A behavioral health EHR should be judged on how it handles the clinical record: progress notes, treatment plans, psychotherapy notes kept apart from the chart, Part 2 substance use records, patient note sharing, controlled-substance e-prescribing, certification and a clean data export. Use the checklists below to test each point in a demo.
A clinical director at a growing group practice sits through a demo. The screen is clean and the scheduling is fast. Then she asks where a therapist keeps private session notes, and the answer is “in the progress note, there is a lock icon.” That one answer decides whether the system fits the practice.
This post is the clinical documentation side of the decision. It sits inside our behavioral health practice management guide, and it differs from the behavioral health practice management software guide, which covers scheduling, billing and general security. Here the focus is the record itself. It names no products and ranks none. For the EHR and EMR terms, see the EHR versus EMR guide.
Key takeaways
- Psychotherapy notes and progress notes are different records under HIPAA, and the EHR must be able to keep them apart.
- Part 2 substance use records carry extra consent and redisclosure rules, so ask how consent and restrictions stay attached to the data.
- Federal information blocking rules do not exempt behavioral health notes by specialty, so ask how note sharing is controlled.
- ONC/ASTP certification is checked in the public CHPL, and it may cover only some modules of a product.
- Test data export and the billing handoff with real cases before signing.
What makes a behavioral health EHR different?
A behavioral health EHR is different because the record has more than one layer. Routine chart entries, private session notes and substance use treatment records each follow different rules, and the clinical workflow is built around recurring visits, treatment plans and measures rather than one-off encounters.
A general-purpose EHR can be configured to do much of this. The question is how much is built in and how much depends on staff discipline. A rule that depends on staff remembering to click the right box will fail on a busy Friday. HHS notes that HIPAA protects all of an individual’s identifiable health information, and that substance use disorder treatment records in federally assisted programs have additional confidentiality protections under 42 CFR Part 2 (HHS).
Start the evaluation by listing the record types your practice actually creates: intake assessments, progress notes, treatment plans, private session notes, group notes, medication notes, outcome measures, letters and releases. Every row in the tables below should be tested against that list.
How should progress notes and treatment plans work?
Progress notes and treatment plans should connect. The plan states the problems and goals, and each note should show work toward them without the clinician retyping the plan. If the software treats plans as a scanned attachment, you will pay for that in time and in audit risk.
| Area | What good looks like | Question to ask |
|---|---|---|
| Note templates | Templates for intake, individual, family and group visits that the practice can edit | Can we change fields and wording ourselves, or does every edit go through the vendor? |
| Session time | Start time, stop time and visit type stored as separate fields | Does time carry into the claim without retyping? |
| Treatment plan | Problems, goals and review dates in structured fields, linked to notes | Can a note pull the current goals, and does the system flag an overdue review? |
| Signatures and locks | Clinician signature, co-signature for supervisees, lock after signing, addenda tracked | What happens to a note after it is locked, and who can add an addendum? |
| Diagnosis list | One current diagnosis list that flows to notes and claims | Does a diagnosis change update the plan and the billing record? |
| Documents and releases | Consent forms, releases and outside records stored with the correct record type | Can we label a document as restricted and limit who opens it? |
“If the plan lives in one place and the notes live in another, the chart will drift apart the first time a clinician is busy.”
— Awais Afzal, Healthcare Operations & Data Analyst
Time capture matters because billing depends on it. We cover how time reaches the claim in our behavioral health revenue cycle post. In the EHR, the test is simple: sign a sample note and check that the claim data is complete without anyone retyping.
Psychotherapy notes versus progress notes: what must the EHR separate?
Under HIPAA, psychotherapy notes are a narrow category: notes a mental health professional keeps to record or analyze the content of a counseling session, kept separate from the rest of the medical record. Most notes in a typical chart are progress notes, and they are not psychotherapy notes.
HHS says psychotherapy notes exclude medication prescription and monitoring, session start and stop times, treatment modalities and frequencies, clinical test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress. The same guidance says a covered entity needs the patient’s authorization to disclose psychotherapy notes, with exceptions such as disclosures required by law (HHS mental health guidance).
| Point | Psychotherapy notes | Progress notes in the record |
|---|---|---|
| What they hold | Clinician’s own record or analysis of session content | Times, modalities, test results, diagnosis, plan, symptoms, progress |
| Where they live | Separate from the rest of the medical record | In the medical record |
| Sharing for treatment | Authorization needed before disclosure, with exceptions such as disclosures required by law | Handled under routine HIPAA rules for treatment, payment and operations |
| Patient right of access | HIPAA gives no right of access; a provider may choose to share, and state law should be checked | Included in the patient’s HIPAA right of access |
| Information blocking | Excluded from electronic health information if the note meets the HIPAA definition | Generally within electronic health information |
Source: HHS (mental health guidance); ASTP/ONC FAQ on psychotherapy notes and EHI.
