What to Document and What to Leave Out of Therapy Notes: A Risk Management Guide

A practical guide for therapists on what belongs in progress notes, what belongs in separate psychotherapy notes, and how to document sensitive topics without creating malpractice exposure.

Every therapist eventually faces the same moment: you finish a difficult session and sit down to write the note. The session was complex. The client disclosed something significant. You had a strong reaction. And now you have to decide: how much of this goes in the chart?

Get it wrong in one direction and you have notes that are legally indefensible. Get it wrong in the other direction and you have notes that violate your client's privacy, expose sensitive information to insurers, or create liability you did not intend.

This guide gives you a clear framework for making that call every time.

The Two-Document System: Progress Notes vs. Psychotherapy Notes

Before you can decide what to document, you need to understand the legal difference between the two types of records you can keep.

Progress notes (also called clinical notes or session notes) are part of the medical record. Under HIPAA, they can be accessed by insurance companies for billing purposes, shared with other treating providers, and subpoenaed in legal proceedings. They are not private in the same way a diary is private.

Psychotherapy notes are a distinct category under HIPAA with special protections. They must be kept separately from the rest of the medical record. They cannot be released without your client's specific written authorization (separate from a general records release). Insurers cannot demand them as a condition of reimbursement. A proper psychotherapy note is your working document, written for yourself.

Most clinicians know this distinction exists. Few use it consistently.

The practical rule: if a piece of information would harm your client if an insurer or opposing attorney read it, it belongs in a separate psychotherapy note, not in the progress note.

What Your Progress Note Must Contain

A progress note that is missing required elements creates legal and billing exposure just as much as one that contains too much. The minimum standard for a defensible progress note includes:

Clinical elements

Presenting issue or focus of the session (specific, not generic)
Current functioning, relevant symptoms, and any changes from the prior note
Intervention used and the clinical rationale for it
Client response to the intervention
Progress toward treatment plan goals (or documented divergence with a reason)
Risk assessment, documented explicitly when relevant (suicidal ideation, self-harm, homicidal ideation, substance use)
Safety plan, if one is active

Administrative elements

Date of service
Session start and stop times (required for time-based CPT codes 90832, 90834, 90837 under 2026 billing standards)
Service modality (individual, group, telehealth)
Your signature and credentials

A note that says "Client did well today. Continued discussion of anxiety" fails on nearly every count. It gives you nothing to stand on in an audit, in litigation, or in a case review.

What Belongs in Separate Psychotherapy Notes

Psychotherapy notes are specifically designed to hold the material that is clinically valuable to you but inappropriate or harmful to expose in the accessible medical record.

Keep in your psychotherapy notes:

Verbatim client disclosures: If a client says something particularly revealing in their own words, paraphrase in the progress note. The exact quote belongs in your private notes if you want to capture it.
Your personal reactions to the session: Countertransference observations, emotional responses, gut reactions about the therapeutic relationship. These are diagnostically useful to you and potentially damaging if read by an insurer or attorney.
Unconfirmed clinical hypotheses: The difference between a hypothesis you are exploring and a confirmed diagnostic impression matters legally. "I wonder if there is a personality structure underlying this presentation" should not appear as a definitive claim in the progress note.
Third-party information: Detailed information about family members, partners, or friends that your client shared. Insurers have no right to this. Attorneys can weaponize it.
Session process details: How the session felt, where the ruptures were, what the silences meant. Progress notes document interventions and outcomes, not the phenomenology of the hour.

Documenting Sensitive Topics: Practical Standards

Some categories of information require specific care. Here is how to handle each one.

Suicidal Ideation

Document all of it, but document it precisely. Vague risk language ("client denies SI") is more dangerous than clear, specific language. A defensible note includes:

Whether ideation is present, and if so, passive or active
Presence or absence of a plan, means, and intent
Protective factors named explicitly
Clinical reasoning for the level-of-care decision you made
Any safety planning discussed or updated

What you leave out: the full narrative of what the client said about wanting to die, their family history of suicide, or the specific method they described if it is not clinically necessary for the intervention record. The fact that ideation is present at a specific level with specific protective factors is the relevant clinical datum.

Abuse Disclosures

If your client discloses that they experienced or are currently experiencing abuse, document that the disclosure was made, the nature of the abuse in clinical terms, and any mandated reporting action you took or your reasoning for not reporting.

Do not document a detailed trauma narrative in the progress note. "Client disclosed a history of physical abuse by a caregiver during childhood. No current risk indicators present. No reporting obligations triggered. Clinically relevant to treatment focus on affect dysregulation" is adequate. A paragraph-long account of what happened and when is not only unnecessary, it is the kind of detail that can be subpoenaed and used in ways you cannot anticipate.

Substance Use

Document substance use as clinical information, not as a behavior inventory. Your note should capture: what the client reported, the clinical significance for treatment, and any safety implications. Avoid logging specific quantities or patterns in the progress note if this level of detail serves no treatment purpose. Clients in early recovery or with active legal situations are particularly vulnerable to having detailed substance use records used against them.

Note: if you work in a federally assisted substance use program, 42 CFR Part 2 protections apply and create additional, more restrictive documentation rules beyond standard HIPAA. Review those requirements separately if relevant to your practice.

Illegal Activity

If a client discloses past illegal activity that does not trigger a mandatory reporting obligation, you generally do not need to document the specifics. "Client disclosed past behavior that was self-harming and illegal in nature; relevant to treatment discussion of impulsivity and shame" protects the clinical relevance without creating a document that could be used in a criminal proceeding.

