When a client requests their therapy record: what to hand over, and when

A client writes: “I want a copy of my file.” Wherever you practise, three things hold. The request starts a clock. You must confirm who is asking before handing anything over. And your answer — including a refusal — has to be documented. What varies is the numbers, and that is where most online guidance is wrong. This article works the procedure through with Mexico as the example, because its two-statute structure exposes the machinery clearly, and contrasts it with the US rule. Verify the rules where you practise; this is documentation and practice management, not legal advice.

Two legal bases, and only one of them has a clock

Mexican clinicians face two regimes that answer different questions.

NOM-004-SSA3-2012, the clinical-record standard, answers who owns the file. Clause 5.4 says records are “propiedad de la institución o del prestador de servicios médicos que los genera” — the provider’s property — and then, “sin perjuicio de lo anterior”, that the patient “tiene derechos de titularidad sobre la información”. The document is yours; the information is theirs. Clause 5.6 adds that a “resumen clínico u otras constancias del expediente clínico” must be requested in writing. And there it stops: no deadline, no format, no cost rule, no grounds for refusal. The word plazo does not appear in the norm, so any table attributing “3 to 5 business days” to NOM-004 is invented. What the standard requires of a private practice is in the guide to Mexico’s clinical-record standard.

The clock lives in the federal data-protection statute. The right of access is article 22; the operational rules — what a request must contain, how fast you answer, in what format, what you may charge — sit in articles 28 and 31 to 34. The four ARCO rights as a set are in the Mexican privacy notice guide.

	Mexico (data-protection law)	United States (HIPAA)
Clock	20 business days to communicate your decision, then 15 business days to deliver (art. 31)	30 days to act on the request, 45 CFR 164.524(b)(2)(i)
Extension	Once, by an equal period (art. 31)	Once, “by no more than 30 days”
Clinician-notes carve-out	None	Psychotherapy notes, if kept separate

Two citations make the figures checkable: article 31 gives both numbers, and article 2, fraction VIII, defines “Días: Días hábiles” — every day in the statute is a business day, which roughly doubles the wall-clock time. That second citation is the one no competing page makes.

The sequence

Acknowledge in writing, with the date. The clock runs from when you received the request, not from when you acknowledge; the dated acknowledgement proves when it started. If the request arrived by message or in conversation, ask for it in writing and offer the channel yourself.
Check the request is complete. Mexico’s article 28 asks for a name, a channel for notifications, proof of identity or representation, and which right is being exercised. Note fraction III: a precise description of the data is not required for an access request. You cannot make the client tell you which notes they want.
Verify identity twice — on receipt and again at delivery, which article 31 conditions on “previa acreditación de la identidad del titular o representante legal”. Which documents suffice the statute does not say, so write down your own criterion.
Decide scope. The default is the whole record for that person; redact only on a ground the law gives you.
Deliver in a permitted format. Article 32 allows direct consultation, plain copies, electronic documents or any other medium your privacy notice sets out; article 34 makes it free, recovering only reproduction, copying and shipping costs.
File the request and your response in the chart. No provision in force requires it — good practice, not obligation — but it proves you answered on time, and NOM-004 clause 5.18 allows adding to the record whatever is needed “para complementar la información”.

Count business days conservatively: the statute does not define them itself, but its article 4 fills gaps from the federal administrative-procedure act, whose article 28 excludes weekends and a listed set of public holidays.

A summary is not a substitute

NOM-004 does not authorise swapping the record for a resumen clínico. It defines one in clause 4.10 and requires one in two hospital or transfer situations; in clause 5.6 it is something a patient may request, not a cap on what you may give. The norm grants no right to a copy and imposes no limit to a summary either. If your client accepts a summary, that is a negotiated agreement worth putting in writing — not compliance with a rule. If they asked for access and you send a summary, you have not complied.

The hard part: where do your working notes stand?

Here is where imported assumptions do real damage, in both directions.

Mexican law recognises no category of clinician notes excluded from the record or from the right of access — not in NOM-004, not in the data-protection statute. The standard runs the other way: clause 5.18 expands what may be filed, and clause 5.16 gives psychological records latitude of form (“se ajustarán a la naturaleza de los servicios prestados”), not an exclusion of content. Spain’s patient-autonomy law does reserve the clinician’s subjective annotations (Ley 41/2002, art. 18.3), and its copy right in 18.1 is expressly subject to that reserve — one reason Spanish-language results keep offering Mexican readers a right that does not exist there.

