conducted in a manner that protects confidentiality.

Minimum Necessary Standard

When disclosing information, the clinician must share only the minimum amount of information necessary to accomplish the purpose of the disclosure. This HIPAA-derived principle limits unnecessary exposure of sensitive client information and applies to communications with insurance companies, courts, and other providers.

✦

KEY TAKEAWAY

Think of a clinical record as a shared bank vault. The clinician is the custodian with a fiduciary duty—they must deposit accurate entries (accuracy), lock the vault properly (confidentiality), tell the client what's inside and who holds keys (informed consent), keep the vault intact for the required period (retention), and when information leaves the vault, release only the specific items requested (minimum necessary). Just as a bank officer who alters records, leaves the vault unlocked, or distributes account information without authorization faces legal and professional consequences, a clinician who fails to uphold these documentation principles risks disciplinary action, malpractice liability, and—most importantly—harm to the client.

SECTION 3

Visual Explanation — The Record Lifecycle

Understanding documentation ethics requires seeing how each principle maps onto the lifecycle of a clinical record. The diagram below illustrates the five major phases of this lifecycle—creation, maintenance, access/disclosure, retention, and disposal—and the ethical and legal standards that govern each phase. Notice how confidentiality is not a single-phase concern but a thread that runs through every stage of the process.

The lifecycle diagram above shows five sequential phases of clinical record management. The green confidentiality thread underscores that safeguarding client privacy is not confined to a single phase but represents a continuous obligation governed by both APA Standard 4.01 and the HIPAA Privacy Rule. Each phase's governing standards are listed in the lower panels.

As the diagram illustrates, the record lifecycle is governed by overlapping layers of regulation. During the creation phase, the clinician's primary obligation is accuracy—documenting assessment bases, treatment plans, and session content in a timely manner. In the maintenance phase, the focus shifts to secure storage and proper correction of errors (by addendum, never by deletion or overwriting). The disclosure phase is often the most ethically complex, requiring the clinician to balance client authorization, legal mandates, and the minimum necessary standard. Finally, retention and disposal require adherence to both APA guidelines and state-specific statutes, which may impose longer or shorter retention periods than the APA's recommended seven years.

SECTION 4

How It Works — HIPAA, the APA Ethics Code, & Psychotherapy Notes

The ethical documentation framework in behavioral health operates at the intersection of three regulatory layers: the APA Ethics Code (enforceable standards and aspirational principles), HIPAA (federal law applicable to covered entities), and state laws and regulations (which may impose stricter requirements). When these sources conflict, the general rule is to follow the standard that provides the greatest protection to the client. Understanding how these layers interact is critical for ethical decision-making around records.

HIPAA's Two-Category Distinction

One of the most frequently tested concepts on the EPPP is HIPAA's distinction between the official clinical record (also called the designated record set) and psychotherapy notes (sometimes called process notes). These are not the same thing, and they receive different levels of protection under HIPAA. The designated record set includes diagnoses, treatment plans, dates of service, medications, test results, progress notes documenting functional status, prognosis, and treatment progress. Clients generally have a right to access this record under HIPAA's Privacy Rule. Psychotherapy notes, by contrast, are defined under 45 CFR §164.501 as notes recorded by a mental health professional documenting or analyzing the contents of conversation during a counseling session, kept separate from the rest of the medical record. These notes receive heightened protection: they cannot be disclosed to insurance companies, other providers, or even the client without a specific, separate authorization—an authorization distinct from the general consent for treatment or payment.

⚠

EPPP HIGH-YIELD POINT

Under HIPAA, psychotherapy notes require a separate, specific authorization for release—even to insurance companies. A general release of information is insufficient. However, there are exceptions: psychotherapy notes may be disclosed without authorization if needed to defend against a legal action brought by the client, for required health oversight activities, or to avert a serious and imminent threat.