ASTP/ONC adds that the test is the content of the note, not the clinician’s specialty. A note that meets the HIPAA definition is treated as a psychotherapy note under the information blocking rules, whoever wrote it (ASTP/ONC). A note that does not meet the definition is not excluded just because it is labeled private.
A lock icon is not separation
Ask the vendor to show where a psychotherapy note is stored, who can open it, whether it prints or exports with the chart, and what the audit log records when someone opens it. A note marked “sensitive” inside the same record is not the same as a separate record. Your counsel should decide what your practice treats as a psychotherapy note.
How should the EHR handle Part 2 records and note sharing?
The EHR should record consent, label restricted records and control who sees them. It should also let you share notes with patients without sharing what you are not allowed to share. Two federal rule sets drive these questions: 42 CFR Part 2 and the 21st Century Cures Act information blocking rules.
42 CFR Part 2 substance use records
HHS announced the Part 2 final rule on February 8, 2024, and said persons subject to it must comply by February 16, 2026. That date has passed. The rule allows a patient to give a single consent for all future uses and disclosures for treatment, payment and health care operations. HIPAA covered entities and business associates that receive records under that consent may redisclose them under HIPAA, but the records cannot be used in legal proceedings against the patient without specific consent or a court order. Breach notification now applies to Part 2 records, and HIPAA-style enforcement replaced the old criminal penalties (HHS Part 2 fact sheet).
The same fact sheet says segregating or segmenting Part 2 records is not required. That changes the question. Do not ask only “can you split the record?” Ask how the system captures the consent, keeps the Part 2 label attached to the data when it moves, and stops restricted records from leaving through a routine release. Whether your program is subject to Part 2 is a legal question for counsel.
Cures Act information blocking and note sharing
ASTP/ONC says the definition of electronic health information does not include or exclude notes or other clinical observations based on the author’s type or specialty. Before October 6, 2022, information blocking was limited to the data classes in the USCDI; notes mapping to the eight types in its Clinical Notes data class were within that limit (ASTP/ONC). The limit ran from April 5, 2021 through October 5, 2022 (ASTP/ONC). After that, the wider definition applies.
Practically, that means a behavioral health practice cannot assume its notes are outside the rules. The ASTP/ONC FAQ hub groups questions under the information blocking exceptions, including preventing harm and privacy (ASTP/ONC FAQs). Ask the vendor what controls exist to hold back or delay a note for a documented reason, who can apply them, and whether the decision is logged. Then have counsel confirm which exception your policy relies on.
Patient access also matters here. HIPAA allows up to 30 days to make information available and requires the form and format requested if readily producible, with cost-based fees, according to a law-firm summary of OCR guidance (Crowell). Test how the EHR produces a record request and how it handles the psychotherapy-note exclusion. Our patient engagement post covers the portal side.
What about measures, group sessions and e-prescribing?
Measurement tools, group notes and controlled-substance prescribing are where behavioral EHRs differ most from general ones. Test each with a real case from your own caseload, not the vendor’s sample.
Measurement tools
Decide which scales your clinicians already use, then check that the EHR can send them to the client, score them, store scores as data and show change over time on one screen. A score trapped in a PDF cannot be charted. Ask whether you can add a tool of your choice, and whether scores can feed the treatment plan review.
Group sessions
HHS includes group, joint and family counseling sessions in its psychotherapy notes definition (HHS). In the EHR, a group note creates a record question: what appears in each member’s chart? Ask how the system documents attendance for each client, whether one member’s details can appear in another member’s chart, and how billing splits the visit by client and payer.
E-prescribing and controlled substances
For prescribers, ask how controlled-substance prescriptions are handled. Under the DEA rule at 21 CFR 1311.120, the application must limit who can mark prescriptions ready for signing and who can sign, require two-factor authentication for signing and for access-control changes, make the prescriber review the required elements, time- and date-stamp the signature, and keep an audit trail protected from deletion or modification. It must also give practitioners a monthly log and be able to produce logs for the previous two years (Cornell LII, 21 CFR 1311.120). Ask the vendor to show each of these on screen, and ask for the audit documentation it holds.
