The PCP's office has called twice. Your shared client started sertraline six weeks ago, the prescriber wants to know how the depression looks from your chair, and the coordination letter you keep meaning to write is now the oldest item on your task list. Care-coordination letters are among the most clinically valuable and least dangerous documents AI can draft, until they are the most dangerous: a release of information letter that exceeds its authorization scope, leaks psychotherapy-note material, or rebroadcasts 42 CFR Part 2 substance use records without the redisclosure notice is not a writing problem, it is a federal disclosure violation with your signature on it. By the end of this lesson you will be able to produce an ROI-compliant coordination letter from a therapist to a PCP about a shared client on an SSRI, scoped to HIPAA's minimum necessary standard, carrying the Part 2 redisclosure prohibition where it applies, and handling the duty-to-protect exception (in California, Civil Code §43.92, duty to protect, not duty to warn) without ever letting the model make a disclosure decision.

Three Legal Layers, One Letter

Every coordination letter sits inside three nested legal frames, and the drafting workflow has to respect all three before style matters at all. The outermost frame is HIPAA. Treatment-related disclosures between providers are generally permitted without a signed authorization under the treatment, payment, and operations provisions, but most behavioral health practices still obtain a signed release of information for therapy-content disclosures, both as ethical practice and because clients deserve to know who hears what. Whether you proceed on TPO or on a signed ROI, the minimum necessary principle governs what goes in the letter: the disclosure is limited to what the recipient needs for the purpose at hand. The PCP managing sertraline needs your observations of mood trajectory, sleep, side-effect-relevant symptoms, adherence signals, and risk status. The PCP does not need the content of the client's affair disclosure, the childhood material driving the schema work, or your countertransference notes.

The second frame is the psychotherapy notes carve-out. Under 45 CFR 164.501, psychotherapy notes are the clinician's separately maintained process notes analyzing the contents of conversation, and under 45 CFR 164.508(a)(2) they require their own specific authorization for nearly any disclosure; a general ROI does not reach them. Your coordination letter is built from the medical record (diagnoses, symptoms, treatment modality, progress, medications observed), never from the process notes. This is one of the strongest practical arguments for keeping the two record types truly separate: if your progress notes and process notes are interleaved in one document, every coordination letter becomes a manual redaction exercise, and an AI tool given the combined document will not reliably know which sentences are radioactive.

The third frame is 42 CFR Part 2, the federal confidentiality rule for substance use disorder records, updated by the 2024 final rule that aligned Part 2 more closely with HIPAA while preserving its core protections. If your practice holds itself out as providing SUD treatment and receives federal assistance (the threshold is broader than clinicians assume), records of that treatment are Part 2 records. Two consequences for the letter: the disclosure must be covered by a Part 2-compliant consent, and the letter itself must carry the redisclosure prohibition notice telling the recipient that the records cannot be further disclosed without consent except as permitted by the regulation. A coordination letter that mentions the client's alcohol use disorder treatment without that notice has converted a routine document into a regulatory violation, even when the underlying disclosure was authorized.

Minimum Necessary as a Drafting Discipline, Not a Vibe

Minimum necessary sounds like a mood ("keep it brief") but operates like an engineering constraint, and the way to honor it is to decide the scope before the model sees anything. The discipline is a three-column exercise that takes five minutes. Column one: the recipient and purpose ("PCP, medication management of sertraline 50mg initiated April 21"). Column two: what that purpose requires ("current diagnosis; symptom trajectory since medication start, ideally with scores; observed sleep, appetite, energy, agitation changes; adherence observations; current risk status with date; treatment modality and frequency; my contact information and an invitation to coordinate"). Column three: what is explicitly excluded ("session content and narrative detail; third-party information; trauma history; relationship specifics; psychotherapy-note material of any kind; any SUD treatment detail unless separately consented with the Part 2 notice").

Notice what the scope table does to the AI workflow: it converts "write a letter to the PCP about my client" (an invitation to overdisclose, because models pad with plausible clinical narrative) into "write a letter containing exactly these elements and nothing else." Overdisclosure is the signature AI failure in this document class. A model given a rich case summary writes a rich letter; richness is the problem. The model does not know that the affair, the sister's diagnosis, or the client's immigration status are outside the authorization's scope, because scope is a legal fact, not a textual one. You set the scope; the model fills the scaffold.

Here is the payer-and-legal rule of this chapter applied to coordination letters: the verifiable details only you can supply are the authorization's exact scope and expiration, the dated clinical observations (the PHQ-9 was 14 on May 5, down from 18 on March 24), the current risk status with its assessment date, and the Part 2 status of the records. Every one of those is checkable against the chart and the signed ROI, and every one is invisible to the model. A letter citing a PHQ-9 delta the chart does not contain, or sent three weeks after the ROI expired, is indefensible no matter how beautifully it reads.

The model decides how the letter sounds. You decide what the letter contains, who may receive it, and whether it may exist at all. Never let the second set of decisions drift toward the first decision-maker.

