Delta
Professions

Mental health & psychology

Psychologists Neuropsychologists Psychiatrists Therapists

Rehab & allied health

Psychomotor therapists Physiotherapists Osteopaths Speech and language therapists Occupational therapists

Nutrition & dietetics

Dietitians
Resources
Blog Patient handouts Help centre Downloads
Security Pricing Contact us
Sign in Try for free
EN

Region and language
All articles

Can patients see their therapist's notes? Patient access to psychologist records in France

A patient asks for their file, or a dispute is looming. Here is what the law lets the patient obtain depending on your status, how to reply on time, and how to write notes you can show without worry.

Delta

Countries covered : Belgium, Switzerland, France

Which law applies to you? It depends on your status

The 8-day deadline that is often quoted does not apply to everyone. The rules change depending on whether you are a psychologist in private practice, a psychologist in a hospital or clinic, or a psychiatrist.

  • Psychologist, psychotherapist or neuropsychologist in private practice
    • Main texts. GDPR, Article 15 (right of access). The « Code de déontologie des psychologues » (French code of ethics for psychologists) for how to write and share notes.
    • Reply deadline. 1 month, which can be extended by 2 months if the request is complex
  • Psychologist employed by a healthcare facility (hospital, clinic)
    • Main texts. Article L1111-7 of the Public Health Code, applied to the facility's patient record. The GDPR as well.
    • Reply deadline. 8 days at the latest, after a 48-hour reflection period. 2 months if the information is more than 5 years old.
  • Psychiatrist, in private practice or in hospital
    • Main texts. Article L1111-7 and the code of medical ethics (Article R4127-45, amended in July 2026). The GDPR as well.
    • Reply deadline. Same deadlines as above

The psychologist in private practice

Article L1111-7 of the Public Health Code gives patients access to health information “held, in any capacity, by health professionals”, by healthcare facilities and by health centres. The title of psychologist, however, is regulated by Article 44 of the law of 25 July 1985 and its implementing decrees. It is not covered by the fourth part of the Public Health Code, which deals with the medical professions, pharmacy and « auxiliaires médicaux » (regulated allied health professions).

No clear text therefore says whether Article L1111-7 covers psychologists in private practice. In practice this changes little, because the GDPR applies anyway. Your notes concern the health of an identified person. They are health data (see our article on GDPR for practitioners in private practice). The GDPR also covers paper notes as soon as they are kept in a “filing system”, meaning a structured set that can be searched by specific criteria (Article 4 of the GDPR). A binder sorted by patient name is one.

The psychologist in a healthcare facility

In a hospital or clinic, what you write and add to the patient's record becomes part of that record. Article L1111-7 then applies in full. The « Commission d'accès aux documents administratifs » (CADA, the French commission on access to administrative documents) has stated several times that handwritten notes used for diagnosis or follow-up, and kept by the facility in the record, must be disclosed. The details are further down, in the section on personal notes.

The psychiatrist

A psychiatrist is a doctor. Article L1111-7 applies directly, in private practice as in hospital. Until July 2026, Article R4127-45 of the code of medical ethics stated that “the doctor's personal notes are neither transmissible nor accessible to the patient and to third parties”. Decree No. 2026-691 of 27 July 2026, in force since 30 July 2026, rewrote this article. It now refers to a “medical record for each patient in care”, and the idea of an observation sheet with confidential personal notes has disappeared from the text.

The GDPR right of access: what the patient can actually demand

Article 15 of the GDPR applies to all practitioners, whatever their status. The patient can obtain three things.

  • Confirmation that you hold data about them.
  • A copy of that data.
  • Information about how it is used, for example why you keep it, for how long, and who it has been shared with.

The Court of Justice of the European Union clarified this right for medical records in a judgment of 26 October 2023 (case C-307/22). Three points concern you directly.

