“Too Sensitive to Release” Is Not an Exception

A 16-year-old established patient is seen for follow-up. The note contains a safety statement, a parent disclosure, and a disposition paragraph. The psychiatrist believes psychiatric notes do not go to the portal. Front-desk staff believe the parent’s proxy account sees everything. The EHR is configured a third way: the progress note releases to the adolescent account on a delay, the parent proxy sees a filtered view the practice has never tested, and item 9 of today’s PHQ-9 is already in a results feed.

This fictional composite is not a patient case. It is three unverified beliefs about the same signed note.

There is no psychiatric-specialty carve-out. “Behavioral health is sensitive” is not one of the information-blocking exceptions.

Sources reviewed August 15, 2026: U.S. federal baseline, not a state-law conclusion or nationwide standard of care.

Information blocking is a practice by an actor that is likely to interfere with access, exchange, or use of electronic health information, except as required by law or covered by an exception in 45 C.F.R. Part 171. Health care providers, certified-health-IT developers, and health information networks or exchanges are actors.

HIPAA is the individual’s access right and certain permitted denials. Information blocking is a practice likely to interfere with access, exchange, or use of EHI. A delay can interfere even if a HIPAA access clock has not run. A Part 171 exception is not the same as a HIPAA access denial, though some exceptions incorporate HIPAA concepts.

For a health care provider, the question is whether the provider knows that the practice is unreasonable and likely to interfere. For a developer of certified health IT, or a network or exchange, the standard is whether the actor knows or should know the practice is likely to interfere.

Since October 6, 2022, EHI is not limited to the United States Core Data for Interoperability. It means electronic protected health information to the extent it would be included in a designated record set. Two categories are excluded: psychotherapy notes as defined in 45 C.F.R. § 164.501, and information compiled in reasonable anticipation of legal proceedings. A psychiatric progress note, an E&M note, a problem list, a medication list, a PHQ-9, and a lab result are not excluded because they are “behavioral health.”

The original Cures Act final rule identified eight exceptions. That count is stale: HTI-1 added TEFCA Manner; HTI-3 (December 2024) added Protecting Care Access and revised Privacy and Infeasibility. Part 171 now lists ten. None is a psychiatric-specialty carve-out. HTI-5 (December 29, 2025; comments closed February 27, 2026) would tighten several interpretations and remove TEFCA Manner. It remains proposed — not current law.

Enforcement is active, not hypothetical (2025 OIG/ASTP alert; 2024 CMS provider disincentives in effect; 2026 developer notices of potential non-conformity). Consequences depend on actor type and federal program. ASTP recorded 2,563 submissions and 2,450 possible claims through July 31, 2026 — allegations, not findings. HHS estimated in the disincentives rulemaking a median eligible-hospital disincentive of roughly $394,000 — hospital-scale, not a small-practice fine schedule.

Treat each artifact separately.

Designated-record-set documents and, when electronic, EHI. “Psychiatric” does not change the category.

The § 164.501 definition is narrow: notes that document or analyze conversation during a counseling session and that are separated from the rest of the medical record. It excludes medication prescription and monitoring, session times, modalities and frequencies, test results, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, or progress. An EHR checkbox does not create a psychotherapy note. Information specifically excluded from the HIPAA definition of psychotherapy notes does not become psychotherapy-note information merely because it is placed in a document labeled “psychotherapy note.”

Decision-making instruments and item-level results sit in the designated record set. They are not psychotherapy notes.

EHI. Releasing them while withholding the note still discloses what those artifacts contain.

State minor-consent categories — commonly reproductive and STI services, substance-use treatment, and mental-health care — vary by jurisdiction. This is not a 50-state answer. The operational question is whether the EHR can segment what the applicable state law requires.

Compliance date was February 16, 2026. Application still depends on the program, the records, and the facts. See Issue 2.

Portal messages are often EHI. A systematic delay applied only to psychiatric notes can interfere. A § 164.526 dispute is a record right, not an exception.

Verify the map with a test-patient account and a test-proxy account. A vendor slide is not a configuration.

Exceptions are voluntary safe harbors. Meeting one means the practice is not information blocking. Missing all of them is not automatically information blocking; review is then against the definition, including the provider knowledge standard.

Individualized determination by a licensed professional with a current or prior clinician-patient relationship, or a risk from data known or reasonably suspected to be misidentified, mismatched, or corrupt. No broader than necessary. Type of harm aligned with § 164.524(a)(3): life or physical safety of the individual or another person; substantial harm to another person mentioned in the information; or, for a legal representative, substantial harm to the individual or another person. Emotional upset is not that standard. Review right aligned with § 164.524(a)(4). A blanket “no psychiatric notes in the portal” fails individualization, type of harm, and breadth. That does not make every withhold information blocking.

