EPPP: PART 1, KNOWLEDGE • DOMAIN 8: ETHICAL LEGAL PROFESSIONAL ISSUES

Documentation Ethics — Apply ethical documentation and record-keeping standards

Mastering the ethical obligations that govern how clinicians create, maintain, store, and release psychological records.

Historical Context & Motivation

The ethical standards governing clinical documentation did not emerge in a vacuum; rather, they evolved in direct response to well-documented abuses, shifting professional norms, and landmark legislation that redefined the relationship between clinicians and the records they create. In the early decades of modern psychology, record-keeping was largely idiosyncratic—practitioners maintained notes according to personal preference, with minimal external oversight. The consequences of this unregulated approach became apparent as legal proceedings increasingly demanded clinical records, patients sought access to their own files, and third-party payers required documentation to authorize reimbursement. These pressures collectively motivated the profession to establish formal ethical and legal frameworks for documentation.

Understanding the historical trajectory of documentation ethics is essential for contemporary practitioners because many of the standards codified in the APA Ethics Code and federal regulations directly reflect lessons learned from past failures. From Tarasoff to HIPAA, each milestone addressed a specific gap in how records were handled, shared, or protected, and these developments continue to shape the ethical landscape of behavioral health practice today.

1953
First APA Ethics Code Published
The American Psychological Association adopted its inaugural Ethical Standards of Psychologists, which included early references to confidentiality obligations but lacked detailed guidance on record-keeping practices.
1976
Tarasoff v. Regents (Tarasoff II)
The California Supreme Court's landmark ruling established a duty to protect identifiable third parties, which had profound implications for what clinicians must document—particularly risk assessments, clinical decision-making, and steps taken to warn potential victims.
1992
APA Ethics Code Revision
The revised code introduced Standard 6 (Record Keeping and Fees), explicitly addressing clinicians' obligations to create, maintain, and dispose of records in a manner that facilitates continuity of care and protects client confidentiality.
1996
HIPAA Enacted
The Health Insurance Portability and Accountability Act established national standards for the protection of health information, requiring covered entities to implement administrative, physical, and technical safeguards for all protected health information (PHI) including psychotherapy notes.
2002–2017
APA Ethics Code Amendments & Record Keeping Guidelines
The current APA Ethics Code (2002, amended 2010 and 2017) refined documentation standards, and the APA published comprehensive Record Keeping Guidelines (2007) offering detailed, aspirational guidance on creating, maintaining, disseminating, and disposing of records across diverse practice contexts.

The central question that this historical evolution addresses is deceptively straightforward: What must a clinician document, how must those records be safeguarded, and under what conditions may they be shared or destroyed? The answers to these questions sit at the intersection of ethical codes, federal and state law, institutional policy, and professional judgment—a convergence that makes documentation ethics one of the most practically consequential topics on the EPPP.

Core Principles & Definitions

Ethical documentation in behavioral health rests on several foundational principles drawn from the APA Ethics Code (particularly Standards 4 and 6), HIPAA regulations, and the APA Record Keeping Guidelines. These principles govern the entire lifecycle of a clinical record—from the moment information is first recorded through its eventual retention or destruction. Mastery of these principles requires understanding both the mandatory ethical standards (enforceable rules) and the aspirational guidelines that represent best practices in the field.

1

Accuracy & Objectivity

Clinicians must ensure that records are factually accurate, distinguish between observed behavior and clinical interpretation, and avoid misleading, deceptive, or biased entries. Records should reflect what actually occurred in a session rather than retrospective reconstructions or unsubstantiated inferences.
2

Confidentiality & Privacy

Under APA Standard 4.01, clinicians have a primary obligation to protect confidential information. Documentation must be stored securely—physically and electronically—and disclosed only with proper authorization, legal mandate, or within recognized exceptions such as imminent danger to self or others.
3

Informed Consent for Records

Clients must be informed about the nature and extent of documentation, who may access their records, and any limitations on confidentiality at the outset of the professional relationship. This includes explaining the distinction between the official clinical record and psychotherapy notes under HIPAA.
4

