What to send when an insurer asks for therapy records, and what to keep back

Send what the payer's request needs to decide payment: usually the progress notes, the treatment plan and the session times for the dates it names. HIPAA allows that without the client's authorization, as long as you send only what the request needs. Psychotherapy notes are the exception. They need the client's specific authorization even when a payer asks, so they stay out of the packet unless the client has signed one.

Why does the packet matter so much? A records request usually comes before a denial or a clawback, and what you send is the whole case. Sending too little loses the claim. Sending the whole chart when the request named three dates discloses more than the minimum the law allows. And a Medicare contractor holding a claim for review denies it automatically on the 46th day without an answer.

This post reads federal HIPAA rules, Medicare contractor guidance and Texas law as they stood on the day it was published. It isn't legal advice.

Can you send records to a payer without the client's consent?

Yes, for payment. HIPAA lets a provider disclose protected health information to another covered entity "for the payment activities of the entity that receives the information" (45 CFR 164.506(c)). Texas law agrees. The mental health records statute lets a professional disclose to people, companies and agencies "involved in paying or collecting fees for mental or emotional health services provided by a professional" (Texas Health and Safety Code §611.004(a)(6)).

BCBS of Texas put it plainly to its Medicaid providers in 2024: "Patient authorization isn't required to release these records" (BCBSTX, April 15, 2024).

How much should you send?

Only what the request needs. The minimum necessary rule applies "when requesting protected health information from another covered entity" and when disclosing it (45 CFR 164.502(b)). The rule also lets a practice rely on a covered entity's request as the minimum necessary for its stated purpose, "if such reliance is reasonable under the circumstances" (45 CFR 164.514(d)(3)(iii)).

In practice, answer the request as written. If it names three dates of service, send the notes for those three dates and the treatment plan in force on them. If the review is about medical necessity, add the diagnostic assessment that supports the diagnosis on those dates. Don't send other dates, the intake paperwork or a family member's sessions unless the request asks for them.

What if the request asks for all records? You may rely on it as written. If you want it narrowed, ask the payer the same day, and send what it named before the deadline if no answer comes.

Not every request is about payment. A Medicaid plan's chart pull for its quality measures is health care operations, not payment. HIPAA allows that disclosure too, to a plan that has a relationship with the client, for purposes that include quality assessment (45 CFR 164.506(c)(4)). Either way, before you send anything, confirm the request came from the plan or a vendor the plan names. Call the number on the plan's own website, not the one on the letter.

What counts as psychotherapy notes?

Less than the name suggests. HIPAA's definition covers notes "documenting or analyzing the contents of conversation during a private counseling session", or during a group, joint or family session, that "are separated from the rest of the individual's medical record" (45 CFR 164.501). The definition leaves out "medication prescription and monitoring", the "counseling session start and stop times", the modalities and frequency of treatment, test results and any summary of the diagnosis, functional status, treatment plan, symptoms, prognosis and progress.

So a progress note is not a psychotherapy note because it is about therapy. Only a separate record of the session's content qualifies. A payer that asks for progress notes is asking for the medical record, and the practice cannot hold it back by calling it psychotherapy notes.

For the separate record, HIPAA says "a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes", apart from a few listed exceptions (45 CFR 164.508(a)(2)). And a plan "may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization", apart from narrow exceptions that do not reach psychotherapy notes (164.508(b)(4)). So a plan cannot refuse to pay a claim because the client declined to release them.

How long do you have to answer?

It depends on who asked, and the letter's own deadline governs. For a claim a Medicare contractor is holding for review, First Coast Service Options, the contractor for Florida, says "CMS allows 45 calendar days to submit the documentation" and that "The 45-day timeframe begins with the date of the ADR letter", not the day it arrived. "Claims are set to automatically deny on day 46 when documentation has not been received." If a note is missing its signature, "an attestation statement must be included" (First Coast Service Options, September 22, 2026). Texas's Medicare contractor is Novitas Solutions, and the same 45 days come from CMS, but use the date printed on each letter. For a commercial or Medicaid plan, the deadline is in the request or your contract, so read the letter for it the day it arrives.

What should the packet look like?

1. 1A cover letter naming the request, the client by the payer's member number and each date of service you are answering.
2. 2For each date, the signed progress note with the session's start and end times.
3. 3The treatment plan in force on those dates, signed.
4. 4For a medical-necessity review, the diagnostic assessment behind the diagnosis.
5. 5An attestation for any note that lacks a signature, signed by the clinician who wrote it.
6. 6Nothing else. No psychotherapy notes, unless the client signed an authorization for them.

Send it by the payer's secure portal or another route that records the day it arrived, and keep a copy of exactly what went out.

What to do this week

1. 1Find every open records request and write its deadline on the calendar of whoever answers it. For a Medicare request, count 45 days from the date on the letter.
2. 2Check that each clinician who keeps psychotherapy notes keeps them in a record separate from the chart.
3. 3Pull one recent progress note per clinician and check that it carries start and end times and a signature.
4. 4Write a one-page procedure for answering a request, with the packet above, and name who signs the cover letter.
5. 5Keep a log of each request: who asked, the dates named, what you sent and when it arrived.

Sources

• 45 CFR 164.501, definitions, including psychotherapy notes.
• 45 CFR 164.502(b), the minimum necessary standard.
• 45 CFR 164.506(c), disclosures for payment.
• 45 CFR 164.508, authorizations and psychotherapy notes.
• 45 CFR 164.514(d), relying on a request as the minimum necessary.
• Texas Health and Safety Code §611.004, authorized disclosure of confidential information.
• Requests for behavioral health documentation for Medicaid members, BCBS of Texas, April 15, 2024.
• Responding to additional documentation requests, First Coast Service Options, September 22, 2026.