In the United States the carve-out is real but narrower than most clinicians remember. 45 CFR 164.501 defines psychotherapy notes as notes “documenting or analyzing the contents of conversation during a private counseling session… and that are separated from the rest of the individual’s medical record”, and excludes medication prescription and monitoring, session start and stop times, modalities and frequencies of treatment, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date. 164.524(a)(1) then removes those notes from the right of access. Two conditions do the work: they must be physically separate, and everything on that exclusion list stays in the accessible record whatever file it sits in. The APA Record Keeping Guidelines — adopted in 2007, expired by their own terms in 2017 and never replaced, so guidance rather than obligation — make the same point in a footnote. This is a US rule; it describes no other country’s law, and importing it is the commonest error in English-language guidance for clinicians abroad.

What remains is narrower and more honest: third-party protection. Article 33, fraction III, permits refusing access “cuando se lesionen derechos de un tercero”, and the same article allows the refusal to be partial — the statutory basis for redacting rather than rejecting outright. It covers what someone else contributed under their own expectation of confidentiality, not “I think reading this would upset them”: Mexican law has no therapeutic-privilege exception. In every case you state the reason, within the deadline, through the channel the request came in.

One question stays genuinely open. If your working notebook never entered the chart, does the access right reach it? Mexico’s definition of processing includes mere possession, which argues yes, and we found no Mexican decision resolving it either way; presenting it as settled would be inventing certainty. The operational consequence does not depend on the answer: write every note as though your client will read it, which is also the cleanest way to keep working notes and the formal note distinct. The habits that make a note survive that reading are in clinical documentation mistakes — and the worst move at this moment is to “fix” the note before releasing it.

Test data yes, test materials no

A client asks for “my PHQ-9 answers” and for the protocol booklet of a test you administered. Two different objects.

Responses and scores are part of the record: NOM-004 clause 6.1.3 puts test results into the clinical history, and APA Standard 9.04 defines test data to include the client’s own responses, provided to the client pursuant to a release. Hand them over with a clinical reading — a bare number reads as a diagnosis, and the PHQ-9 is a screening and monitoring tool, never a verdict.

Booklets, manuals and items are not that. APA Standard 9.11 defines test materials — manuals, instruments, protocols, questions and stimuli — as distinct from test data, and asks for reasonable efforts to maintain their integrity and security; Mexico’s Código Ético del Psicólogo (4th ed., 2007) draws the same line in article 27. An honest caveat: Mexico’s closed list of refusal grounds does not name test security, and we found no Mexican criterion resolving that tension. The defensible position is to release responses and scores, decline to reproduce the instrument, and explain the distinction in writing.

Requests that leave the script

Minors and adults under guardianship. Whoever holds legal representation may exercise the right: NOM-004 clause 5.6 names parental authority, guardianship and legal representation, and the statute recognises the legal representative (article 21). Verify the representation, not the family relationship, and record which document you saw. For a deceased client neither Mexican text answers the question.

Couples and family work. The record holds material about people who did not sign this request, and third-party protection is the tool for it: release what belongs to the requester, redact what would injure another’s rights. APA’s expired-but-unreplaced Guideline 11 says the same — release only the portions relevant to the party covered by the release. It resolves far better when your informed consent defined from the outset who the client is.

Unpaid fees. Not a ground. Mexico’s psychologists’ ethics code is blunt in article 64: you may not withhold records under your control that are requested and needed for a client’s treatment because payment is outstanding, unless the law provides otherwise. Debt is collected through its own channel; how to frame that from the start is in the guide to setting your fees.

A lawyer, or an authority. A lawyer without proven legal representation is a third party, and NOM-004 clause 5.5.1 allows release to third parties only on the written request of the patient, guardian, legal representative or a physician they authorised. With representation proven, they enter through the ordinary request door. A demand from a competent authority changes the frame entirely — it is no longer a client right. Ask for it in writing, verify who signed it, release what is required and nothing more, and document the release.

If the deadline passes

In Mexico the escalation is more gradual than the alarmist versions suggest. The client may go to the authority within 15 business days of your answer — or, if you never answered, at any time once your deadline has lapsed (article 40). Failing to comply “sin razón fundada” is the infraction in article 58, fraction I, and it draws a warning to comply (article 59, fraction I). The fine comes later: ignoring that warning is a separate infraction (article 58, fraction VII). A request answered late rarely reaches a fine; one ignored does. Since these requests cluster around contested endings, documenting a therapy termination properly is preparation for this.

A record you release, not one you excavate

The difference between a comfortable deadline and a frantic one is almost never legal — it is filing. With notes spread across notebooks, a folder and an app, assembling the record costs more than deciding what to release. In gesell.ai each client has a structured chart — intake, clinical history, treatment plan and session notes — and each note is drafted in SOAP, DAP, BIRP or GIRP format from your own session record for you to review and sign, so the final note is yours. When the request arrives, the work is reading and deciding, not searching.