Retention & Disposal

Records must be retained for a period consistent with applicable statutes, regulations, and institutional requirements. The APA recommends maintaining complete records for at least 7 years after the last date of service (3 years after a minor reaches the age of majority). Disposal must be conducted in a manner that protects confidentiality.
5

Minimum Necessary Standard

When disclosing information, the clinician must share only the minimum amount of information necessary to accomplish the purpose of the disclosure. This HIPAA-derived principle limits unnecessary exposure of sensitive client information and applies to communications with insurance companies, courts, and other providers.
KEY TAKEAWAY
Think of a clinical record as a shared bank vault. The clinician is the custodian with a fiduciary duty—they must deposit accurate entries (accuracy), lock the vault properly (confidentiality), tell the client what's inside and who holds keys (informed consent), keep the vault intact for the required period (retention), and when information leaves the vault, release only the specific items requested (minimum necessary). Just as a bank officer who alters records, leaves the vault unlocked, or distributes account information without authorization faces legal and professional consequences, a clinician who fails to uphold these documentation principles risks disciplinary action, malpractice liability, and—most importantly—harm to the client.

Visual Explanation — The Record Lifecycle

Understanding documentation ethics requires seeing how each principle maps onto the lifecycle of a clinical record. The diagram below illustrates the five major phases of this lifecycle—creation, maintenance, access/disclosure, retention, and disposal—and the ethical and legal standards that govern each phase. Notice how confidentiality is not a single-phase concern but a thread that runs through every stage of the process.

The lifecycle diagram above shows five sequential phases of clinical record management. The green confidentiality thread underscores that safeguarding client privacy is not confined to a single phase but represents a continuous obligation governed by both APA Standard 4.01 and the HIPAA Privacy Rule. Each phase's governing standards are listed in the lower panels.

As the diagram illustrates, the record lifecycle is governed by overlapping layers of regulation. During the creation phase, the clinician's primary obligation is accuracy—documenting assessment bases, treatment plans, and session content in a timely manner. In the maintenance phase, the focus shifts to secure storage and proper correction of errors (by addendum, never by deletion or overwriting). The disclosure phase is often the most ethically complex, requiring the clinician to balance client authorization, legal mandates, and the minimum necessary standard. Finally, retention and disposal require adherence to both APA guidelines and state-specific statutes, which may impose longer or shorter retention periods than the APA's recommended seven years.

How It Works — HIPAA, the APA Ethics Code, & Psychotherapy Notes

The ethical documentation framework in behavioral health operates at the intersection of three regulatory layers: the APA Ethics Code (enforceable standards and aspirational principles), HIPAA (federal law applicable to covered entities), and state laws and regulations (which may impose stricter requirements). When these sources conflict, the general rule is to follow the standard that provides the greatest protection to the client. Understanding how these layers interact is critical for ethical decision-making around records.

HIPAA's Two-Category Distinction

One of the most frequently tested concepts on the EPPP is HIPAA's distinction between the official clinical record (also called the designated record set) and psychotherapy notes (sometimes called process notes). These are not the same thing, and they receive different levels of protection under HIPAA. The designated record set includes diagnoses, treatment plans, dates of service, medications, test results, progress notes documenting functional status, prognosis, and treatment progress. Clients generally have a right to access this record under HIPAA's Privacy Rule. Psychotherapy notes, by contrast, are defined under 45 CFR §164.501 as notes recorded by a mental health professional documenting or analyzing the contents of conversation during a counseling session, kept separate from the rest of the medical record. These notes receive heightened protection: they cannot be disclosed to insurance companies, other providers, or even the client without a specific, separate authorization—an authorization distinct from the general consent for treatment or payment.

⚠️ EPPP HIGH-YIELD POINT
Under HIPAA, psychotherapy notes require a separate, specific authorization for release—even to insurance companies. A general release of information is insufficient. However, there are exceptions: psychotherapy notes may be disclosed without authorization if needed to defend against a legal action brought by the client, for required health oversight activities, or to avert a serious and imminent threat.