The Worked Example: The SSRI Coordination Letter

Maria's client, the same F33.1 client from the prior-auth lesson, started sertraline 50mg with her PCP on April 21. The PCP requested an update. The signed ROI authorizes disclosure to this named PCP of "diagnosis, treatment summary, medication-relevant observations, and risk status," expiring in twelve months. The chart shows PHQ-9 18 on March 24 and 14 on May 5, improved initial insomnia, no GI complaints reported, consistent session attendance, and SI denied at every session, most recently May 19. No Part 2 records are involved.

The letter, in scaffold form. Header block: client name, DOB, your license and contact, the date, and one line establishing authority: "This letter is provided pursuant to a release of information signed by the client on [date], authorizing disclosure of diagnosis, treatment summary, medication-relevant observations, and risk status to your office." That sentence is the legal spine; it tells the recipient (and any later auditor) exactly which authorization carries the disclosure. Clinical body, four short paragraphs. Diagnosis and treatment: "I have treated [client] in weekly individual cognitive behavioral therapy since November for major depressive disorder, recurrent, moderate (F33.1)." Medication-relevant trajectory: "Since the initiation of sertraline on April 21, measured symptoms have improved: PHQ-9 was 18 on March 24 and 14 on May 5. The client reports improved sleep onset, denies gastrointestinal side effects, and has attended all scheduled sessions." Risk: "Suicidal ideation has been denied at every session, most recently assessed May 19." Coordination close: "I will continue measurement-based monitoring and will contact your office if I observe symptom worsening, emergent side effects, or any change in risk status. Please feel free to contact me to coordinate care." Footer: signature, license number, and, if Part 2 records were involved, the redisclosure prohibition notice verbatim.

Read what is absent: no session narrative, no history of the marriage, no speculation about medication response mechanisms (you are not the prescriber; you report observations, not pharmacology opinions), no diagnosis of conditions you have not assessed. The letter is under 300 words, lands every element of the scope table, and could be read aloud to the client without a flinch, which is a serviceable ethical test for any disclosure document.

The Part 2 Block, and When It Attaches

If the client is in a Part 2 program, or your practice holds itself out as providing SUD treatment and the records are Part 2 records, the letter changes in three ways. First, the consent must be Part 2-compliant: the 2024 final rule allows a single consent for future uses and disclosures for treatment, payment, and operations, brought closer to HIPAA's model, but the consent's scope still controls and SUD counseling notes have their own heightened protection analogous to psychotherapy notes. Second, the letter carries the redisclosure notice, the block informing the recipient that the record is protected by federal law and may not be redisclosed without written consent except as permitted by 42 CFR Part 2. Keep the current regulatory text of that notice as a saved block in your template; do not let a model paraphrase it, because a paraphrased legal notice is a defective legal notice. Third, the scope discipline tightens: even with consent, ask whether the PCP's purpose requires the SUD detail at all. A PCP managing sertraline may need to know about alcohol use as a clinical interaction issue; that is a clinician judgment about clinical relevance, made by you, documented in your scope table, never delegated.

The AI rule for Part 2 content is categorical: the model never decides whether material is Part 2-protected, whether the consent covers it, or whether the notice is required. Those are legal determinations about record status. The model's legitimate roles are inserting your saved notice block verbatim, checking that the letter contains no SUD references when your scope table excludes them (a useful automated scan: "flag any sentence referencing substance use, treatment programs, or recovery"), and formatting. A practice that lets an AI assistant decide "this seems relevant, include it" has delegated a federal compliance determination to an autocomplete engine.

Duty to Protect: The Exception That Is Not a Letter Problem

Coordination letters live in the world of consented, scoped disclosure. The duty-to-protect exception lives somewhere else entirely, and the two must not blur. When state law mandates or permits breach of confidentiality because a client presents a serious danger of violence to an identifiable victim, the disclosure is not running on an ROI; it is running on the statute. In California, the operative frame is Civil Code §43.92 as revised in 2013: a duty to protect, discharged when the therapist makes reasonable efforts to communicate the threat to the victim or victims and to a law enforcement agency. California is unambiguously a duty-to-protect jurisdiction, not a duty-to-warn jurisdiction; protection often includes warning the identified victim, but the statutory duty is broader than warning and the post-2013 text matters. Other states differ in trigger, scope, and mandated versus permissive breach, which is why the statute, not a generalized "Tarasoff rule," governs your conduct, and why a multi-state teletherapy practice needs the analysis per state.

Where does AI sit in a duty-to-protect event? Behind the decision, never in front of it. The determination that a threat triggers the statute is the clinician's, made in real time, often with consultation; the AI never assesses the threat, never weighs whether the victim is identifiable, never decides whether to breach. After the clinician has made the determination and taken the statutory actions, AI may help structure the documentation: the timeline of the disclosure decision, who was contacted and when, the clinical basis, the consultation obtained. That documentation is the artifact that protects the clinician afterward, and it benefits from the same fact-sheet discipline as every payer document: you supply the times, names, and clinical observations; the model organizes them. Put the line in your practice policy exactly that bluntly: AI structures and formats after the clinician's risk determination; it never makes or shapes the determination.

