When clients ask for a copy of everything that’s been documented by you about them, it's natural to be hesitant. Your first instinct might even be to refuse. That’s because a lot of the guidance online suggests that such information carries a blanket protection. What’s important to remember is that most of the guidance found online is written for the United States and shaped by HIPAA, which doesn't apply here in Australia.
In Australia, under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APP), clients hold a qualified right of access to most of their health records. This includes therapy notes. Knowing exactly when you can lawfully limit or refuse that access is what separates a confident response from a compliance risk. Also, now that AI-assisted documentation sits inside regular clinical sessions, it’s now even more important to learn and understand the specific nuances of information sharing in a clinical context.
How do psychotherapy notes differ from standard clinical records?
Psychotherapy notes are your private working notes. They are the reflective observations, session impressions, hypotheses, and process notes you record to guide your own thinking between sessions. They capture things like your professional read on the therapeutic relationship, a tentative formulation, or a reminder to explore something next time. They're written for you, by you, and they sit apart from the formal record.
The formal health record is a different thing entirely. It holds your assessments, treatment plans, progress notes, referral letters, and any correspondence that documents the care you provide. This is the record other clinicians, insurers, and the client's broader care team might reasonably need.
The difference between clinical records and therapy notes shapes how you assess an access request. Unlike the United States, Australia has no HIPAA-style statute which automatically shields psychotherapy notes from disclosure. Classification alone doesn't decide access. Calling something a "process note" doesn't place it beyond a client's reach. What decides access is the Privacy Act 1988 (Cth) and the specific exceptions it allows.
Can Psychotherapy Notes Be Released to a Patient? What Australian Privacy Law Actually Says
In Australia, clients generally do have a right to patient access to their mental health records, therapy notes included, under Australian Privacy Principle 12 of the Privacy Act 1988 (Cth). This right is qualified, not absolute. The default position is that you must give access when a client asks. You can only refuse or limit access where a specific exception applies, and the burden sits with you to justify that refusal.
There's a great deal of confusion around whether psychotherapy notes can be withheld from patients, and it's precisely this point that trips up practitioners who've read US-focused guidance. Under HIPAA, psychotherapy notes carry a genuine statutory protection: a patient doesn't have a right to compel their disclosure [12]. That doesn't translate here. Under psychotherapy notes privacy law in Australia, they aren't automatically exempt in the same way. Whether you must release a given note depends on the exact content of the record and which APP 12 exception, if any, you can lawfully rely on.
The APP 12 exceptions that allow you to refuse or limit access
Chapter 12 of the Australian Privacy Principles (APP 12) lists the grounds on which a private-sector health provider can refuse or limit access to information. The exceptions most relevant to therapy notes include where giving access would:
- Pose a serious threat to the life, health, or safety of any person
- Have an unreasonable impact on the privacy of other individuals
- Prejudice legal proceedings between you and the client, or be otherwise unlawful
- Reveal your evaluative information generated in connection with a commercially sensitive decision-making process
- Be likely to prejudice an investigation of possible unlawful activity
These exceptions are narrowly defined. To avoid making a blanket decision, you must exercise caution before relying on any of them. A general reluctance to share your working notes is not a lawful ground. This means a psychologist can only withhold notes from a patient in Australia when one of these specific grounds genuinely applies. Let’s examine this in more detail with the help of a client example:
Let’s assume a client requests their session process notes. In those notes however, you’ve recorded concerns about the client's partner, including something the client disclosed about that partner's behaviour. Releasing the notes verbatim could have an unreasonable impact on the privacy of a third party. That engages the privacy-of-others exception.
Even in this case, your response doesn't necessarily have to be a flat refusal. You might release the notes with the third-party material redacted, giving access to everything the client is entitled to while protecting the other person's privacy. But whatever exception you rely on, be sure to document it and put it to the client in writing. A refusal you can't explain is a refusal that exposes you.
A psychologist's obligations when a patient requests their notes
When a client requests access to their records, APP 12 sets out a clear sequence you're obliged to follow.
- Respond within 30 days: You have 30 calendar days from the request to respond. This means, within 30 days, you either decide to give access or provide your written decision against it.
- Don't charge for the request itself: You can't charge a fee simply for the client making a health information request. You may charge for giving access, such as copying costs, but that fee can't be excessive.
- Give access in the manner requested where reasonable: If a client asks for a digital copy, provide a digital copy where it's practical to do so.
- Provide written reasons if you refuse or limit access: Where you rely on an exception, you must put your reasoning in writing. Name the exception, explain how it applies, and note what you've released versus withheld.
- Tell them how to complain: Your written response must inform the client of the mechanisms available to them, including lodging a complaint with the Office of the Australian Information Commissioner (OAIC).
How to weigh clinical risk when handling an information request
Your duty of care runs alongside your privacy obligations. Some material is clinically sensitive enough that releasing it without any redactions could cause serious harm to the client or another person. That harm potential is precisely what the serious-threat exception speaks to.