APA Ethics Code — Key Standards

Key APA Ethics Code Standards Related to Documentation
StandardRequirementClinical Implication
4.01 — Maintaining ConfidentialityTake reasonable precautions to protect confidential informationUse encrypted electronic records, locked file cabinets, password protection; discuss limits of confidentiality at intake
4.05 — DisclosuresDisclose confidential information only with valid consent or as mandated/permitted by lawObtain written authorization before releasing records; apply minimum necessary standard
6.01 — Documentation of Professional WorkCreate and maintain records to facilitate provision of services, allow replication of research, and meet institutional requirementsDocument assessment bases, treatment plans, session dates, presenting concerns, progress, and clinical rationale for interventions
6.02 — Maintenance, Dissemination, and DisposalMaintain confidentiality in creating, storing, accessing, transferring, and disposing of recordsImplement record disposal procedures that prevent unauthorized access (shredding, secure electronic deletion); plan for records in the event of death or incapacitation
6.06 — Planning for Record CustodyPlan in advance for custody and protection of records in the event the psychologist can no longer maintain themDesignate a professional executor or colleague to assume record custody; address this in a professional will

Detailed Breakdown — Types of Records & Documentation Pitfalls

Not all clinical records serve the same purpose, and the type of record determines its content, accessibility, and level of protection. Clinicians working in behavioral health must understand these distinctions to avoid common documentation pitfalls—errors that are frequently the basis of licensing board complaints, malpractice claims, and EPPP questions. The diagram below classifies the primary record types and identifies the most common ethical violations associated with each.

This diagram contrasts three major record categories—the designated record set, psychotherapy notes, and test data/materials—and highlights four common documentation pitfalls that can lead to ethics complaints and malpractice liability.

A critical distinction that EPPP candidates must internalize is between test data and test materials under APA Standards 9.04 and 9.11. Test data refers to client responses, raw scores, and the clinician's notes about client behavior during testing—these are generally releasable to the client or their designee upon request. Test materials, on the other hand, include test protocols, copyrighted items, scoring keys, and stimuli that, if released, could compromise test security and validity. Psychologists must balance their obligation to provide test data against their responsibility to protect test integrity, and this balancing act often requires consulting with the test publisher and/or legal counsel before releasing information.

Worked Example — Navigating a Record Request

Consider the following scenario, which is representative of the type of ethical dilemma that appears on the EPPP and that clinicians encounter in practice. Work through each step to see how the ethical and legal frameworks converge to guide appropriate action.

Scenario: Attorney Subpoena for Psychotherapy Notes
1
Step 1 — Identify the RequestDr. Martinez, a licensed psychologist in private practice, receives a subpoena from an attorney representing her client's estranged spouse in a custody dispute. The subpoena demands "all records, notes, and communications" related to the client's treatment over the past two years. The first step is to clarify what types of records are being requested. In this case, the subpoena appears to request the entire clinical file, including both the designated record set and psychotherapy notes.
The request encompasses both the official clinical record and psychotherapy notes, which receive different levels of protection.
2
Step 2 — Determine Legal AuthorityA subpoena is not the same as a court order. A subpoena is typically issued by an attorney and does not carry the same legal force as a court order signed by a judge. Under HIPAA, a psychologist may not release psychotherapy notes in response to a subpoena alone—psychotherapy notes require either a specific client authorization or a court order. Even the designated record set should not be released without first consulting with the client, attempting to quash the subpoena if the client objects, or seeking a protective order.
A subpoena from an attorney is NOT equivalent to a court order. Psychotherapy notes cannot be released based on a subpoena alone.
3
Step 3 — Contact the Client and Obtain GuidanceDr. Martinez's next step is to promptly contact the client, inform them of the subpoena, and discuss options. The client may choose to sign a valid authorization, object to the release, or consult with their own attorney. If the client objects, Dr. Martinez should communicate this to the requesting attorney and may need to file a motion to quash the subpoena or request a protective order from the court. This step reflects APA Standard 4.05's requirement that disclosures be based on valid consent or legal mandate.
The client must be notified and given the opportunity to consent, object, or seek legal counsel before any records are released.
4
Step 4 — Apply the Minimum Necessary StandardAssuming the client provides valid authorization (or a court order is obtained), Dr. Martinez must still apply the minimum necessary standard. Rather than releasing the entire file, she should release only the specific information relevant to the custody evaluation—for example, diagnoses, functional status, treatment dates, and treatment summary. Psychotherapy notes should still be withheld unless the client provides a separate, specific authorization for their release, or a court order compels disclosure.
Release only the minimum information necessary. Psychotherapy notes require separate, specific authorization even if the client has authorized release of the designated record set.
5
Step 5 — Document the Decision-Making ProcessFinally, Dr. Martinez must document every step of her decision-making process: the date the subpoena was received, the content of the subpoena, the date and content of her conversation with the client, the client's decision, the specific records released (and withheld), and the rationale for each action taken. This documentation serves multiple purposes: it protects Dr. Martinez in the event of a licensing board complaint, demonstrates adherence to ethical standards, and creates a defensible record should the matter proceed to litigation.
Thorough documentation of the clinician's ethical reasoning and actions provides the best protection against future complaints.