APA Ethics Code — Key Standards

Standard	Requirement	Clinical Implication
4.01 — Maintaining Confidentiality	Take reasonable precautions to protect confidential information	Use encrypted electronic records, locked file cabinets, password protection; discuss limits of confidentiality at intake
4.05 — Disclosures	Disclose confidential information only with valid consent or as mandated/permitted by law	Obtain written authorization before releasing records; apply minimum necessary standard
6.01 — Documentation of Professional Work	Create and maintain records to facilitate provision of services, allow replication of research, and meet institutional requirements	Document assessment bases, treatment plans, session dates, presenting concerns, progress, and clinical rationale for interventions
6.02 — Maintenance, Dissemination, and Disposal	Maintain confidentiality in creating, storing, accessing, transferring, and disposing of records	Implement record disposal procedures that prevent unauthorized access (shredding, secure electronic deletion); plan for records in the event of death or incapacitation
6.06 — Planning for Record Custody	Plan in advance for custody and protection of records in the event the psychologist can no longer maintain them	Designate a professional executor or colleague to assume record custody; address this in a professional will

Key APA Ethics Code Standards Related to Documentation

SECTION 5

Detailed Breakdown — Types of Records & Documentation Pitfalls

Not all clinical records serve the same purpose, and the type of record determines its content, accessibility, and level of protection. Clinicians working in behavioral health must understand these distinctions to avoid common documentation pitfalls—errors that are frequently the basis of licensing board complaints, malpractice claims, and EPPP questions. The diagram below classifies the primary record types and identifies the most common ethical violations associated with each.

This diagram contrasts three major record categories—the designated record set, psychotherapy notes, and test data/materials—and highlights four common documentation pitfalls that can lead to ethics complaints and malpractice liability.

A critical distinction that EPPP candidates must internalize is between test data and test materials under APA Standards 9.04 and 9.11. Test data refers to client responses, raw scores, and the clinician's notes about client behavior during testing—these are generally releasable to the client or their designee upon request. Test materials, on the other hand, include test protocols, copyrighted items, scoring keys, and stimuli that, if released, could compromise test security and validity. Psychologists must balance their obligation to provide test data against their responsibility to protect test integrity, and this balancing act often requires consulting with the test publisher and/or legal counsel before releasing information.

SECTION 6

Worked Example — Navigating a Record Request

Consider the following scenario, which is representative of the type of ethical dilemma that appears on the EPPP and that clinicians encounter in practice. Work through each step to see how the ethical and legal frameworks converge to guide appropriate action.

Scenario: Attorney Subpoena for Psychotherapy Notes

1
Step 1 — Identify the Request

Dr. Martinez, a licensed psychologist in private practice, receives a subpoena from an attorney representing her client's estranged spouse in a custody dispute. The subpoena demands "all records, notes, and communications" related to the client's treatment over the past two years. The first step is to clarify what types of records are being requested. In this case, the subpoena appears to request the entire clinical file, including both the designated record set and psychotherapy notes.

The request encompasses both the official clinical record and psychotherapy notes, which receive different levels of protection.
2
Step 2 — Determine Legal Authority

A subpoena is not the same as a court order. A subpoena is typically issued by an attorney and does not carry the same legal force as a court order signed by a judge. Under HIPAA, a psychologist may not release psychotherapy notes in response to a subpoena alone—psychotherapy notes require either a specific client authorization or a court order. Even the designated record set should not be released without first consulting with the client, attempting to quash the subpoena if the client objects, or seeking a protective order.

A subpoena from an attorney is NOT equivalent to a court order. Psychotherapy notes cannot be released based on a subpoena alone.
3
Step 3 — Contact the Client and Obtain Guidance

Dr. Martinez's next step is to promptly contact the client, inform them of the subpoena, and discuss options. The client may choose to sign a valid authorization, object to the release, or consult with their own attorney. If the client objects, Dr. Martinez should communicate this to the requesting attorney and may need to file a motion to quash the subpoena or request a protective order from the court. This step reflects APA Standard 4.05's requirement that disclosures be based on valid consent or legal mandate.

