Clinical documentation mistakes that put your practice at risk

No psychologist gets into trouble for writing inelegant notes. Practices get into trouble when the record cannot prove what was actually done. The APA’s Record Keeping Guidelines state the risk equation plainly: appropriate records help protect both the client and the psychologist if anything reaches a legal or ethical proceeding, and adequate records are generally a requirement for third-party reimbursement. And when official bodies audit mental-health documentation, they keep finding the same failures, in strikingly similar lists across countries. This guide covers the seven most consequential, with one difference from the usual tip lists: each mistake is defined by the exact rule it breaks. A documentation “mistake” is not a matter of style — it is falling below a floor someone can hold you to.

What turns a slip into a mistake

Two layers travel with you across borders. The APA Ethics Code makes records an ethical duty with defined purposes — the first being that you, or another professional, can continue the service later (Standard 6.01). And Standard 6.02 extends confidentiality across the record’s entire life: creating, storing, accessing, transferring, and disposing of it, in any medium. A note nobody could pick up, or a chart stored carelessly, breaches those duties no matter where you practice.

Then most jurisdictions add a statutory floor of their own. In Mexico, for example, the clinical-record norm (NOM-004-SSA3-2012) requires every note to carry date, time, the author’s full name and signature; a progress note every time outpatient care is provided; and a minimum five-year retention counted from the last act of care. In the United States, Medicare imposes its own documentation requirements on the psychotherapy it pays for. Whatever governs you, the floor is what defines the error — so the first fix is knowing yours. Verify the rules where you practice; the mistakes below are the ones that fall below almost any version of that floor.

What auditors actually find

The most detailed public evidence comes from the US. In 2023, the HHS Office of Inspector General published a nationwide audit of Medicare psychotherapy claims from the first year of the COVID-19 public health emergency: for 128 of 216 sampled enrollee days, providers did not meet Medicare requirements, and OIG estimated that of the 1 billion dollars Medicare paid for psychotherapy that year, 580 million were improper payments. The deficiency categories read like an outline of this article: session time not documented (60 of 216 days; for 54 of them the notes gave neither start and stop times nor total time); treatment plans incomplete, missing, or written six to eight years earlier with no update (43 days); services with no note at all (24 days — and for 7 of those, documentation was created only after OIG requested the records, more than eight months after the sessions); and, in OIG’s separate review of documentation guidance, missing provider signatures (31 dates).

A companion OIG audit of a single New York City provider shows how these accumulate: all 100 sampled beneficiary days failed Medicare requirements, with 375 deficiencies in total — including 96 days with no evidence the treatment plan had been signed — and an estimated 1.1 million dollars in overpayments. OIG attributed the failures to absent policies, procedures, and training, not to bad intentions.

Those are Medicare-specific requirements, but the categories are not exotic. Mexico’s national human-rights commission (CNDH), reviewing years of clinical-record cases, put first on its list of recurring omissions exactly the date-time-name-signature set its norm requires on every note. Different regulators, same failures.

The seven mistakes

1. Missing date, time, name, or signature

What it looks like: a clinically reasonable note that nobody can place in time or attribute to a professional. Which rule it breaks: in Mexico, NOM-004 requires all four elements on every single note, with the signature handwritten, electronic, or digital (numeral 5.10); in the OIG audits, missing signatures and undocumented session time were deficiency categories of their own. And under APA Standard 6.01, an unattributable note fails the record’s first purpose — nobody can rely on it later.

How to fix the habit: stop trusting discipline. On paper, sign and date the note as part of closing the session, not as homework for tonight. In software, use templates where those fields are not optional. If your payer or regulator expects session times, record start and stop times or total time explicitly, the way the auditors look for them.

2. The note written after the fact — or never

A session without a note is, as far as the record is concerned, a session you cannot prove. A note reconstructed days later is memory dressed up as documentation. The worst variant is backdating: giving a late note the session’s date turns an oversight into an integrity problem, because now the record lies about itself. Auditors are alert to precisely this — in the 2023 OIG audit, some providers produced documentation only after the records request, more than eight months post-session, and those days still counted among the undocumented services.

How to fix the habit: write the note the same day, ideally in the last minutes of the clinical hour rather than in a pile at week’s end. If one slips through, write it late but honest: dated the day you actually write it and identified as a late entry for an earlier session. A transparent late note is an oversight; a backdated one is a different animal.