  • The first copy is free. A national law cannot make the patient pay for it.
  • The reason for the request does not matter. A patient who wants your file in order to bring a claim against you has the same right as anyone else.
  • The copy must be “faithful and intelligible”. Where this is needed to understand the data, it can extend to a full copy of the documents in the record.

Recital 63 of the GDPR also lists, among accessible health data, diagnoses, examination results and “assessments by treating physicians”. Written clinical hypotheses come close to this.

The limits of this right

The right of access has limits. The text sets out three that may concern you.

  • The rights of other people (Article 15(4)). If a note mentions the patient's partner, parent or colleague, you can redact what concerns them. The GDPR states that this must not lead to refusing to provide any information at all.
  • Requests that are manifestly unfounded or excessive, for example repeated without reason (Article 12(5)). It is up to you to prove it.
  • Reasonable doubts about the identity of the person making the request (Article 12(6)). You can then ask for proof of identity, but not as a matter of routine.

If you refuse, even partly, you must tell the patient within one month, with your reasons and the option of complaining to the CNIL, the French data protection authority (Article 12(4)). In 2017 the CNIL fined a dental practice 10,000 euros for failing to respect a patient's right of access to their record.

“Personal notes”: what the texts really say

Many psychologists believe their session notes are personal and concern only them. This is partly the spirit of professional ethics. As things stand, it is not solid legal protection.

For doctors and healthcare facilities

The recommendations of the ANAES (now the HAS, the French National Authority for Health), approved by an order of 5 March 2004, describe personal notes as notes that are not meant to be kept, reused or shared, and that are not used for diagnosis, treatment or prevention. In an opinion of 15 April 2004, the CADA held that they could not be disclosed, either to the patient or to third parties.

But the CADA also set a clear limit. Once a note has contributed to diagnosis or follow-up and is kept in the record, it is no longer personal. Two opinions illustrate this.

  • Opinion No. 20130447 of 21 February 2013. A hospital refused to disclose notes from a family therapy, arguing that they were personal. The CADA gave a favourable opinion on disclosure, without redacting the passages about other family members, because each note was part of each participant's record.
  • Opinion No. 20150229 of 19 March 2015. Notes kept by the facility in the patient's record lose their personal character. In this case, which concerned a child, the CADA did accept that some passages could stay redacted to protect her safety.

For psychologists

The code of ethics for psychologists (2021 version) mentions personal notes in Article 23. The psychologist “collects, processes, files and archives their personal notes”. The code does not say these notes are exempt from the right of access. The « Commission nationale consultative de déontologie des psychologues » (CNCDP, the French national advisory committee on ethics for psychologists) considers, in its opinion No. 16-11 of 26 September 2016, that these notes are not in principle meant to be shared, “including with the person concerned”, because they can be misunderstood. This is an ethics opinion. It does not create an exception to the GDPR.

Our reading, which is not legal advice, is as follows. A note thrown away once your report is written looks like a draft. A note that is dated, filed under the patient's name and reread from one session to the next is part of the follow-up. It is health data, and the patient can ask for a copy. Start from this principle for everything you keep.

Reply deadlines at a glance

  • GDPR (all practitioners)
    • Minimum time. None
    • Maximum time. 1 month, plus 2 months if the request is complex, to be announced within the first month
    • Cost to the patient. First copy free
  • Article L1111-7 (health professionals and healthcare facilities)
    • Minimum time. 48-hour reflection period
    • Maximum time. 8 days, or 2 months if the information is more than 5 years old
    • Cost to the patient. Free consultation on site (L1111-7). The first copy is also free, under the GDPR (CJEU judgment of 2023)
  • Belgium, patients' rights law
    • Minimum time. None
    • Maximum time. 15 days
    • Cost to the patient. First copy free
  • Switzerland, Federal Act on Data Protection
    • Minimum time. None
    • Maximum time. 30 days as a general rule
    • Cost to the patient. Free in principle

For health data, the CNIL also refers to the 8-day deadline of the Public Health Code. In private practice, replying within 8 days is therefore the safest course.

