Requesting Your Mental Health Records: Your Rights Under HIPAA and New York Law

You have a legal right to see and get a copy of your mental health records. Under HIPAA, a provider must act on your request within 30 days, with one extension of up to 30 more days if it explains the delay in writing, and it can charge only a reasonable, cost-based fee. New York adds its own rules: a provider must let you inspect your records within 10 days of a written request, provide copies within a reasonable time, and charge no more than 75 cents per page for paper copies.

The main exception is "psychotherapy notes," a narrow category of a therapist's separate session notes. Everything else in a typical psychiatric record, including diagnoses, medication history, test results, treatment plans and progress summaries, is covered by your right of access. This article explains what you can get, how to ask, how the federal and New York rules fit together, and what to do if a provider says no. It is general information, not legal advice.

What is in a mental health record, and what you can get

HIPAA's right of access covers protected health information in a provider's "designated record set," for as long as the provider keeps it, with two exceptions: psychotherapy notes, and information compiled for a legal proceeding.

What "psychotherapy notes" means

The term is narrower than most people assume. Psychotherapy notes are notes a mental health professional records to document or analyze the contents of a counseling session, and they count only if they are kept separate from the rest of the medical record. The definition specifically excludes medication prescription and monitoring, session times, the types and frequency of treatment, clinical test results, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress. So a provider cannot withhold your whole therapy chart by calling it "psychotherapy notes."

New York law has a similar but differently worded exclusion. Under Public Health Law §18, a practitioner's "personal notes and observations," meaning speculations, impressions (other than a tentative or actual diagnosis) and reminders, are not part of the patient information you can demand, but only while the practitioner keeps them and has not disclosed them to anyone else. A provider can still choose to share psychotherapy notes with you; the exception permits withholding them, it does not require it.

Federal and New York rules side by side

When both federal and state rules apply, the provider has to satisfy both. HIPAA does not override a state law that gives individuals greater rights of access. In practice, a New York practice should let you inspect your records within 10 days, send copies within a reasonable time that does not exceed HIPAA's outer limit, and keep any paper-copy fee within both the cost-based rule and the per-page cap.

How to request your records, step by step

1. Check the provider's notice of privacy practices for how it handles access requests. A provider may require a written request if it tells you so.
2. Make the request in writing, even if not required, and keep a copy with the date. New York's 10-day inspection clock runs from a written request.
3. Say what you want: the whole record or specific parts, the date range, and the format. If the records are electronic and you ask for an electronic copy, the provider must give it to you in the format you ask for if it is readily producible, or in another readable electronic format you agree on.
4. Say how to deliver it: pickup, mail, a secure portal or email.
5. If you want the records sent to a new clinician, put that direction in writing, signed, naming the person and where to send them. After a 2020 federal court decision, this HIPAA right to direct records to someone else covers electronic copies of records kept in an electronic health record, and HIPAA's fee limits do not apply to these third-party requests.
6. Ask about any fee in advance.
7. Follow up if you have heard nothing after 30 days. If the provider needs more time, it must have told you in writing why and when it will finish.

You do not have to give a reason for wanting your records, and your reason, if you share it, is not a permitted ground for denial. A provider also may not refuse because you owe money for care, and it may not impose unreasonable verification steps, such as requiring you to come in person or to use a web portal when you want a copy mailed to you.

What to include in a written request

• Your full name, date of birth and contact information
• The provider or practice name and your approximate dates of treatment
• The records you want and the date range
• The format (paper, PDF, portal) and delivery method
• If sending to someone else, that person's name and address
• Your signature and the date

Email, portals and keeping your copy private

You can ask to receive copies by mail or email, and a provider may not insist that you travel to its office to pick them up. You also have the right to ask for unencrypted email, but HHS notes that this carries security risks in transit that you accept when you choose it. A secure patient portal or an encrypted file is usually the safer choice for a psychiatric record. Once you have your copy, store it as carefully as you would a passport: a password-protected folder rather than a shared family computer or a work email account.

Fees: what a provider may charge

HIPAA limits fees to the cost of copying labor, supplies for paper or portable electronic media, postage, and preparing a summary if you agreed to one in advance. HHS guidance adds that the fee may not include the cost of verification, documentation, or searching for and retrieving the information. The Department of Health and Human Services has described an optional flat fee for electronic copies and has clarified that it is not a cap on what a provider may charge if the provider calculates actual or average costs. New York caps paper copies at 75 cents per page, and you cannot be denied access solely because you cannot pay. New York also bars any charge for records requested to support an application, claim or appeal for a government benefit or program. If you only need a summary for a new clinician, asking for a treatment summary or the most recent records can keep costs and time down.

When a provider can say no

HIPAA allows a provider to deny access on a few reviewable grounds, most importantly when a licensed professional determines that access is reasonably likely to endanger the life or physical safety of you or another person. New York allows denial when review can reasonably be expected to cause substantial and identifiable harm to you or others. These are exceptions, not routine practice.

If you are denied, the provider must give you a written denial in plain language explaining the basis, your review rights and how to complain. It must also give you access to everything else after removing what it is withholding. Under New York law, you can seek a free review by the appropriate review committee; for records at a state mental hygiene facility or program, a clinical record access review committee hears the appeal. You can also file a complaint with the federal Department of Health and Human Services under HIPAA.