How do certification, data export and security fit?
Certification, export and security are the points that protect you after the demo. Certification shows whether a product has been tested against federal criteria. Export decides whether you can leave. Security decides what happens to the record while it is there.
The ASTP/ONC Health IT Certification Program is a voluntary third-party program. ONC does not test or certify products itself; it authorizes testing labs and certification bodies. The Certified Health IT Product List, or CHPL, is the authoritative listing, updated at least weekly, and each product page shows the criteria a module is certified to, its status, mandatory disclosures and compliance activities. Certification is of Health IT Modules, which may be certified individually or in combinations (ASTP/ONC; ASTP/ONC CHPL overview). So ask which modules are certified and whether the ones you need are in scope.
The ASTP/ONC overview also says developers had to provide certified capabilities under criterion 170.315(b)(10), the electronic health information export criterion, on and after December 31, 2023. Ask what that export produces, in what format, for one patient and for the whole practice, and what it excludes.
| Topic | Ask the vendor | Why it matters |
|---|---|---|
| CHPL listing | Which product and modules are listed, and which criteria apply to the version we would run? | The list is public and shows status and disclosures |
| Data export | Can you export every note, plan, measure and document for the whole practice, in what format, how fast, and at what cost? | Leaving is a billing and care-continuity problem if export is partial |
| Business associate agreement | Will you sign one before we load patient data? | A vendor that holds electronic PHI for you is a business associate |
| Access and audit | Can you show role-based access and an audit log of who opened which record? | HIPAA technical safeguards include access control and audit controls |
| Ending the contract | What happens to our data when the contract ends, and how long do we have access? | HHS says a BAA generally has to require return or destruction of PHI where feasible |
| Data location | Where is our data stored and who can reach it? | HHS says location should be part of your risk analysis |
Source: ASTP/ONC certification overview (2024); HHS Security Rule summary; HHS cloud computing guidance.
The HHS Security Rule summary lists technical safeguards for access control, audit controls, integrity and transmission security, and requires a risk analysis (HHS). HHS cloud guidance says a cloud provider that maintains electronic PHI for you is a business associate even if it holds only encrypted data, and that service terms must not block your access to your own data (HHS). Our HIPAA compliance checklist and HIPAA Security Rule and revenue cycle post cover the wider program.
How should the EHR hand off to billing and support telehealth?
The EHR should pass a complete, signed visit to billing without retyping. That means diagnosis, rendering clinician, date, session time, visit type and payer reach the claim from structured fields, and billing questions go back to the clinician through a defined route.
Ask for a test with ten real visits: individual, family, group, medication visit and telehealth. Follow each from signed note to claim to payment. The goal is to find where a biller has to ask for missing time or a missing signature. Our behavioral health revenue cycle management post and the EHR and revenue cycle integration guide cover what happens after the handoff.
Telehealth should work from the same chart, with a visit type that carries through to the claim and a consent record in the chart. Medicare telehealth rules change, so use our behavioral health telehealth post and the telehealth billing guide for current setup and billing, and ask the EHR vendor only that the visit type, location and consent fields exist and flow through.
Map your documentation workflow first
A free practice audit can map how notes, plans, signatures and claims move today, so your EHR demo is tested against your real workflow. Pricing is quoted after the audit.
How should you run the evaluation?
Run the evaluation as a scripted trial. A demo shows what an EHR can do. A trial with your own cases shows what your clinicians and billers will face.
- Write the record list: every note, plan, form and measure your practice creates.
- Give the vendor three real, de-identified scenarios and watch them built live: an individual visit, a group visit and a substance use visit.
- Ask for a psychotherapy note, a progress note and a restricted record to be created, then show who can see each one and what the audit log records.
- Ask for the CHPL listing for the exact product and version, and have counsel read the BAA and the data return terms.
- Run a test export of a sample chart and read it as a new owner would.
- Have the biller follow ten signed visits through to claims, and score each EHR on the same sheet.
Our recommendations
- Name your psychotherapy-note policy before the demo. Decide with counsel what your practice treats as a psychotherapy note and what is a progress note. Then judge each EHR against that policy, not against its own labels.
- Ask how consent travels with Part 2 records. If you treat substance use disorders, ask where consent is stored and what stops a restricted record leaving in a routine release. Do not accept “we can segment it” without seeing it.