But even when there is a potential for harm, refusal is rarely your only tool. Best practice suggests offering supervised access or a clinical debrief, where you sit with the client and walk them through the material in a contained way. This is far more preferable than handing over unfiltered notes or shutting the request down entirely. By taking such an approach, you honour the right of access while simultaneously managing the clinical risk. In practice, there is no single course of action that works for every client and every kind of request. For example, let’s assume your notes contain a raw formulation about a suicidal ideation you were still testing. Sharing this with your client, even though they have legitimate rights to view it, could set back your clinical progress. At such times, the rules outlined by APP 12 alone aren’t enough to guide you. You have to make a judgement call and be prepared to defend it later.
Dealing with state and territory mental health legislation
Federal privacy law doesn't operate alone. State and territory Mental Health Acts sit alongside the Privacy Act. These acts can impose their own record access and confidentiality provisions. The Mental Health and Wellbeing Act 2022 in Victoria and the Mental Health Act 2007 No 8 in New South Wales are two examples, and each carries its own rules around information handling for clients receiving treatment under those frameworks.
Where state or territory law is more protective of client privacy, it can override or supplement the federal position. This matters most for clients under compulsory treatment orders or receiving care within the public mental health system, where jurisdiction-specific confidentiality rules may apply.
Check the legislation in your own jurisdiction rather than assuming the federal framework is the whole picture. For complex cases, particularly those involving compulsory treatment or contested access, get legal advice before you respond.
Understanding mandatory disclosures
Some situations require disclosure and override your usual confidentiality obligations. There are three you need to recognise.
- Court orders and subpoenas: A court can order the production of records. In Australia, this extends to psychotherapy notes as well. In practice it's unlikely. A general records subpoena is far more likely to capture the formal clinical record. [7], and you'd usually be more likely to testify about the official record than hand over your process notes. But a court can specifically compel them, and a valid order must be complied with.
- Mandatory reporting: Child protection legislation in every state and territory imposes mandatory reporting duties, and elder abuse obligations apply in various forms. Where these are triggered, you disclose regardless of consent [1].
- Duty to warn or protect: Where there's a serious, credible, and imminent threat to the safety of an identifiable person, you may be obliged to act, including by disclosing relevant information.
In each scenario, document your decision-making carefully: what you knew, what you disclosed, to whom, and why. That record is your protection.
Confidentiality in Healthcare in the Age of AI: What Practitioners Must Consider
When an AI tool transcribes or drafts your session notes, confidentiality in healthcare takes on a new dimension. This is because your client's most sensitive disclosures may be processed and stored somewhere you can't see.
The main risk is cross-border data flow. Many AI transcription and note-generation tools process data on offshore servers. The moment that happens, APP 8 comes into play, governing cross-border disclosure of personal information and holding you accountable for what an overseas recipient does with it.
Psychotherapy notes carry heightened sensitivity given the intimate nature of their content [6], which raises the stakes further. If you think your psychotherapy notes might be exposed to such risks, we recommend the following checklist:
- Confirm privacy standards are met: You need to check that any AI tool you use for clinical documentation meets Australian privacy standards and, ideally, keeps data onshore.
- Inform clients about the use of AI: When AI is used in their care, you need to keep clients informed before data is stored, and maintain a record that you've done so.
- Understand your role as data controller: Irrespective of the AI tool used, the obligations to maintain the integrity of client data ultimately stays with you.
Should psychotherapy notes be kept separate from the main record?
Keeping your psychotherapy process notes separate from the primary clinical record is smart practice, even though Australian law doesn't require it.
The benefit is administrative clarity. When an access request arrives, separation lets you assess each category of record on its own terms. To meet immediate compliance, you can hand over progress notes and treatment plans. At the same time, separation of process notes gives you more time to conduct a closer, exception-by-exception review. That's a faster, cleaner response, and one far less likely to result in something being released or withheld by accident.
To make separation work, label your record types clearly within your practice management system and apply access controls to match. Process notes should be visible only to the practitioners who need them, with permissions set deliberately rather than left open by default.
How practice management software supports compliant record-keeping
Everything above becomes far more manageable when your software is built for it. Compliant record-keeping depends on a few practical capabilities: role-based access controls so the right people see the right records, audit trails that log who accessed what and when, secure storage, and the ability to separate note types cleanly.
Australian data residency belongs on that list too. If your records are stored onshore, you sidestep a large part of the APP 8 cross-border complexity from the outset.
splose is a practice management platform built to support these obligations. It gives you role-based access controls, a clear audit trail, secure onshore storage, and the ability to separate sensitive clinical notes from the main record. Responding to an access request and documenting your decisions becomes part of your workflow rather than a scramble. With the right practice management platform, compliance work still rests on your clinical judgement, but you don’t have to carry the infrastructure load.
Navigating psychotherapy note requests with confidence
Australian law gives clients a qualified right of access to their records, therapy notes included, but the APP 12 exceptions let you lawfully limit or refuse access where the grounds are genuine. The condition attached to that discretion is documentation. Your reasoning has to be recorded, defensible, and consistent. Mandatory disclosure obligations sit above confidentiality, and AI-assisted notes add a fresh layer to think through before a request lands.
Here's your next step. Before the next email arrives, run an audit of one closed client file and ask whether you could respond to an access request today. Can you separate sensitive notes from the main record? Is your reasoning captured anywhere? That single exercise will show you where your systems hold up and where they don't. A practice built on secure infrastructure and clear processes turns these moments into routine, and routine is what lets your practice grow.
