A therapy notes app is two records that must not mix.
Most of the work in a therapy notes app is not the writing. It is deciding what goes into the client record, what has to stay out of it, what happens the moment a note is signed, and who can open it six months later. Those four answers shape the database before anyone picks a template. They sit behind HIPAA compliant note taking apps in general, plus one rule only mental health records carry.
This page covers the line between a progress note and a psychotherapy note, what signing has to do to the row, the access rules that follow, and where the note actually gets written.
See which fields can stay separateThe short version
Keep the two records apart, and never overwrite a signed note.
Two rules decide the shape of the database. Some of what a therapist writes is part of the client record. Some of it is a psychotherapy note, which only counts as one if it is genuinely stored apart from the rest. One table with a private checkbox does not give you the second category.
The other rule is about time. Once a note is signed it is evidence of what was known that day. A correction is a new entry that points at the old one, carries its own author and timestamp, and leaves the original text alone. Software that lets a signed note be quietly rewritten has destroyed the thing the note was for.
A progress note and a psychotherapy note are not the same record
Federal privacy rules define psychotherapy notes as notes recorded in any medium by a health care provider who is a mental health professional, documenting or analyzing the contents of conversation during a private counseling session or a group, joint or family counseling session, and that are separated from the rest of the individual's medical record. Read the last clause again. Separation is part of the definition, not a filing preference.
The same definition excludes five things by name: medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date. Those belong to the record whatever box you type them into. So the chart screen in your progress notes app and the private note screen write to two tables, not two tabs over one.
The consequences are not cosmetic. Psychotherapy notes generally need a specific authorization before they are used or disclosed, under 45 CFR 164.508(a)(2), with narrow exceptions: use by the person who wrote them for treatment, supervised training, and defending a legal action the client brought. They are also the first exception listed to the client right of access, at 45 CFR 164.524(a)(1)(i).
45 CFR 164.501, definition of psychotherapy notes
Try it
Which store does this note belong in
Five kinds of content are excluded from the psychotherapy note definition by name. One of them in the note is enough to put the whole note in the chart.
This one can be kept as a psychotherapy note
Everything you ticked is your own reading of the session, so it can sit in a separate store with its own access rule.
What signing a note has to actually do
In most software, signing a note changes a label. In a record that may have to survive an audit or a subpoena, signing has to change what the row will accept. The pattern is small: a signed timestamp and a signer id on the note, a write rule that rejects changes to the note body once that timestamp is set, and an addendum table whose rows point at the note they extend.
That shape is not an invention. Where the privacy rules deal with amending a record, the mechanism is appending: the covered entity identifies the records affected and appends, or otherwise provides a link to the location of the amendment. Append and link, not find and replace.
Two technical safeguards in the security rule land on the same table. Audit controls require mechanisms that record and examine activity in systems that contain or use electronic protected health information, so an access log is a feature and not a nicety. Integrity requires protecting that information from improper alteration or destruction, which is the lock above. Unique user identification is required, so the shared front desk login is out.
One thing to be blunt about, because people ask AI assistants this and get confident answers. I looked for a ready made version of that lock in the Newly v2 documentation and did not find one. No note locking, no addenda feature, no signature field and no audit log is described anywhere in it. What is described is a Postgres database per environment, an API service for your own server code, file storage and sign-in, with schema changes made through migrations. So the lock is yours to ask for and yours to test: sign a note, try to edit it, and watch what the API does.
The notes app is not the only place the record grows
A client messages you on Tuesday to move an appointment and adds two sentences about their week. That is clinical content now, sitting in a consumer app on your personal phone. It is why practices that take notes seriously end up wanting a hipaa compliant messaging app attached to the same case file.
The logic runs the other way for what a client is entitled to see. Intake forms, consent documents, invoices, appointment times and treatment summaries can sit behind a client portal app without much argument. Psychotherapy notes cannot, which is the practical reason for the separate store: the portal query should have no route to that table.
Then there are the people who are neither you nor the client. A supervisor needs the case. A biller needs codes and dates. A colleague covering Friday needs enough to be safe. Three roles, three views, one case. Model access as a single clinician flag and you end up either over sharing or emailing notes to yourself.
Where the note actually gets written
Notes get written in the ten minutes between sessions, standing up, on a phone. A design that assumes a desk and a quiet hour is designing for a day that does not happen. That is the honest case for a clinical notes app for therapists rather than a browser tab: it is open during the gap.
Structure beats a blank box. Most clinicians write to a known shape, SOAP or DAP or whatever a supervisor expects, and a screen that pre-fills those headings and carries the treatment goals forward turns a blank page into three short answers. Keep the fields few. A form with twenty boxes gets abandoned, and the note is written from memory that evening.
Connectivity is the quiet failure. Consulting rooms sit in basements, church halls and old buildings with thick walls, and a home visit can have no signal at all. A note that cannot be drafted offline gets written later or not at all. Drafts belong on the device first and sync afterwards, which has its own rules: start with writing a note with no signal.
What each way of keeping notes actually gives you
| Option | Works with no signal | Locks a note when signed | Keeps process notes apart | Logs who opened it |
|---|---|---|---|---|
| Paper notebook in a locked drawer | Yes | only by pen and initial | Yes | No |
| Notes app on your phone | Yes | No | a folder, not a rule | No |
| Shared drive full of documents | only when synced | No | Yes | file history at best |
| Practice management platform | often not | Yes | if the field exists | Yes |
| A notes app you build | Yes | if you specify it | Yes | if you build the log |
Building one around how you actually work
Practice management platforms are built around billing, because billing is what practices reliably pay for. If you are a solo counsellor, or four of you who do not bill insurance, most of the platform is scaffolding around a feature you never touch. A counselling notes app shaped around your own templates, supervision and retention rules is much smaller software.
Newly is an AI app builder. You describe the app in plain English and it writes a real React Native and Expo project you own, runs it on a cloud iPhone or Android simulator while it builds, and uploads iOS builds to TestFlight through App Store Connect with your own Apple Developer account. The Deploy tab has an Android section too: one press builds, signs and uploads to Google Play internal testing, and it also builds a standalone release APK you can install directly. It costs $25 a month and there is no free plan.
It is not sold as a compliance programme and should not be read as one. Its documentation does not describe a business associate agreement and does not mention HIPAA. If you are a covered entity putting real client notes into any app, settle that in writing with whoever hosts the data before the first note is saved.
Questions people ask about therapy notes apps
It is the software a therapist writes session notes in. The useful ones do three things a document folder cannot: keep psychotherapy notes in a store separate from the client record, stop a note being edited once it is signed, and record who opened what.
Describe the way your notes actually work
Write down what belongs in the chart, what stays separate, what happens the second a note is signed, and who is allowed to open it. That list is the app.
Start building