3. Cloned notes

Copying the previous note and changing the date produces a record that documents nothing: if March and June read identically, neither supports that a process took place. Progress notes exist to record change — Mexico’s norm, for instance, asks the progress note for precisely the evolution and updating of the clinical picture — so a note that never changes documents, literally, that nothing evolved.

How to fix the habit: structure beats willpower. A format with defined sections — SOAP or DAP — forces you to answer what happened in this session: what the client reported, what you observed, what it means, what comes next.

4. Vague interventions and stale treatment plans

“Client cooperative. Worked on self-esteem. Continue treatment. Next session in one week.”

Fictional, but recognizable. There is no identifiable clinical problem, no technique, no client response, no verifiable indication. It fails the Standard 6.01 test: could another professional continue the service from this note? Its close cousin is the stale treatment plan. In the 2023 OIG audit, 43 of 216 sampled days involved plans missing required elements or no plan at all — and some plans on file had been written six to eight years before the session, with no update anywhere in the record.

Behind a run of vague notes there is almost always a missing map: without a treatment plan with verifiable goals, notes have nothing to report progress against.

How to fix the habit: every note names the problem addressed, the concrete intervention, the observed response, and a next step you could check at the next session. And give the treatment plan itself a review date, so it cannot quietly go stale.

Informed consent is a process, but the process has to leave a trace in the chart. The APA Ethics Code expects psychologists to inform clients early about the nature and course of therapy, fees, third-party involvement, and the limits of confidentiality (Standard 10.01) — and a consent conversation that appears nowhere in the record is very hard to evidence later. In many jurisdictions the duty is also statutory, and stricter than clinicians assume: in Mexico, what a therapist records about a client’s mental health is legally sensitive data, and the data-protection law in force requires express written consent — handwritten or electronic signature — before processing it, for every client. And a consent that exists but cannot be produced from the chart defends no one.

How to fix the habit: run informed consent as a documented process — discussed, signed, and archived inside each client’s chart, with new versions whenever the frame changes (fees, teletherapy, recording, new tools).

6. Keeping records for less time than required

Retention rules vary, so the mistake is generic: deleting or losing files before your jurisdiction’s clock runs out. As US guidance, the APA Record Keeping Guidelines suggest — explicitly “in the absence of a superseding requirement” — considering retention of full records until 7 years after the last date of service for adults, or until 3 years after a minor reaches the age of majority, whichever is later. Local law prevails where it exists: Mexico’s norm sets a minimum of five years counted from the last act of care, and adds that while the record belongs to the provider, the patient keeps rights over the information in it — destroying a file early also destroys their ability to exercise them. The typical failures are mundane: counting from intake instead of last contact, purging cabinets when moving offices, losing notes in a system migration.

How to fix the habit: record a last-contact date for every chart and compute retention from it, treating the legal period as a floor rather than a target. In any migration, verify everything arrived before deleting the source.

7. Storage, transfer, and disposal failures

Documentation does not end when the note is written. APA Standard 6.02 requires maintaining confidentiality in creating, storing, accessing, transferring, and disposing of records, whatever the medium — which makes the unlocked cabinet, the shared family laptop, and the case discussed over messaging with identifying details documentation failures, not just privacy lapses. Many jurisdictions attach real penalties: in Mexico, therapy notes are sensitive personal data under the data-protection law in force, the confidentiality duty survives the end of the professional relationship, and fines are set in ranges that can double when sensitive data are involved.

How to fix the habit: decide in writing where every note lives, who can access it, and how it is destroyed. Before trusting any digital tool with client data, ask it the security questions first — the criteria for evaluating AI tools apply to any software that touches your charts. And verify the data-protection rules where you practice.

Fix the habit, not today’s note

The seven mistakes share one root: documentation treated as an administrative leftover to be handled “when there is time.” The lasting fix is structural — a per-session note routine, formats that force specificity, and a chart that keeps everything in one place: history, treatment plan, notes, and consents. That is what gesell.ai is built for: it keeps a structured chart for every client and drafts the session note from your session record, in SOAP, DAP, BIRP, or GIRP format, for you to review and adjust. The clinical judgment and the final note remain yours; what stops depending on your memory on a Friday night is the structure the rules expect.