The client must be notified and given the opportunity to consent, object, or seek legal counsel before any records are released.
4
Step 4 — Apply the Minimum Necessary Standard

Assuming the client provides valid authorization (or a court order is obtained), Dr. Martinez must still apply the minimum necessary standard. Rather than releasing the entire file, she should release only the specific information relevant to the custody evaluation—for example, diagnoses, functional status, treatment dates, and treatment summary. Psychotherapy notes should still be withheld unless the client provides a separate, specific authorization for their release, or a court order compels disclosure.

Release only the minimum information necessary. Psychotherapy notes require separate, specific authorization even if the client has authorized release of the designated record set.
5
Step 5 — Document the Decision-Making Process

Finally, Dr. Martinez must document every step of her decision-making process: the date the subpoena was received, the content of the subpoena, the date and content of her conversation with the client, the client's decision, the specific records released (and withheld), and the rationale for each action taken. This documentation serves multiple purposes: it protects Dr. Martinez in the event of a licensing board complaint, demonstrates adherence to ethical standards, and creates a defensible record should the matter proceed to litigation.

Thorough documentation of the clinician's ethical reasoning and actions provides the best protection against future complaints.

SECTION 7

Strengths, Limitations, & Practical Tensions

The ethical documentation framework in behavioral health reflects decades of thoughtful development, but it is not without tensions and practical challenges. Clinicians must navigate competing obligations—thoroughness versus privacy, legal compliance versus therapeutic alliance, standardization versus clinical individuality. The table below summarizes the key strengths and limitations of current documentation ethics standards.

Strengths	Limitations / Tensions
Comprehensive legal-ethical framework (APA Code + HIPAA + state law) provides layered client protection	Overlapping and sometimes conflicting federal, state, and organizational requirements create confusion about which standard to follow
Psychotherapy notes provision gives clinicians a protected space for clinical reflection separate from the formal record	The distinction between psychotherapy notes and progress notes is frequently misunderstood, leading to inadvertent over-disclosure
Minimum necessary standard reduces risk of unnecessary privacy violations during record disclosures	Determining what constitutes 'minimum necessary' requires clinical judgment with no bright-line rule
Documentation facilitates continuity of care when clients transfer between providers	Detailed records may be weaponized in custody disputes, disability claims, or other adversarial proceedings
Clear retention guidelines (7-year recommendation) provide actionable benchmarks for record management	State retention requirements vary widely and may exceed or conflict with APA guidelines, creating compliance burdens

Strengths and Limitations of Current Documentation Ethics Standards

✦

KEY TAKEAWAY

The documentation ethics framework is like a set of interlocking guardrails on a mountain road: each guardrail (APA Code, HIPAA, state law) was installed after an accident revealed a gap in protection. Together, they provide robust safety, but the guardrails sometimes overlap or point in different directions—especially at curves. When you encounter such a curve, the ethical clinician follows the guardrail that provides the most protection to the client, documents the decision, and consults with colleagues or legal counsel when the path forward is ambiguous. On the EPPP, the correct answer almost always prioritizes client welfare and confidentiality.

SECTION 8

Connection to Advanced Topics — Electronic Records, Telepsychology, & Evolving Standards

The documentation ethics landscape is evolving rapidly due to technological advances and the expansion of telepsychology. The rise of electronic health records (EHRs) has introduced new challenges related to data breaches, cloud storage, and the permanence of digital records. Similarly, the growth of telepsychology raises questions about where records are stored, how sessions are documented across state lines, and whether video or audio recordings of sessions create additional documentation obligations. These emerging issues build directly on the foundational principles covered in this lesson.