- Write your note-sharing rule down. Decide who may hold back or delay a note for a documented reason, and make sure the EHR logs the decision. Have counsel confirm the rule.
- Check the CHPL yourself. Look up the exact product and version. Read which modules and criteria are listed and what the status is. Ask about anything missing.
- Test the export before you sign. Ask for a sample export of a full chart and have someone who did not attend the demo try to read it. This is the cheapest way to see lock-in risk.
- Follow ten visits to payment. Pick different visit types and follow each from note to claim. Every question a biller has to ask the clinician is a gap in the handoff.
Bottom line
A behavioral health EHR is a records decision first. Ask how psychotherapy notes and progress notes are kept apart, how Part 2 consent and restrictions stay attached, how notes are shared with patients, which modules are on the CHPL, and how the full record leaves. The behavioral health practice management guide shows where the EHR fits with billing, marketing and the front desk. For the billing side, see the practice management system page, which describes what RCM Finder offers today.
Frequently asked questions
What is a behavioral health EHR?
It is an electronic health record used by therapists, psychiatrists and substance use programs. It holds intake, progress notes, treatment plans, measures and prescriptions. The behavioral difference is the extra handling for private session notes, substance use records and group sessions, and for recurring visits.
What is the difference between psychotherapy notes and progress notes?
Under HIPAA, psychotherapy notes record or analyze the content of a counseling session and are kept separate from the rest of the record. Progress notes hold things like session times, modalities, test results, diagnosis, plan and progress. They sit in the medical record and follow routine rules.
Does the Cures Act apply to behavioral health notes?
ASTP/ONC says the electronic health information definition does not carve notes out by author type or specialty, but a note that meets the HIPAA psychotherapy notes definition is excluded. The information blocking exceptions are complex, so ask counsel to confirm how your practice applies them.
Do I need an ONC-certified EHR?
Certification is voluntary under the ASTP/ONC program, and whether you need it depends on programs you report to and what your payers or contracts require. If a vendor says it is certified, check the CHPL for the product, version and modules, since certification covers specific modules.
What should I ask about 42 CFR Part 2?
Ask whether your program is subject to Part 2 with counsel. Then ask how the EHR records consent, keeps restriction labels attached when data moves, and logs access. HHS says segmentation is not required under the 2024 final rule, so focus on consent and control.
How do I avoid being locked in by an EHR?
Ask for a sample export of a full chart before you sign, in the format you would receive at exit. Confirm cost and timing for the whole practice and what the contract says about data return. HHS guidance says service terms must not block your access to your data.
Get your free practice audit
Tell us about your practice. We will contact you using the details you give.
- A review of your recent claims, denials and A/R aging
- Where your front desk and prior authorizations slow payment
- A prioritized fix list you keep, whether or not you hire us
Pricing is quoted after the audit, based on your volume and the services you choose. Prefer to talk? Call +1 (302) 556-2288.
Sources
- HIPAA Privacy Rule and Sharing Information Related to Mental Health — HHS OCR (n.d.)
- Mental Health and Substance Use Disorders — HHS OCR (n.d.)
- Fact Sheet: 42 CFR Part 2 Final Rule — HHS (2024)
- Does the EHI definition exclusion for psychotherapy notes apply to all notes? — ASTP/ONC (n.d.)
- Information blocking FAQ: clinical notes and the EHI definition — ASTP/ONC (n.d.)
- Information blocking limited to USCDI period FAQ — ASTP/ONC (n.d.)
- Information Blocking FAQs — ASTP/ONC (n.d.)
- ONC Health IT Certification Program Overview (2024) — ASTP/ONC (2024)
- ONC Health IT Certification Program Overview — ASTP/ONC (n.d.)
- 21 CFR 1311.120 Electronic prescription application requirements — Cornell Legal Information Institute (eCFR text) (n.d.)
- Summary of the HIPAA Security Rule — HHS (n.d.)
- Guidance on HIPAA and Cloud Computing — HHS (n.d.)
- Key Takeaways from HIPAA Guidance on Individuals' Rights to Access Health Information — Crowell & Moring (2016)
Disclaimer: This article is educational and is not legal, compliance, coding or technology purchasing advice. CPT is a registered trademark of the American Medical Association. HIPAA, Part 2, information blocking and certification rules change, and state law may differ, so confirm requirements with counsel. No products are recommended.
