Testing is the part of psychology that behaves least like the rest of the chart.

The RealityThree artefacts, three different rules

⚠️

The Problem

Everything lands in one document bin.

Raw protocols, score summaries and the report filed identically, so any request for records reaches all three and nobody has a basis for treating them differently.

🔧

The Solution

File by artefact type, decide once.

Separate raw data, scores and report in the record, and write down which sits in the designated record set and who may receive it.

✅

The Resolution

A defensible answer ready in advance.

Requests answered from a written policy rather than improvised, and the reasoning documented before anyone is under pressure.

Psychotherapy notes are not what most people think

Start here, because this is the most commonly misapplied protection in mental health records and it does not cover testing.

The regulation defines psychotherapy notes as notes recorded in any medium by a mental health professional documenting or analysing the contents of conversation during a private counselling session, and separated from the rest of the individual’s medical record. It then lists what is excluded, and the list is the important part: medication prescription and monitoring, session start and stop times, modalities and frequencies of treatment, summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress — and clinical test results.

Clinical test results are excluded by name. So the heightened protection that applies to psychotherapy notes does not extend to testing output, and a practice treating the two as equivalent is working from a belief rather than the rule.

HHS makes the separation requirement explicit too: the notes only qualify where they are kept apart from the rest of the record. A note filed in the chart alongside everything else is not a psychotherapy note in the regulatory sense, whatever it is called locally.

The designated record set decides the answer

If testing output is not protected as psychotherapy notes, what governs it? The designated record set.

The same section defines that as a group of records maintained by or for a covered entity comprising medical and billing records maintained by a provider, a health plan’s enrolment and claims systems, and records used by the covered entity to make decisions about individuals. That last clause is the one that matters for testing, because a battery used to reach a diagnosis or a recommendation is, plainly, a record used to make decisions about an individual.

Which means the useful question is not “is this releasable” in the abstract. It is which artefacts your practice maintains, where, and whether each falls inside that set. Answer that once, in writing, and requests stop being improvised.

Raw test data and who is entitled to it

This is where a genuine tension sits, and it is worth stating both sides rather than pretending it is settled.

On one side, the individual’s right of access to records used to make decisions about them is broad. On the other, test protocols are frequently copyrighted instruments whose validity depends on the items not being in general circulation, and releasing them to an unqualified recipient carries a real risk of misinterpretation. Different practices resolve this differently, and some resolve it by releasing to a qualified professional nominated by the patient rather than to the patient directly.

What we would not do is leave it undecided until a request arrives. Write the policy, note the reasoning, and have your own counsel review it — this is a legal question with clinical consequences, not an IT configuration. We are deliberately not telling you what the answer should be.

Test administration: who does it, and what gets billed

The documentation has to show who did what, because the billing rules turn on it. CMS states that only physicians or clinical psychologists may provide general supervision for diagnostic psychological and neuropsychological tests.

The structure below that is specific. Technician-administered testing is billed by the hours the technician spends face to face with the patient. Computer-administered testing is billed once regardless of how long it took. And the professional codes cover time spent on test administration, interpretation and report preparation, as well as integrating previously interpreted results into a comprehensive report.

Each of those is a different time record kept by a different person, which is why testing documentation is as much a workflow design problem as a clinical one. A template that captures who administered, in what mode, for how long, at the point of service is worth building properly, because reconstructing it at the end of the month does not work.

Scoring reports and the vendor problem

Most testing now involves a vendor platform somewhere — for administration, scoring, norm lookup, or report generation. That platform holds patient responses.

So it is a business associate, and the questions are the ordinary ones that get skipped because the platform arrived through the clinical side rather than through IT. Is there an executed agreement. What is retained on their servers and for how long. Can data be exported if you leave. Who inside the practice has accounts, and is that list reviewed when someone departs.

The standardised norms these platforms apply are exactly why they are worth using — a normed score is only meaningful against the population it was derived from, and the NIH-hosted review of psychological testing notes that applying a test to individuals for whom it was not intended can produce inaccurate scores and misinterpretation. That is an argument for the platform, and equally an argument for knowing which norm set it used and recording it.

What to fix first

• Separate the three artefacts in the record. Raw protocol, scores, report. Different document types, not one bin.
• Write the release policy before the next request. With your counsel, not from a forum post.
• Capture administration mode and time at the point of service. Technician, computer or professional.
• Inventory the testing platforms. Agreement, retention, export, account list.

Qventive provides psychological testing documentation software support in New Jersey as part of our psychology EHR and IT work and a broader psychology practice management engagement. Because testing platforms hold patient responses outside your own systems, they belong in your HIPAA risk analysis and usually in a wider cybersecurity compliance review as well.

Where testing is administered remotely, the same three artefacts arrive by a different route and the same questions apply — worth settling alongside your telehealth setup rather than separately.

Testing documentation: common questions