Traditional Practice Context	Emerging / Advanced Context
Paper records stored in locked file cabinets in a private office	EHR systems with cloud storage, requiring HIPAA-compliant encryption, business associate agreements (BAAs), and audit trails
In-person sessions documented in handwritten or typed notes	Telepsychology sessions requiring documentation of platform used, client's location at time of service, and applicable state laws
Record disposal by physical shredding	Secure electronic deletion requiring data wiping protocols, verification of cloud backup deletion, and documentation of the deletion process
Single-state licensure with familiar retention statutes	PSYPACT and interstate practice requiring compliance with multiple states' record-keeping laws simultaneously
Professional will designating a single colleague as record custodian	Digital estate planning, including provisions for EHR account access, password management, and automated systems for notifying clients in the event of clinician incapacitation or death

Traditional vs. Emerging Documentation Challenges

As the field continues to evolve, clinicians will need to stay current with updates to the APA Ethics Code, HIPAA regulations, and state-specific laws. The fundamental ethical principles—accuracy, confidentiality, informed consent, minimum necessary disclosure, and responsible retention/disposal—remain constant, but their application to new technologies requires ongoing professional development and consultation. For EPPP preparation, it is important to recognize that emerging issues are increasingly represented on the exam, particularly questions about EHR security, telepsychology documentation, and the intersection of state and federal law in interstate practice.

ℹ

LOOKING AHEAD

The APA's Guidelines for the Practice of Telepsychology (2013) and ongoing revisions to the Record Keeping Guidelines emphasize that the same ethical obligations apply regardless of the medium of service delivery. Whether a clinician meets a client in person or via videoconference, the documentation standards—including informed consent, secure storage, and confidential disposal—apply with equal force.

SECTION 9

Practice Problems

Question 1: CONCEPTUAL

Under HIPAA, what is the key distinction between the designated record set and psychotherapy notes, and why does this distinction matter for disclosure purposes?

Show answer

The designated record set (official clinical record) includes diagnoses, treatment plans, progress notes, dates of service, test results, and billing information—clients generally have a right of access to this information under HIPAA. Psychotherapy notes, by contrast, are the clinician's personal notes documenting or analyzing the contents of therapy conversations, maintained separately from the medical record. This distinction matters because psychotherapy notes receive heightened protection: they require a separate, specific written authorization for release and cannot be disclosed merely on the basis of a general consent for treatment, payment, or healthcare operations. This two-tier system reflects the recognition that the intimate content of therapy sessions warrants greater protection than routine clinical information.

Question 2: BASIC APPLICATION

Dr. Chen discovers a factual error in a progress note she wrote three weeks ago. According to ethical documentation standards, what is the correct procedure for correcting this error?

Show answer

Dr. Chen should never delete, overwrite, or use correction fluid to remove the original entry. The ethically and legally appropriate procedure is to add a dated addendum to the record that identifies the original entry, explains the error, and provides the corrected information. In a paper record, the clinician draws a single line through the erroneous entry (so it remains legible), writes 'error' beside it, and adds the dated correction with her signature. In an electronic health record, she creates a new addendum entry with the current date that references the original note and provides the corrected information. This approach preserves the integrity of the original record while ensuring accuracy—a critical requirement because altered records are viewed with suspicion in legal proceedings and may constitute an independent ethics violation.

Question 3: INTERMEDIATE

A managed care company requests 'all clinical records' for a client who has filed an insurance claim for psychotherapy services. The client has signed a general release of information authorizing the insurance company to access treatment records. Should the psychologist release the entire file, including psychotherapy notes? Explain your reasoning.

Show answer

No. The psychologist should not release the entire file. Under HIPAA, psychotherapy notes require a separate, specific authorization distinct from a general release of information—even one signed by the client. The general release authorizes access to the designated record set (diagnoses, treatment plans, progress notes, dates of service), but NOT to psychotherapy notes. Additionally, the minimum necessary standard requires the clinician to release only the information needed to process the insurance claim, which typically includes diagnoses, dates of service, and a treatment summary. If the managed care company specifically requests psychotherapy notes, the clinician should inform the client and obtain a separate, specific authorization before releasing them. The clinician should also document the request, the information released, and the basis for the disclosure decision in the client's record.