Distinct sub-exceptions. Not every privacy concern qualifies. In outpatient psychiatry: a required federal, state, or tribal precondition that has not been satisfied (including minor-consent rules); a denial of the individual’s own access consistent with § 164.524(a)(1) and (2); and an individual’s request not to share EHI, documented, not improperly induced, and applied consistently. HTI-3 removed the former limitation that restricted this sub-exception to situations in which sharing was not otherwise required by law. A documented individual request can therefore support the § 171.202(e) safe harbor even when the actor is uncertain whether another law or instrument may ultimately compel disclosure. The sub-exception protects against information-blocking liability; it does not override a separate law that actually requires disclosure. That is a documented individual request, not a psychiatric withhold.

Added by HTI-3 (December 2024). Not a general psychiatric-note exception. Specific threshold: a good-faith belief that particular access, exchange, or use of specific EHI could expose persons who seek, obtain, provide, or facilitate reproductive health care to legal action, plus tailoring and implementation by policy or case-by-case determination — and either the patient-protection or the care-access condition. Psychiatric records that intersect reproductive care may fall inside its scope; most ordinary psychiatric records do not fall in merely because they are sensitive. In Purl v. HHS (N.D. Tex. June 18, 2025), the court vacated most of the 2024 HIPAA reproductive-health privacy rule; certain Notice of Privacy Practices modifications remained in effect. HHS did not appeal; the Fifth Circuit dismissed the intervenor appeal September 10, 2025; the vacatur stands. That does not invalidate § 171.206. This article does not treat the vacated HIPAA rule as current law.

The remaining exceptions are not psychiatric carve-outs: Security (§ 171.203); Infeasibility (§ 171.204), including segmentation (HTI-3 expanded this; HTI-5 would narrow other conditions of the exception — proposed only); Health IT Performance (§ 171.205); Manner, Fees, and Licensing (§§ 171.301–171.303); and TEFCA Manner (§ 171.403), which HTI-5 proposes to remove.

For any withhold, record who decides, which condition, individualized or written policy, where it lives, and the re-review trigger.

A 16-year-old’s note has at least two audiences: the adolescent, and a parent or guardian who may have a proxy account, a shared login, or both.

The federal root of the proxy analysis is the HIPAA personal-representative rule at 45 C.F.R. § 164.502(g), which § 171.202 itself cross-references in defining “individual.”

In the studied health systems, Ip and colleagues (2021) estimated that 64 to 76 percent of adolescent portal accounts with outbound messages had been accessed by a guardian at least once — message-content analysis at three academic children’s hospitals, not a national prevalence. NASPAG/SAHM, the AAP, and SAHM treat separate adolescent and proxy accounts, plus segmentation, as the operational design.

State law, not a vendor default, decides which content a minor can keep from a parent — commonly reproductive and STI services, substance-use treatment, and mental-health care, with state-specific age cutoffs and exceptions (abuse, danger, court order). A vendor default is not a legal entitlement. Shared credentials and proxy access create uncertainty about who is reading the note.

Silence is not segmentation.

Issue 3’s disposition paragraph will now be read by the patient. That changes the craft, not the clinical duty.

Attribute the safety statement to the speaker; label collateral as collateral; drop shorthand that reads as contempt; replace “poor historian” with what could not be obtained and why; document disagreement without characterological assumptions.

Accuracy, the risk formulation, the medication rationale, the disposition, and the follow-up — not to be sanitized because the patient may read them. Writing differently is appropriate. Falsifying or omitting clinically important information is not.

OpenNotes evidence is associative, not causal. Denneson and colleagues (178 veterans in mental-health care): 49 percent more in control, 45 percent more trust, 8 percent often or always upset. Fernández and colleagues (22,959 patients who read an outpatient note, 2021): 10.5 percent felt judged or offended — usually errors, surprises, labeling, or disrespect. Associations in specific samples. They do not prove open notes harmless or justify a blanket specialty withhold.

Operational and documentation failures, not universal legal conclusions. Correcting them does not create an exception.

Sensitivity is not a Part 171 exception.

The § 164.501 definition is content plus separation. A flag is neither.

Information specifically excluded from the HIPAA definition of psychotherapy notes does not become psychotherapy-note information merely because it is placed in a document labeled “psychotherapy note.”

The psychiatrist, the front desk, and the EHR can each be wrong. A test account is the verification.

An unsigned belief is not a Preventing Harm determination.

An individualized harm determination and a state-law precondition expire when the facts change.

Removing the risk formulation so the portal is comfortable falsifies the record.

A delay is a practice. It needs a reason that survives the definition.

Download the Psychiatric Record Release Decision Record (PDF)

If any answer is unknown, do not treat the note as released, withheld, or “handled by the EHR.” Name an owner.

Educational Disclaimer: The Psychiatric Record provides general educational information for psychiatric and mental-health professionals. Content does not constitute medical, legal, regulatory, compliance, billing, or other professional advice; does not establish a standard of care; and is not a substitute for independent professional judgment. Requirements and appropriate practices may vary by jurisdiction and circumstance. Verify current authoritative sources.

This article does not determine whether a particular note must be released or withheld, and the companion worksheet does not create an exception or approve a portal configuration.