Records for minors and family members

In New York, a parent or legal guardian can ask to inspect a child's records about care the parent consented to, or emergency care, within 10 days of a written request. The provider may refuse if it determines access would have a detrimental effect on its professional relationship with the child, on the child's care, or on the child's relationship with the parents. A young person over the age of twelve may be told about a request to review their information, and if they object, the provider may deny it. For teenagers in therapy, this is often a conversation worth having at the start of care, so everyone knows what will be shared.

For an adult family member, you generally need the patient's written authorization or legal authority to act for them. Psychiatric advance directives and health care proxies in New York explains how to set that up before it is needed.

Correcting something in your record

Seeing your record sometimes reveals an error: a wrong medication dose, a diagnosis you were never told about, or a family history detail that is not right. HIPAA gives you a separate right to ask a provider to amend information in your designated record set. The provider may require the request in writing with a reason, if it tells you in advance, and must act on it within 60 days, with one possible 30-day extension if it explains the delay in writing. It can decline, for example if it believes the record is accurate and complete; if it does, you can submit a written statement of disagreement.

Keep amendment requests factual. "The visit note of 3 March lists a medication I have never taken" is easier to act on than a general objection to how a visit was described. A clinician's impressions are a professional judgment and are less likely to be changed than a factual error, but your statement of disagreement can still sit alongside them.

Why and when to ask

Common reasons to get your records include:

• Switching psychiatrists or adding a new clinician. Ask for the last year or two of notes, the medication history and any test results. Switching psychiatrists without a gap covers timing so prescriptions do not lapse.
• A second opinion. Getting a second opinion on your psychiatric medication lists what the reviewing psychiatrist will want.
• Leave or disability claims, where your own copy helps you check what was certified. See FMLA leave for mental health.
• Your own reference. A personal copy of your medication trials, doses and responses is useful for the rest of your life; how to prepare your medication history shows how to organize it.

If your concern is who else sees your mental health information, such as insurers or employers, what insurers and employers see when you file a mental health claim covers that side of privacy.

At this practice

The practice's HIPAA notice of privacy practices and its website privacy policy are posted on its site; read them for the practice's own policies. For billing documents, superbills are available in the patient portal after each session. The office can be reached by phone at (212) 621-7770 or by email at info@drlewis.com. The guide to choosing psychiatric care covers other practical questions about starting or changing care.

Frequently asked questions

Can my therapist refuse to give me my therapy notes?

A therapist may withhold psychotherapy notes, meaning separate notes analyzing session content. They cannot withhold the rest of your record, including diagnoses, treatment plans, progress summaries, medication information and test results. Ask for those specifically if notes are withheld.

How long does a provider have to give me my records in New York?

New York requires an opportunity to inspect within 10 days of a written request and copies within a reasonable time. HIPAA sets an outer limit of 30 days, with one 30-day extension if the provider explains the delay in writing. Both rules apply.

Can a provider charge me for my records?

Yes, but only a reasonable, cost-based fee under HIPAA, and no more than 75 cents per page for paper copies under New York law. A provider cannot deny access solely because you cannot pay, and cannot withhold records because you owe money for care.

Can I have my records sent directly to my new psychiatrist?

Yes. Under HIPAA you can direct the provider, in a signed written request, to send a copy to a person you name; since a 2020 court decision, this federal right covers electronic copies of records kept in an electronic health record. Include the recipient's name and address. Many practices also accept a standard release form from the new clinician.

What if my old provider has closed or retired?

Ask the office or the provider directly who is keeping the records. If a provider knows where requested records are kept but does not hold them, HIPAA requires it to tell you where to send the request.

Can I correct something wrong in my record?

HIPAA gives a separate right to request an amendment. Put the request in writing, identify the entry and explain the correction. The provider must act within 60 days, and if it declines, you can submit a written statement of disagreement.

Sources

1. 45 CFR 164.524 Access of individuals to protected health information. Electronic Code of Federal Regulations, 2026. ecfr.gov
2. 45 CFR 164.501 Definitions (psychotherapy notes). Electronic Code of Federal Regulations, 2026. ecfr.gov
3. Individuals' Right under HIPAA to Access their Health Information 45 CFR 164.524. U.S. Department of Health and Human Services, Office for Civil Rights, 2025. hhs.gov
4. New York Public Health Law §18: Access to patient information. New York State Senate (Consolidated Laws), 2024. nysenate.gov
5. New York Mental Hygiene Law §33.16: Access to clinical records. New York State Senate (Consolidated Laws), 2017. nysenate.gov
6. 45 CFR 160.202 and 160.203 (HIPAA preemption of state law). Electronic Code of Federal Regulations, 2026. ecfr.gov
7. 45 CFR 164.526 Amendment of protected health information. Electronic Code of Federal Regulations, 2026. ecfr.gov
8. Court Order Regarding the HIPAA Right of Access (Ciox Health, LLC v. Azar). U.S. Department of Health and Human Services, Office for Civil Rights, 2020. hhs.gov

Educational information, not medical, tax or legal advice. Decisions about diagnosis, medication and treatment belong with a clinician who knows your history.