Current illegal activity that creates a duty to warn or protect requires documentation of the specific risk, your clinical reasoning, and the actions you took.

The "Too Much, Too Little, Just Right" Framework in Practice

The following examples illustrate the same session documented at three different levels of detail. The fictional client is Marta, a 34-year-old woman presenting with MDD and a history of childhood trauma.

Too much:

Session focused on Marta's disclosure that her father sexually abused her from age 8 to 11. She described specific incidents in detail and became visibly dysregulated. I felt overwhelmed listening to this and found myself thinking about my own childhood. Marta cried for 20 minutes. She said, word for word: "I've never told anyone the whole story before. I'm disgusted by what he did." I wonder if she has BPD traits given the intensity. PHQ-9 was 17 today, same as last time.

This note contains verbatim quotes, third-party identifying information (father, specific ages), your countertransference, an unconfirmed diagnostic speculation, and more trauma narrative than any clinical decision requires.

Too little:

Marta reported trauma history. Emotional processing occurred. PHQ-9 17. No safety concerns.

This gives you nothing. If this client later files a complaint, transfers to a new provider, or sues you, this note does not document what you did clinically or why.

Just right:

Client reported long-standing history of childhood sexual abuse by a family member for the first time. Disclosure occurred approximately 30 minutes into session. Client exhibited increased emotional activation and tearfulness consistent with trauma processing. Intervention: trauma-informed stabilization using paced breathing and grounding; client was able to return to a regulated state before session close. PHQ-9: 17 (stable from prior session). Discussed pacing of trauma work and client consent for continued trauma focus. Safety screen: no current SI, no self-harm urges. Plan: continue trauma processing with ongoing attention to window of tolerance; next session in one week.

This note documents what happened clinically, what you did, why you did it, and what you assessed. The fact that there was a family member involved is clinically relevant; the name and specific incidents are not.

Documentation Pitfalls That Create Malpractice Exposure

Contradictory notes

If your note from session 14 documents that suicidal ideation was absent, and your note from session 15 documents that the client had "been having ideation for several weeks," you have a clinical and legal problem. The records are inconsistent in a way that a plaintiff's attorney will highlight.

Write notes that are internally consistent with your prior documentation. If something has changed, document it explicitly: "Client disclosed today that they have been experiencing passive suicidal ideation for the past three weeks. This was not disclosed in previous sessions."

Missing risk assessments

The single most common malpractice exposure in outpatient therapy is a file that shows no risk documentation at any point, followed by a client crisis. You do not need to run a full C-SSRS every session. But you do need to demonstrate, through the record, that you were monitoring risk as a routine part of your clinical work.

A brief notation is enough when nothing significant is happening: "No SI, no SH urges, no homicidal ideation. Safety plan remains active." When something is happening, document specifically.

Your file should contain evidence that the client received informed consent at the start of treatment, including your approach, confidentiality limits, and any technology or AI tools used in your practice. If you cannot produce a signed consent form or a note documenting the consent conversation, you are exposed.

Consent is not just a one-time event. Document consent discussions that happen mid-treatment: when you introduce a new modality, when a client asks about records, when safety planning changes.

Copy-paste errors

Copying last session's note with minor modifications is one of the most common documentation shortcuts in outpatient therapy, and it creates two problems. First, identical notes across sessions are an insurance audit red flag. Second, if you copy a risk statement that was accurate last session but inaccurate this session, you have now documented the wrong clinical picture.

If you use a template or documentation tool to structure your notes, the structure can repeat. The clinical content must reflect this specific session.

A Post-Session Decision Framework

After every session, ask yourself these four questions before you write the note.

1. What is the clinical story of this session in one sentence? This is your note's core. If you cannot answer this, you are not ready to write. Get clear on the central clinical event before you start.

2. What did I actually do, and why? Interventions require documentation. The "why" is your clinical reasoning, and it is what distinguishes a defensible note from a billing slip.

3. Is there anything here that could harm this client if an insurer or attorney read it? If yes, that material belongs in a separate psychotherapy note, not in the chart. This includes verbatim quotes, third-party details, speculation, and personal reactions.

4. Have I documented risk explicitly? Even if the answer is "no risk present," document that explicitly. Silence on risk is not the same as documented absence of risk.

A Note on AI-Assisted Documentation

Using a documentation tool that works from your own written summary, not from session recordings, gives you more control over what enters the note in the first place. Tools that generate notes from audio transcripts of the session create a different risk profile: the raw content of the session enters the AI's processing before you have made any clinical decisions about what belongs in the record.

If you use NotuDocs or a similar generation-based tool, the filtering decision happens at your keyboard. You write the session summary, which means you are already deciding what clinical content to include before the AI structures it into a note format.

Checklist: Risk Management Documentation

Before each session

Consent documentation current and accessible in the file
Safety plan current if applicable

After each session

Date of service, start/stop times, and modality documented
Presenting issue and session focus specific to this session
Interventions documented with clinical rationale
Client response to intervention documented
Progress toward treatment plan goals addressed
Risk screen documented explicitly (present or absent)
Any mandated reporting obligations addressed

Content decisions

Verbatim client quotes kept out of progress note (use psychotherapy notes)
Third-party information minimized in progress note
Diagnostic impressions confirmed, not speculative
Personal reactions and countertransference in psychotherapy notes
Sensitive disclosures (abuse, substance use, illegal activity) documented at clinical level, not narrative level
No copy-paste of prior note clinical content without review

Periodic review

Notes internally consistent across sessions
No contradictions in risk documentation
Informed consent updated for any new modalities or tools