Informed consent in psychotherapy: what it must include

Informed consent is not a signature at the first session: it is an ongoing process in which your client understands what therapy is, what to expect, and where confidentiality ends — and, with that information, decides to participate. The document matters, but it is the record of a conversation, not a substitute for one. Beyond being an ethical obligation, it is the foundation of the therapeutic alliance: a client who knows what they said yes to trusts more. This guide covers what the document should include, what the APA Ethics Code actually requires, and how to handle the situations that raise the most questions: minors, couples, teletherapy, and recordings.

What the ethics code actually asks for

The APA Ethics Code devotes two standards to the topic. Standard 3.10 requires obtaining informed consent when you provide services — in person or via electronic transmission — “using language that is reasonably understandable” to that person; and it allows consent to be written or oral, but requires you to document it either way (3.10d). Standard 10.01 spells out the content for therapy: inform clients “as early as is feasible” about the nature and anticipated course of therapy, fees, involvement of third parties, and the limits of confidentiality, with sufficient opportunity to ask questions and get answers. And if you are a trainee, 10.01c adds a requirement that is skipped remarkably often: the client must know you are being supervised and be given your supervisor’s name.

On top of the ethics sits a legal layer that varies by country. In Mexico, for example, two separate regimes apply: the clinical-record norm (NOM-004-SSA3-2012) defines consent forms and their minimum contents, but its list of events that mandate a signed form is hospital- and surgery-focused — the duty that actually reaches every therapy client comes from the data-protection law in force since 2025, which treats health information as sensitive data and requires express written consent, by handwritten or electronic signature, before processing it. In the United States, HIPAA adds its own layer (more on that below). Wherever you practice, verify the current local rules; what follows is the clinically portable core.

The essential elements

An informed consent document for psychotherapy should cover, at minimum:

1. Nature and scope of treatment

The approach you use, what the process involves, estimated session length and frequency, and an honest clarification: psychotherapy has expectable benefits but no guaranteed outcomes, and it sometimes involves temporary discomfort (discussing difficult topics, doing exposure exercises). This is exactly what Standard 10.01 calls the nature and anticipated course of therapy. If you work with a treatment plan with verifiable goals, this is the place to explain that one will exist and will be reviewed together with the client.

2. Confidentiality — and its limits

The most important part. Standard 4.02 asks you to discuss the limits of confidentiality at the outset of the relationship and again whenever new circumstances warrant it — not once. Explain that what is discussed in session is confidential, and list the exceptions before they ever occur:

Imminent risk to the client’s life or to third parties — handled under your own protocol and ethical framework.
Statutory reporting duties. Many jurisdictions oblige anyone — clinicians included — to report suspected abuse of minors or knowledge of certain crimes; in Mexico, for instance, the children’s-rights law (art. 12) and the national code of criminal procedure (art. 222) impose those duties on every person.
An order from a competent judicial authority.
Clinical supervision (using information that does not identify the client).

The exact list is jurisdiction-specific: verify the exceptions that apply where you practice, and write them in plain language, not legal jargon.

“What we discuss in session is confidential. The law requires me to break that confidentiality only in specific situations, and I want you to know them from day one: if there is a serious risk to your life or someone else’s, if I learn of abuse of a minor, or if a court formally requires it.”

3. Fees and the administrative frame

Fees, payment methods, cancellation policy (how much notice is required and what a missed session costs), and how lateness is handled. Standard 10.01 lists fees among the things to be disclosed as early as feasible, and experience confirms it: nothing erodes the therapeutic relationship faster than a money surprise.

4. Communication between sessions

Which channel clients can reach you on, during which hours, and what response times are reasonable. Be explicit about emergencies: messaging is not a crisis channel, and the document should name where to turn if there is one — the crisis lines and emergency services that operate where your client is located.

5. Teletherapy, if applicable

The APA telepsychology guidelines (revised in 2024; if your form still cites the 2013 version, it is due for an update) devote Guideline 2 to informed consent and recommend dual consent: one for the psychological services and one for the remote modality itself. Their sixteen consent domains work well as an audit of your form: what data is stored, how, and who can access it; the client’s physical location during the session, in case a support network has to be activated; emergency procedures; what happens if the connection fails; technical requirements; fees and cancellation policy; when consent gets renewed; and the psychologist’s license and jurisdiction. For minors, the same guideline asks for the minor’s informed assent in addition to parental consent.

