HIPAA, state privacy law, and psychedelic client records

Last reviewed: August 2026 · Psychedelic law changes quickly — verify current status before relying on this page.

For licensed healthcare professionals who want to understand how HIPAA, ORS 475A.450, and other state privacy obligations interact when they are involved with psychedelic services — as dual-licensed facilitators, referring clinicians, or integration providers.

The short answer

HIPAA and Oregon’s psilocybin confidentiality framework are separate legal regimes that apply to different activities. HIPAA applies to covered entities — healthcare providers who conduct certain electronic transactions, health plans, and clearinghouses — and governs records created in the course of providing healthcare. ORS 475A.450 governs records created during Oregon’s licensed psilocybin services. A licensed facilitator providing OPS facilitation is not providing healthcare under HIPAA, so the records from that facilitation are governed by ORS 475A.450, not HIPAA. The complication arises for dual-licensed clinicians who are covered entities under HIPAA and who provide psilocybin services under HB 2387 alongside their clinical work — those two record streams must be kept cleanly separate, because the rules that govern each are different.

HIPAA does not apply to OPS facilitation records

HIPAA’s Privacy Rule applies to covered entities and their business associates. A covered entity is a healthcare provider who transmits health information in electronic form in connection with certain covered transactions — billing Medicare or Medicaid, submitting claims to commercial insurers, and so forth. A service center providing psilocybin facilitation is not billing any health insurer for psilocybin services — those services are entirely out-of-pocket. OPS facilitation is not a covered transaction under HIPAA.

The OPS informed consent document that every client signs before an administration session states explicitly that psilocybin services are not a medical or clinical treatment. Services provided under ORS 475A are wellness services, not healthcare transactions as defined under HIPAA. This means:

Facilitators do not need to provide clients with a HIPAA Notice of Privacy Practices for their facilitation work. Client records created during OPS facilitation are not subject to HIPAA’s patient access and amendment rights. OPS facilitation records are not subject to HIPAA’s breach notification requirements. A service center is not a HIPAA-covered entity by virtue of operating a psilocybin program.

ORS 475A.450 governs facilitation records

The confidentiality of psilocybin client records is established by ORS 475A.450, which prohibits disclosure of any information that may identify a client or any communication made by a client during the course of psilocybin services. The protection is a default — it applies without the client needing to invoke it. Exceptions are narrow: compelled disclosure in legal proceedings, disclosure to prevent imminent harm, and disclosure otherwise required by law.

All client records — the informed consent document, client information form, safety and support plan, transportation plan, additional consent forms, and any session notes — must be stored at the licensed service center under OAR 333-333-4820. The facilitator is not the custodian; the service center is. A facilitator cannot retain independent copies of client records at their own location.

HB 2387 added a specific confidentiality layer over OPS complaint and investigation records. Information obtained by OHA in the course of an OPS investigation is confidential and not subject to public records disclosure, with limited exceptions for information sharing between OPS and the seven identified professional licensing boards when a dual-licensed facilitator is under investigation.

The dual-licensed clinician’s record problem

A clinician who holds both an OPS facilitator license and a professional license from one of HB 2387’s seven boards — and who provides services under both licenses to the same client — is operating under two separate record regimes simultaneously.

If the clinician is a covered entity under HIPAA — because they bill Medicare, Medicaid, or commercial insurance for their clinical work — then the clinical records they create in their professional capacity are governed by HIPAA. The psilocybin facilitation records they create in their OPS capacity are governed by ORS 475A.450. These are different legal frameworks with different rules about patient access, breach notification, record retention, and disclosure.

The practical requirement is clean separation of the two record streams. A dual-licensed clinician should not create a single integrated record that mixes clinical treatment notes with OPS facilitation notes. The clinical notes belong in the patient’s clinical chart — subject to HIPAA, the patient’s right of access, and insurance billing documentation requirements. The facilitation notes belong at the service center — subject to ORS 475A.450, stored there under OAR 333-333-4820, not retained independently by the clinician.