The Drafting Workflow, End to End

Assemble the safe workflow. Step one, before any tool opens: pull the signed ROI and read it. Confirm the named recipient matches, the scope covers your intended content, and the expiration has not passed. An expired or mismatched ROI stops the workflow; no letter exists until the authorization does. Step two: build the scope table, three columns, five minutes, and determine Part 2 status. Step three: extract the dated facts from the chart into a mini fact sheet: diagnosis, scores with dates, observations relevant to the recipient's purpose, risk status with date. Step four: prompt with the scaffold: "Draft a care-coordination letter from a therapist to a PCP. Include ONLY the elements listed below, in this order: authorization sentence, diagnosis and treatment summary, medication-relevant observations with the exact scores and dates provided, risk status with date, coordination close. Use nothing not provided. Do not add history, session content, or clinical speculation. Keep it under 300 words." Step five: verify against the scope table line by line, confirming nothing excluded crept in and every included element survived. Step six: if Part 2 applies, append the saved notice block verbatim. Step seven: sign, send through the practice's secure channel (the most carefully scoped letter in the world is still a breach if it goes to the wrong fax number; confirm the destination), and file a copy with the ROI it rode on.

Two recurring AI failure modes deserve names. Scope creep: the model enriches the letter with plausible clinical context ("the client's recent occupational stressors"), importing material your scope table excluded; the line-by-line verification against the table is the catch. Authority drift: the model writes prescriber-flavored sentences ("the sertraline appears subtherapeutic; consider titration to 100mg"), exceeding your license and your lane; you report observations and invite coordination, you do not direct pharmacotherapy. Both failures are stylistically invisible, which is why the verification pass reads against the table, not against an impression of quality.

The Applied Problem: The Coordination Letter Kit

The artifact for this lesson is the Coordination Letter Kit: a scope-table template, the drafting prompt, and your saved Part 2 notice block, assembled and tested on one realistic case. Step one: create the scope-table template with the three columns (recipient and purpose; required elements; excluded elements) and pre-populate the exclusion column with the permanent residents: psychotherapy-note material, third-party information, session narrative, SUD content absent Part 2-compliant consent and notice. Step two: store the current 42 CFR Part 2 redisclosure prohibition notice as an uneditable text block in your template library, with a note of the regulatory source and the date you verified the text, so the model inserts rather than improvises it.

Step three: run the worked example or a case of your own through the full seven-step workflow: ROI check, scope table, fact sheet, scaffold prompt, table verification, Part 2 block if applicable, secure transmission check. Time it; the second run should come in under fifteen minutes. Step four: stress-test the verification. Deliberately add one out-of-scope sentence to the fact sheet ("client disclosed conflict with spouse") and confirm your prompt's "use nothing not provided / do not add history" instructions plus your table check catch it when the model carries it through, because it will: the model treats everything you provide as in-scope, which is precisely why the scope decision happens before the fact sheet is built.

Done looks like this: a letter under 300 words that opens with the authorization sentence, contains every required element with chart-exact scores and dates, contains nothing from the exclusion column, carries the verbatim Part 2 notice if and only if Part 2 records are involved, and goes out through a verified secure channel with a copy filed against the ROI. Keep the kit with your practice forms; the PCP letter, the psychiatrist letter, and the school-coordination letter are all the same kit with a different scope table.

Key Takeaways

• Every coordination letter sits inside three legal frames: HIPAA's minimum necessary standard, the psychotherapy notes carve-out (45 CFR 164.501 and 164.508(a)(2), requiring specific authorization a general ROI does not provide), and 42 CFR Part 2 for substance use disorder records under the 2024 final rule.
• Minimum necessary is an engineering constraint, not a vibe. Build a three-column scope table (recipient and purpose, required elements, excluded elements) before the model sees anything; scope is a legal fact the model cannot infer from text.
• The verifiable details only you can supply: the ROI's exact scope, recipient, and expiration; dated clinical observations like the PHQ-9 falling from 18 to 14 after sertraline initiation; risk status with its assessment date; and the Part 2 status of the records.
• Part 2 letters carry the redisclosure prohibition notice verbatim from a saved block; a model-paraphrased legal notice is a defective legal notice, and the model never decides whether material is Part 2-protected or whether the notice is required.
• Duty to protect is statutory disclosure, not ROI disclosure. In California, Civil Code §43.92 post-2013 establishes a duty to protect, discharged by reasonable efforts to communicate the threat to the victim and law enforcement; California is duty-to-protect, not duty-to-warn. AI structures documentation after the clinician's determination, never before or during it.
• The two named AI failure modes are scope creep (the model enriches with excluded context) and authority drift (the model writes prescriber-flavored recommendations beyond your license). Both are invisible to a quality read and caught only by verifying line by line against the scope table.
• The full workflow is seven steps: ROI check, scope table, fact sheet, scaffold prompt, table verification, Part 2 block if applicable, secure transmission with the copy filed against the ROI. An expired or mismatched ROI stops everything; no authorization, no letter.