Minors: what parents can obtain

Under the Public Health Code, a minor patient's right of access is exercised by the holder or holders of parental authority (Article L1111-7). The minor can ask for this access to go through a doctor. In certain cases set out in Article L1111-5, the minor can also ask to keep their state of health confidential from their parents.

In its 2015 opinion mentioned above, the CADA made two useful points.

  • What the child told you in session is not information “obtained from third parties” when the parents ask for the record. They can therefore, in principle, access it.
  • The child's interest comes first. A passage can be withheld if disclosing it threatens the child's health or safety, for example in a conflict between parents.

The code of ethics for psychologists (Article 11) asks you to seek the minor's consent and the authorisation of their legal representatives. In a conflictual separation, note in the file which parent asked for what and what you shared.

After the patient's death

The GDPR does not apply to the data of deceased persons (Recital 27). For health professionals and healthcare facilities, the Public Health Code takes over. The heirs, the unmarried partner and the PACS partner (French civil partnership) can access the record, but only for three reasons. To find out the causes of death, to defend the memory of the deceased or to assert their own rights. They must state their reason. The patient can, during their lifetime, object to this access. A refusal must be justified.

For a psychologist in private practice, no text clearly settles a request from a relative after a death. Professional confidentiality still applies. Before sharing anything, ask for the reason in writing and take advice from your professional liability insurer or a lawyer.

Responding to an access request, step by step

  1. Note the date you received it. This date starts the clock. A verbal request counts too. Suggest that the patient confirms it in writing, without making this a condition.
  2. Check who is asking. The patient, a parent for a minor, a guardian, an heir. Only ask for ID if you have a real doubt.
  3. Acknowledge receipt. A short message is enough. State the time within which you will reply.
  4. Gather everything you keep about this patient. Paper notes, notes in your software, reports, letters received and sent, test results, messages.
  5. Identify information about other people. Redact what concerns only a third party. Do not redact what concerns the patient.
  6. Do not change any note. If a phrase bothers you, leave it. You can add a dated entry that clarifies or corrects it, marked as added after the request.
  7. Offer time to talk. Reading their notes can be hard for a patient. Offer an appointment to discuss them, without imposing it. Outside psychiatric care without consent, the Public Health Code allows you to recommend that a third party be present, not to require it.
  8. Send it securely. Hand delivery, registered post, or protected electronic transfer. No unencrypted attachment on a consumer email service.
  9. Keep a trace. Date of the request, date of the reply, what was sent, what was redacted and why.

Writing notes that hold up if the patient reads them

A note that holds up is one you could show the patient, a colleague or a judge without embarrassment. Three rules are usually enough.

  • Separate what you observed from what you think about it. The code of ethics stresses the “relative nature” of assessments and interpretations (Article 22). A hypothesis written as a hypothesis can be defended. A hypothesis written as a fact can be challenged.
  • Write what is useful for the follow-up, and only that. An intimate detail with no clinical use does not belong in the file.
  • Date your notes, and never rewrite them. The code requires the psychologist's documents to be dated and to show their identity (Article 18). A note dated on the day of the session carries far more weight than one reconstructed weeks later.

Examples of wording

  • Avoid. Manipulative patient Prefer. Mrs B. asked three times for me to change the certificate. I kept the original text.
  • Avoid. He is clearly depressed Prefer. Reports sleep reduced to 4 hours a night for 3 weeks, loss of interest in sport. Hypothesis of a depressive episode, to be assessed.
  • Avoid. Toxic mother, responsible for the difficulties Prefer. Describes frequent conflict with her mother since adolescence. Mentions feeling “never good enough”.
  • Avoid. No suicide risk Prefer. Asked about thoughts of death. Says she has none at present. Names her children as her reason to keep going. To be revisited next session.
  • Avoid. Pointless session, patient in denial Prefer. The patient did not wish to discuss alcohol today. I told him we could come back to it.
  • Avoid. The husband is violent Prefer. Mrs D. reports that her husband pushed her against a wall on 12 March. She says she was afraid. Support contacts given.
  • Avoid. Cancelled yet again, not motivated Prefer. Session of 4 April cancelled by text the day before. Third cancellation since February.

