Therapy and Mental Health Practice Shredding: Protecting Patient Confidentiality

Mental health practitioners in New York — including psychologists, licensed clinical social workers, marriage and family therapists, and psychiatrists — handle some of the most sensitive information that exists: therapy notes, psychiatric evaluations, trauma histories, medication records, and treatment plans. The very nature of mental health care requires clients to share deeply personal information, and that trust carries a legal and ethical obligation to protect those records throughout their entire lifecycle — including when they’re no longer needed. For therapy practices across New York City, Long Island, and Westchester, proper therapy practice document shredding is a non-negotiable component of HIPAA compliance and professional ethics.

This article covers what HIPAA requires of mental health practitioners regarding document disposal, which record types are most sensitive, how long therapy records must be retained, and what secure shredding looks like for a solo practice versus a multi-provider group. Whether you’re a solo therapist in a home office or a behavioral health group with multiple locations, the principles are the same: client confidentiality doesn’t end when the therapeutic relationship does.

HIPAA and the Privacy of Mental Health Records

The Health Insurance Portability and Accountability Act (HIPAA) applies to any healthcare provider who transmits health information in electronic form — which includes virtually all licensed therapists who bill insurance or use electronic health record systems. Under HIPAA’s Privacy Rule, mental health records are classified as Protected Health Information (PHI) and receive the same protections as any other medical record, with some additional restrictions on psychotherapy notes.

HIPAA’s Security Rule and Privacy Rule require that PHI be disposed of in a way that renders it “unreadable, indecipherable, and otherwise cannot be reconstructed.” The only compliant methods for physical records include:

• Cross-cut or micro-cut shredding by a certified vendor
• Burning or incineration through a licensed facility
• Pulping through an approved pulping process

Simply placing therapy records in a recycling bin — even in a locked dumpster — does not meet the HIPAA standard. Explore our HIPAA compliance resources for more details.

What Therapy Records Must Be Kept (and For How Long)

Before any document can be shredded, it must have reached the end of its required retention period. Mental health practitioners in New York should be familiar with both federal and state retention requirements, as New York’s rules are sometimes more stringent than HIPAA’s minimums.

Retention guidelines for New York therapy practices include:

• Adult patient records: At least 6 years from the date of last service, or 3 years after the patient’s death — whichever is longer (New York Education Law)
• Minor patient records: Must be retained until the patient’s 22nd birthday or for 6 years after the last date of service, whichever is longer
• Psychotherapy notes (process notes): Not subject to the same access rules as the medical record, but must still be retained and destroyed in compliance with HIPAA
• Billing records: 7 years for records related to Medicaid or Medicare billing; 6 years for other insurance

Once these periods have elapsed, records should be destroyed promptly. Holding records beyond the required period without a clinical or legal reason creates unnecessary risk.

The Special Problem of Psychotherapy Notes

Psychotherapy notes — sometimes called “process notes” — occupy a unique position in mental health recordkeeping. Under HIPAA, psychotherapy notes are defined as notes that document or analyze a therapy session and are kept separate from the rest of the patient’s medical record. These notes are not part of the designated record set and are specifically excluded from most patient access rights.

However, this separation also means that psychotherapy notes require additional care during disposal. Because they often contain the most personal and sensitive clinical observations — including details about family dynamics, past trauma, suicidal ideation, or substance use — they must be shredded with the same or greater care as the formal medical record. Mixing psychotherapy notes with general office paper waste is never appropriate.

Mental health practices should create a separate, labeled secure console or bin specifically for psychotherapy notes to ensure they are always destroyed through a certified shredding process.

Setting Up a HIPAA-Compliant Shredding System for Your Practice

Whether you’re a solo therapist or part of a multi-clinician group, setting up a formal shredding system is straightforward with the right partner. Here’s how to structure your mental health records shredding program:

1. Designate a Privacy Officer: Even solo practices should formally designate a HIPAA Privacy Officer (often the therapist themselves) responsible for overseeing records handling and destruction
2. Obtain locked shredding consoles: Place secure, locked containers in each treatment room, at reception, and in your administrative area
3. Schedule regular pickups: Depending on volume, schedule weekly, bi-weekly, or monthly shredding service with a certified vendor
4. Request Certificates of Destruction: After every shredding event, obtain and file a Certificate of Destruction documenting what was shredded and when
5. Train all staff: Anyone who handles patient records — including administrative assistants and billing staff — must be trained on proper disposal procedures
6. Document your procedures: Maintain written policies for document retention and destruction as part of your HIPAA compliance program

Learn more about how our shredding services are designed to meet healthcare compliance requirements.

Closing a Therapy Practice: What to Do With Client Records

One of the most sensitive moments for any mental health practice is a planned or unexpected closure. Whether a therapist is retiring, relocating, or closing due to illness, client records must be managed carefully. Simply shredding all records at closure without proper notice is a HIPAA violation.

Best practices for practice closure include:

• Notify all active clients of the closure and provide options for obtaining copies of their records
• Arrange for records transfer to a covering practitioner or records custodian for the duration of the retention period
• If assuming custodianship yourself, store records in a secure location and document the storage arrangement
• Once the retention period expires for any records, destroy them using certified shredding with a Certificate of Destruction

New York Shredding provides one-time purge services for practice closures — an ideal solution for practices that need to destroy a large volume of expired records at once. Contact us to discuss your specific situation.

Why New York Businesses Choose New York Shredding

For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit.

Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your office on a shredding schedule that keeps you protected year-round.

Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services tailored to healthcare and mental health practices.