Mental Health EHR

What is a mental health EHR?

A mental health EHR is an electronic health record built for psychiatry, psychology, counseling and substance use treatment. It keeps psychotherapy notes apart from the main record, manages consent for sensitive data under HIPAA and 42 CFR Part 2, tracks outcomes with standard rating scales, and supports individual, group, family and telehealth sessions.

General EHRs can store a therapy note, but they often lack the privacy controls, consent logic and outcome tracking that behavioral health needs, and they rarely handle a single session with several clients well.

What makes behavioral health documentation different?

Behavioral health documentation differs in its privacy rules, its reliance on narrative, its measurement tools and its session formats. Each difference changes how the EHR must be built.

• Two kinds of notes: Progress notes that belong in the medical record, and psychotherapy notes that HIPAA protects separately.
• Narrative depth: Assessments and treatment plans rely on detailed narrative, so templates must guide without forcing everything into checkboxes.
• Rating scales: Standard questionnaires track symptoms over time and should be stored as scored data, not scanned forms.
• Session formats: Individual, couples, family and group sessions, each with its own documentation and billing pattern.
• Safety planning: Risk assessments and safety plans that must be easy to find in a crisis.
• Sensitive diagnoses: Substance use disorder records that may fall under 42 CFR Part 2.

How should a mental health EHR handle psychotherapy notes?

A mental health EHR should store psychotherapy notes separately from the rest of the record, restrict access to the author by default, and block their release without the specific authorization HIPAA requires. The progress note, which holds the clinical summary, stays in the main record.

• Definition: Under 45 CFR 164.501, psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the contents of conversation during a counseling session, kept separate from the rest of the record.
• What they exclude: Medication prescription and monitoring, session start and stop times, modalities and frequencies of treatment, clinical test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress.
• Authorization: 45 CFR 164.508(a)(2) requires an authorization for most uses and disclosures of psychotherapy notes, with limited exceptions.
• Separate forms: An authorization for psychotherapy notes may be combined only with another authorization for psychotherapy notes.

In the software, this means a separate note type with its own storage, access rules and release workflow. The exclusions matter just as much: if clinicians put the diagnosis or treatment plan only in psychotherapy notes, the main record is incomplete and those details lose their special protection anyway.

What does 42 CFR Part 2 require from the EHR?

42 CFR Part 2 protects records of federally assisted substance use disorder treatment programs. HHS's February 2024 final rule aligned Part 2 more closely with HIPAA, took effect on April 16, 2024 and required compliance by February 16, 2026, so EHRs used by Part 2 programs must now support its consent and labeling rules.

• Single consent for TPO: Patients can give one consent for all future uses and disclosures of their Part 2 records for treatment, payment and health care operations.
• SUD counseling notes: The rule created a separate category of SUD counseling notes, which need their own specific consent, similar to psychotherapy notes under HIPAA.
• Record tracking: The EHR must know which records came from a Part 2 program, so the right rules follow them when they are shared.
• Redisclosure: Records disclosed under Part 2 consent need clear labeling so recipients know limits on further use apply.
• Legal proceedings: The rule keeps strong limits on using Part 2 records against patients in legal proceedings without consent or a court order.

Integrated practices that offer both mental health and substance use treatment need to track which parts of a record are Part 2 records. Tagging at the note and encounter level, rather than the whole chart, keeps the rest of the record usable.

How should consent be managed in a mental health EHR?

Consent should be stored as structured records that the system checks before every disclosure, not as scanned forms. Each consent needs a scope, a recipient, a purpose, an expiry and a revocation path.

• Scope: Which records the consent covers, such as all records, Part 2 records or psychotherapy notes only.
• Recipients and purposes: Named recipients or classes of recipient, and the purposes allowed.
• Expiry and revocation: An end date or event, and an easy way to record a revocation that takes effect at once.
• Minors: Rules for adolescent consent, which vary by state and service type.
• Release checks: The release-of-information workflow checks consent automatically and blocks disclosures it does not cover.

How does measurement-based care work in the EHR?