6. Records and use of technology

How you store your notes, who has access, and how long records are kept. Retention rules vary: Mexico’s clinical-record norm sets a minimum of five years counted from the last act of care, while the APA’s Record Keeping Guidelines (US guidance) suggest considering seven years after the last service for adults, absent a superseding requirement. Check the rule where you practice and treat it as a floor. In some countries a separate privacy notice is also legally required alongside the consent form (in Mexico, the aviso de privacidad must identify which data you process, which of it is sensitive, and for what purposes). And if you use digital or AI-based tools to support your documentation, say so: which tool, what data it processes, and what safeguards it offers. Transparency here is not just ethics: it is what makes the client’s consent real.

7. The right to ask and to withdraw

The client can ask questions at any time, decline specific techniques, and end treatment whenever they decide. Data-protection laws in many places add a parallel right: consent to the processing of personal data can be revoked at any time (Mexico’s law states this expressly). Writing this down changes the tone of the whole document: from an imposed contract to an agreement between adults.

If you practice under HIPAA: ask the BAA question

For US readers, one piece of paperwork deserves its own paragraph. Under HIPAA, a business associate is a person or entity that performs functions involving protected health information on behalf of a covered entity — HHS’s own examples include cloud services that store health data and transcription vendors. The Privacy Rule requires “satisfactory assurances, in the form of a contract or other written arrangement” — the business associate agreement, or BAA — before disclosing protected health information to such a vendor. That turns vendor selection into a short list of questions to ask about any tool that touches session content, whether it is a notes platform, a video service, or a transcription or AI assistant: Will you sign a BAA with me? Does it cover recordings and transcripts, not just stored notes? What data is retained, where, and who can access it? A compliance badge on a website is not the same as a signed agreement. And if you practice outside the US, HIPAA most likely does not apply to you at all — verify the rules of your own jurisdiction instead.

Situations that need special attention

Minors

Legal consent comes from a parent or legal guardian — who qualifies is defined by local law; in Mexico, for example, those exercising parental authority (patria potestad) are the minor’s legal representatives under the federal civil code. But the adults’ signature is not enough: Standard 3.10b asks you, with anyone legally incapable of consenting, to provide an appropriate explanation, seek the person’s assent, consider their preferences and best interests, and obtain permission from the legally authorized person. Put in writing what will be shared with the adults and what will not. Two final cautions: the age at which an adolescent can consent on their own varies by jurisdiction — verify yours rather than assuming — and where parents are separated or in dispute, document who authorized the treatment and on what basis.

Couples and family therapy

Standard 10.02 requires it from the very start: clarify which individuals are the clients and what relationship the psychologist will have with each person. Define from the outset who “the client” is, how you handle secrets between members, and what happens to the record if the process splits into individual treatments.

Recordings, transcription, and AI tools

Several layers converge here. Ethics first: before recording a client’s voice or image you need their permission, or their legal representative’s — and it is a specific permission, not implied by the general consent to therapy (Standard 4.03). Data-protection law in many jurisdictions adds a second layer: a session recording is health information, and where the law classifies health data as sensitive — as Mexico’s does — processing it requires express written consent, revocable at any time. And if you are a HIPAA-covered provider, the BAA question above applies to any vendor handling the audio or transcript. The same logic covers AI tools that transcribe or process session content: express, documented, revocable consent — never a default setting.

“No session is recorded by default. If I ever propose recording audio or using a tool that transcribes the session, I will explain beforehand what is captured, where it is stored, and who can access it, and you will sign a specific authorization that you can revoke at any time without affecting your treatment.”

How to document it well

Provide it before the first session and spend minutes of that session discussing it; the document accompanies the conversation, it does not replace it. How it fits with everything else session one must cover is in the intake interview.
Record the process in your session note: that it was explained, what questions came up, and that the client agreed. Standard 3.10d accepts written or oral consent, but requires documenting it either way.
Update it when the frame changes: moving to teletherapy, changing fees, adopting a recording or AI tool. That is the logic of 4.02 — the confidentiality conversation repeats when circumstances change.
Make the form complete. Wherever you practice, a strong consent form states the place and date, what exactly is being authorized, the expectable risks and benefits, and the names and signatures of both the client (or representative) and the professional who informed them; some jurisdictions ask for more — Mexico’s clinical-record norm, for instance, also calls for two witnesses’ names and signatures in its consent-form model.
Keep the signed document in the chart, along with its versions: if the consent evolves, your file should reflect it for the full retention period.

A clear frame shows in the chart, too

Informed consent is the first piece of a well-kept clinical record — and keeping up the rest (notes, plans, follow-ups) is where most of the time goes. gesell.ai helps with both parts: informed consents can be signed digitally and archived in each client’s chart, and your session record becomes structured clinical notes that you review and approve, while you focus on the one thing no tool can do — the relationship with your client.