Question 4: APPLIED

Dr. Patel, a psychologist in solo private practice, is diagnosed with a terminal illness and has approximately six months to live. She has 45 active clients and records spanning 20 years of practice. What ethical obligations does she have regarding her clinical records, and what steps should she take?

Show answer

APA Standard 6.06 requires psychologists to plan in advance for the custody and protection of records in the event they can no longer maintain them. Dr. Patel should take several immediate steps: (1) Designate a qualified colleague or professional executor to assume custody of her records, ensuring this person is bound by the same confidentiality obligations through a written agreement. (2) Notify active clients of her planned practice closure, provide referrals, and facilitate transfer of care. (3) Ensure that all records are complete and current, including documentation of her transition plan. (4) Determine the applicable state retention period and arrange for records to be maintained for the required duration. (5) Execute a 'professional will' that specifies the designated record custodian, the location of records (physical and electronic), passwords for EHR access, and instructions for notifying clients. (6) Arrange for secure disposal of records that have exceeded the retention period. These steps reflect the convergence of APA Standards 6.01, 6.02, and 6.06, and they protect both the clinician's professional legacy and the ongoing welfare of her clients.

Question 5: CRITICAL THINKING

A psychologist conducts therapy via a HIPAA-compliant videoconferencing platform with a client who resides in a different state. The client is involved in a custody dispute, and the psychologist receives a subpoena from a court in the client's state requesting all treatment records, including session recordings. The psychologist did not record any sessions, but the videoconferencing platform automatically stores encrypted session metadata (date, duration, IP addresses). Analyze the ethical and legal issues the psychologist must navigate in responding to this subpoena.

Show answer

This scenario involves multiple intersecting ethical and legal issues. First, the psychologist must determine which state's laws govern the record-keeping obligations—typically the state where the client is located at the time of service, though the clinician's licensing state may also impose requirements. Second, a subpoena is not equivalent to a court order; the psychologist should not automatically comply but should instead notify the client, consult with legal counsel, and determine whether to assert privilege or seek a protective order. Third, the platform's stored metadata (session dates, duration, IP addresses) likely constitutes part of the treatment record and may fall within the scope of the subpoena, raising questions about whether the psychologist has an obligation to produce information stored by a third-party vendor. The psychologist should review the business associate agreement (BAA) with the platform provider to determine data ownership and access procedures. Fourth, since no session recordings exist, the psychologist should clearly communicate this to the requesting party rather than risk the implication that recordings were destroyed. Fifth, the minimum necessary standard applies—even if compliance with the subpoena is required, only the information specifically requested should be released. This scenario illustrates how telepsychology amplifies traditional documentation ethics challenges by introducing jurisdictional complexity, third-party data custody, and technology-specific metadata considerations.

SUMMARY

Lesson Summary

Summary

Ethical documentation in behavioral health is governed by three interlocking regulatory layers: the APA Ethics Code (particularly Standards 4.01, 4.05, 6.01, 6.02, and 6.06), the HIPAA Privacy and Security Rules, and state laws and regulations. When these sources conflict, clinicians must follow the standard that provides the greatest protection to the client. The clinical record lifecycle spans five phases—creation, maintenance, access and disclosure, retention, and disposal—with confidentiality serving as a continuous obligation across all phases.

Key EPPP concepts include the critical distinction between the designated record set (accessible to clients) and psychotherapy notes (requiring separate, specific authorization for release), the minimum necessary standard for disclosures, the distinction between a subpoena and a court order, proper error correction procedures (addenda rather than deletion), the APA's recommended 7-year retention period, and the obligation under Standard 6.06 to plan for record custody in the event of death or incapacitation. Emerging challenges in EHR security and telepsychology documentation build directly on these foundational principles.