Measurement-based care means giving clients standard rating scales at regular intervals and using the scores to guide treatment. The EHR should send the scales, score them, chart the trend and put the results in front of the clinician during the session.

• Scheduled scales: Questionnaires such as the PHQ-9 for depression and the GAD-7 for anxiety sent before sessions through the portal or a tablet.
• Automatic scoring: Scores calculated and stored as discrete values, with item-level answers kept.
• Trend charts: Scores over time shown beside the treatment plan, so progress or lack of it is clear.
• Safety items: Responses to suicide-related questions flagged immediately for clinician review.
• Reporting: Aggregate outcomes by clinician, program and diagnosis for quality and value-based contracts.

The value comes from using the data during care. A score that only appears in a quarterly report changes nothing for the client; a score on screen at the start of the session can change the conversation.

What do group, family and telehealth sessions need?

Group and family sessions need one session record that links to each participant's chart, with a shared session description and individual notes, while keeping each participant's information out of the others' records.

• Group roster: Attendance recorded once, creating an entry in each attendee's chart.
• Shared and individual content: A common description of the session, plus individual observations for each client.
• Privacy: No client's name or details appear in another client's record or released documents.
• Billing: Group and family codes applied correctly to each participant who is billed.

Family sessions add a further question: who may see the note afterwards. A parent who attended a family session may have access rights to a minor's record, while an adult partner in couples therapy usually does not have access to the other partner's chart. The access rules should follow the client, not the session.

Telehealth support should be built into scheduling and documentation, so a virtual session is created, joined, documented and billed from the same record. Behavioral health uses telehealth heavily, and audio-only sessions are common.

• Integrated video: Sessions launched from the appointment, with no separate login for clients.
• Location capture: Client location recorded each session, which matters for licensing and safety planning.
• Modality: Video or audio-only recorded in the note for billing and compliance.
• Emergency details: Local emergency contacts and resources for the client's current location.

How should a mental health EHR share data?

A mental health EHR should share what care partners need, such as medications, diagnoses and care plans, while holding back psychotherapy notes and any Part 2 records not covered by consent. That requires labeling sensitive data at the point it is created.

• Security labels: Tag sensitive resources, for example with FHIR security labels, so sharing rules can act on them.
• Filtered exports: Documents and API responses include only what the consent and purpose allow.
• Primary care coordination: Share care plans and medication changes with primary care where the client agrees.
• Audit: Log every disclosure with recipient, purpose and the consent it relied on.

Labeling only works if it happens when data is created. Retrofitting labels across years of existing notes is slow and error-prone, so new behavioral health systems should set the labeling rules before go-live and apply them to migrated data as part of the conversion.

Where do mental health EHRs fall short?

Mental health EHRs fall short when privacy is handled by policy instead of software, or when outcome data never reaches the session.

• Notes mixed together: Psychotherapy notes stored as ordinary notes, visible to anyone with chart access.
• Scanned consents: Consents kept as images, so release staff check them by hand.
• All-or-nothing sharing: Whole charts shared or withheld, because sensitive parts are not labeled.
• Paper scales: Questionnaires scored by hand and filed, with no trend view.
• Hidden safety plans: Safety plans buried in old notes, where on-call staff cannot find them quickly.

Each of these can be fixed in software rather than with more training. When the system knows what a psychotherapy note is, which records came from a Part 2 program and what each consent allows, staff no longer have to remember the rules under time pressure.

How Agnotic can help

Agnotic Technologies builds behavioral health EHR features for clients: separate psychotherapy and SUD counseling note types, structured consent records with automated release checks, Part 2 record labeling, and measurement-based care with scheduled scales and trend charts.

Agnotic also builds the interfaces that let behavioral health providers share care plans and medications with primary care and hospitals, filtered by consent and labeled so sensitive data stays protected.

Sources

• 45 CFR 164.501: Definitions, including psychotherapy notes
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• Federal Register: Confidentiality of Substance Use Disorder (SUD) Patient Records, final rule (2024)
• HHS: Part 2 (Confidentiality of Substance Use Disorder Patient Records)