How the clinician handles informed consent must also reflect this separation. The client receiving both clinical services and psilocybin facilitation from the same provider should receive separate consent documentation — the OPS-mandated 33-item informed consent document for the facilitation, and whatever clinical informed consent the clinician uses for their professional services. A single document that conflates both is problematic from both a HIPAA compliance standpoint and an OPS compliance standpoint.

What HIPAA requires for clinical records that touch on psilocybin

A clinical record that contains information about a patient’s access to Oregon’s psilocybin program — for example, a therapy note documenting that the patient described their psilocybin experience during an integration session — is subject to HIPAA if it is created by a covered entity in the course of providing covered healthcare. The patient has HIPAA rights to access and amend that record. The clinician has HIPAA obligations regarding its storage, security, and disclosure.

A clinician whose clinical records document psilocybin-adjacent clinical work — medication review before a session, integration-focused therapy after a session — should be aware that those records may be subject to subpoena in civil litigation, requested by insurers during claims review, and accessed by the patient. This is not a reason to avoid documenting the clinical work — documentation protects the clinician — but it is a reason to document carefully, describing the clinical services provided rather than reproducing client communications about the psilocybin experience that belong to the ORS 475A.450 confidential record.

Responding to requests for records

A clinician who receives a request for records related to a patient’s psilocybin services must evaluate which regime governs each record. A valid HIPAA authorization from the patient for their clinical records does not constitute authorization to disclose OPS facilitation records — those records are held at the service center under a separate legal framework and would require a separate process to produce.

A subpoena for “all records related to [patient]‘s psychedelic treatment” will likely be contested. HIPAA-governed clinical records may be produced through the standard subpoena compliance process for protected health information. ORS 475A.450-governed facilitation records require their own analysis — the disclosure exceptions under ORS 475A.450 are narrower than HIPAA’s, and a clinician who is also a facilitator should not produce facilitation records in response to a subpoena without consulting an attorney first.

SB 303 data and HIPAA

Oregon’s SB 303 requires service centers to collect and report aggregate, de-identified demographic data to OPS quarterly. The de-identification process — removing individual identifiers before submission to OPS — is designed to place the data outside HIPAA’s individually identifiable health information definition. A service center that submits properly de-identified aggregate data to OPS under SB 303 is not making a HIPAA-regulated disclosure.

Colorado and other states

Colorado’s natural medicine program operates under DORA rules for facilitators and DOR rules for healing centers, with confidentiality obligations that parallel Oregon’s framework. Colorado facilitation records are not HIPAA-governed for the same reasons Oregon’s are not — psilocybin services are not covered healthcare transactions. A dual-licensed clinician in Colorado faces the same record separation challenge as in Oregon.

When public information may be enough

ORS 475A.450 is publicly available through the Oregon Legislative Assembly. HIPAA’s Privacy Rule (45 CFR Parts 160 and 164) is published by HHS at hhs.gov/hipaa. The HHS Office for Civil Rights publishes guidance on covered entity status and business associate relationships. OPS publishes the required facilitation forms and records storage rules at oregon.gov/psilocybin.

When you should speak with a lawyer

A dual-licensed clinician who is a HIPAA covered entity and wants to structure a practice that provides both clinical services and OPS facilitation to the same clients should consult an attorney familiar with both HIPAA and ORS 475A before establishing their record-keeping practices. A clinician who has received a subpoena or records request that implicates both clinical and facilitation records should retain counsel before producing anything. A clinician who has experienced a potential breach of either clinical or facilitation records — unauthorized disclosure, lost records, a ransomware incident — should consult a privacy attorney immediately.

You might also want to read

• What facilitators need to know about client confidentiality and data privacy
• Recordkeeping requirements for Oregon and Colorado facilitators
• Dual licensure: what HB 2387 changed for Oregon clinician-facilitators
• Malpractice exposure for clinicians involved in psychedelic services
• Prescribing, referring, and recommending: where the legal lines are for clinicians