Attribute every reported statement (“reports”, “describes”, “says”) and put the patient's exact words in quotation marks when they matter.

Notes about risk

When a session deals with risk (suicidal thoughts, violence suffered or committed, a child in danger), that note is the first one to be reread if something goes wrong. Write down what you asked, what the patient answered, what you decided and why, and what is planned next. Deciding to do nothing more is also a decision. Write it down with the reason.

A short outline for every session

  • Date, length, session number, who was present.
  • What the patient brings, in their own words when useful.
  • What you observe (behaviour, affect, facts).
  • Your hypotheses, presented as such.
  • What was worked on or suggested.
  • Any point to watch and the planned next step.

For a fuller outline, see our psychologist's session notes template and our comparison of SOAP, DAP and BIRP formats. To find out how long to keep these notes, read our article on patient record retention periods.

Belgium and Switzerland: what changes

How Delta works

Delta is an AI assistant for mental health professionals and allied health practitioners. During the session, Delta transcribes what is said, then prepares a session summary that you review and correct. You can also dictate your observations just after the session. The summary takes into account your specialty and your therapeutic approach, and is added to the patient's file. You find the whole follow-up and how it has developed in one place, dated session by session, which makes it easier to reply quickly on the day a patient asks for their file.

Data is hosted in France on infrastructure certified for health data (HDS, the French certification for health data hosting). AI processing takes place on servers located in France, after the patient's name and identifying information have been pseudonymised. No audio file is kept, data is never used to train models, and it is encrypted in transit and at rest. Delta also drafts your assessment reports, letters and certificates. On the question of informing the patient, see our article on consent to AI note-taking.

Frequently asked questions

Can a patient read their psychologist's notes?

Yes, in principle. The GDPR allows them to obtain a copy of the health data you keep about them, and no text gives psychologists' notes special protection. You can redact what concerns only other people. A note thrown away after your report is written, and not kept, is not part of the file.

Are a psychologist's personal notes protected?

Not by law. The code of ethics for psychologists mentions them and the CNCDP considers that they are not meant to be shared, but these are ethical positions. For doctors, the reference to personal notes disappeared from the code of medical ethics in July 2026. For healthcare facilities, the CADA considers that a note kept in the record is no longer personal.

How long do I have to reply to an access request?

One month at most under the GDPR, which can be extended by two months if the request is complex. If Article L1111-7 applies to you (healthcare facility, psychiatrist), it is 8 days at the latest, or 2 months for information more than 5 years old. In private practice, aiming for 8 days remains the safest position.

Can I charge for a copy of the file?

Not for the first one, even if the patient is preparing a claim against you (CJEU, 2023). Reasonable fees are only possible for additional copies or a manifestly excessive request.

Can the parents of a child I see read my notes?

As a general rule, the holders of parental authority exercise the right of access for their minor child. In some cases, however, the minor can ask to keep information confidential from them. And the CADA accepts that a passage can be withheld if disclosing it threatens the child's health or safety.

Can I correct a note before sending it to the patient?

No. Changing a note after an access request weakens the whole file and can be used against you in a dispute. If a phrase is inaccurate, add a dated entry that clarifies it, stating that it was added after the request.

What should I do if a relative asks for a deceased patient's file?

Ask them for their reason in writing. For health professionals and healthcare facilities, access is limited to the causes of death, defending the memory of the deceased and defending the relatives' rights, unless the patient objected during their lifetime. In private practice, take advice before sharing anything, because professional confidentiality still applies.

Sources

Cookie policy