Strengths, Limitations, & Practical Tensions

The ethical documentation framework in behavioral health reflects decades of thoughtful development, but it is not without tensions and practical challenges. Clinicians must navigate competing obligations—thoroughness versus privacy, legal compliance versus therapeutic alliance, standardization versus clinical individuality. The table below summarizes the key strengths and limitations of current documentation ethics standards.

Strengths and Limitations of Current Documentation Ethics Standards
StrengthsLimitations / Tensions
Comprehensive legal-ethical framework (APA Code + HIPAA + state law) provides layered client protectionOverlapping and sometimes conflicting federal, state, and organizational requirements create confusion about which standard to follow
Psychotherapy notes provision gives clinicians a protected space for clinical reflection separate from the formal recordThe distinction between psychotherapy notes and progress notes is frequently misunderstood, leading to inadvertent over-disclosure
Minimum necessary standard reduces risk of unnecessary privacy violations during record disclosuresDetermining what constitutes 'minimum necessary' requires clinical judgment with no bright-line rule
Documentation facilitates continuity of care when clients transfer between providersDetailed records may be weaponized in custody disputes, disability claims, or other adversarial proceedings
Clear retention guidelines (7-year recommendation) provide actionable benchmarks for record managementState retention requirements vary widely and may exceed or conflict with APA guidelines, creating compliance burdens
KEY TAKEAWAY
The documentation ethics framework is like a set of interlocking guardrails on a mountain road: each guardrail (APA Code, HIPAA, state law) was installed after an accident revealed a gap in protection. Together, they provide robust safety, but the guardrails sometimes overlap or point in different directions—especially at curves. When you encounter such a curve, the ethical clinician follows the guardrail that provides the most protection to the client, documents the decision, and consults with colleagues or legal counsel when the path forward is ambiguous. On the EPPP, the correct answer almost always prioritizes client welfare and confidentiality.

Connection to Advanced Topics — Electronic Records, Telepsychology, & Evolving Standards

The documentation ethics landscape is evolving rapidly due to technological advances and the expansion of telepsychology. The rise of electronic health records (EHRs) has introduced new challenges related to data breaches, cloud storage, and the permanence of digital records. Similarly, the growth of telepsychology raises questions about where records are stored, how sessions are documented across state lines, and whether video or audio recordings of sessions create additional documentation obligations. These emerging issues build directly on the foundational principles covered in this lesson.

Traditional vs. Emerging Documentation Challenges
Traditional Practice ContextEmerging / Advanced Context
Paper records stored in locked file cabinets in a private officeEHR systems with cloud storage, requiring HIPAA-compliant encryption, business associate agreements (BAAs), and audit trails
In-person sessions documented in handwritten or typed notesTelepsychology sessions requiring documentation of platform used, client's location at time of service, and applicable state laws
Record disposal by physical shreddingSecure electronic deletion requiring data wiping protocols, verification of cloud backup deletion, and documentation of the deletion process
Single-state licensure with familiar retention statutesPSYPACT and interstate practice requiring compliance with multiple states' record-keeping laws simultaneously
Professional will designating a single colleague as record custodianDigital estate planning, including provisions for EHR account access, password management, and automated systems for notifying clients in the event of clinician incapacitation or death

As the field continues to evolve, clinicians will need to stay current with updates to the APA Ethics Code, HIPAA regulations, and state-specific laws. The fundamental ethical principles—accuracy, confidentiality, informed consent, minimum necessary disclosure, and responsible retention/disposal—remain constant, but their application to new technologies requires ongoing professional development and consultation. For EPPP preparation, it is important to recognize that emerging issues are increasingly represented on the exam, particularly questions about EHR security, telepsychology documentation, and the intersection of state and federal law in interstate practice.

🔮 LOOKING AHEAD
The APA's Guidelines for the Practice of Telepsychology (2013) and ongoing revisions to the Record Keeping Guidelines emphasize that the same ethical obligations apply regardless of the medium of service delivery. Whether a clinician meets a client in person or via videoconference, the documentation standards—including informed consent, secure storage, and confidential disposal—apply with equal force.

Practice Problems

PROBLEM 1CONCEPTUAL
Under HIPAA, what is the key distinction between the designated record set and psychotherapy notes, and why does this distinction matter for disclosure purposes?
PROBLEM 2BASIC APPLICATION
Dr. Chen discovers a factual error in a progress note she wrote three weeks ago. According to ethical documentation standards, what is the correct procedure for correcting this error?
PROBLEM 3INTERMEDIATE
A managed care company requests 'all clinical records' for a client who has filed an insurance claim for psychotherapy services. The client has signed a general release of information authorizing the insurance company to access treatment records. Should the psychologist release the entire file, including psychotherapy notes? Explain your reasoning.
PROBLEM 4APPLIED
Dr. Patel, a psychologist in solo private practice, is diagnosed with a terminal illness and has approximately six months to live. She has 45 active clients and records spanning 20 years of practice. What ethical obligations does she have regarding her clinical records, and what steps should she take?
PROBLEM 5CRITICAL THINKING
A psychologist conducts therapy via a HIPAA-compliant videoconferencing platform with a client who resides in a different state. The client is involved in a custody dispute, and the psychologist receives a subpoena from a court in the client's state requesting all treatment records, including session recordings. The psychologist did not record any sessions, but the videoconferencing platform automatically stores encrypted session metadata (date, duration, IP addresses). Analyze the ethical and legal issues the psychologist must navigate in responding to this subpoena.

Lesson Summary

Ethical documentation in behavioral health is governed by three interlocking regulatory layers: the APA Ethics Code (particularly Standards 4.01, 4.05, 6.01, 6.02, and 6.06), the HIPAA Privacy and Security Rules, and state laws and regulations. When these sources conflict, clinicians must follow the standard that provides the greatest protection to the client. The clinical record lifecycle spans five phases—creation, maintenance, access and disclosure, retention, and disposal—with confidentiality serving as a continuous obligation across all phases.

Key EPPP concepts include the critical distinction between the designated record set (accessible to clients) and psychotherapy notes (requiring separate, specific authorization for release), the minimum necessary standard for disclosures, the distinction between a subpoena and a court order, proper error correction procedures (addenda rather than deletion), the APA's recommended 7-year retention period, and the obligation under Standard 6.06 to plan for record custody in the event of death or incapacitation. Emerging challenges in EHR security and telepsychology documentation build directly on these foundational principles.

Varsity Tutors • EPPP: Part 1, Knowledge • Documentation Ethics — Apply ethical documentation and record-keeping standards