Under 45 CFR 164.502,
A covered entity or business associate may not use or disclose
protected health information, except as permitted or required by this
subpart or by subpart C of part 160 of this subchapter
PHI is defined in 45 CFR 160.103:
Protected health information means individually identifiable health
information: (1) Except as provided in paragraph (2) of this
definition, that is: (i) Transmitted by electronic media; (ii)
Maintained in electronic media; or (iii) Transmitted or maintained in
any other form or medium. (2) Protected health information excludes
individually identifiable health information: (i) In education records
covered by the Family Educational Rights and Privacy Act, as amended,
20 U.S.C. 1232g; (ii) In records described at 20 U.S.C.
1232g(a)(4)(B)(iv); (iii) In employment records held by a covered
entity in its role as employer; and (iv) Regarding a person who has
been deceased for more than 50 years.
A diary is not necessarily personally identifiable, but let us say the patient writes his name in the diary, so that it is. "Health information" is also defined:
Health information means any information, including genetic
information, whether oral or recorded in any form or medium, that: (1)
Is created or received by a health care provider, health plan, public
health authority, employer, life insurer, school or university, or
health care clearinghouse; and (2) Relates to the past, present, or
future physical or mental health or condition of an individual; the
provision of health care to an individual; or the past, present, or
future payment for the provision of health care to an individual.
A patient diary is not necessarily a professional diagnosis, but it does relate to mental health. Therefore, the diary is PHI, and is subject to the privacy rule. PHI isn't defined in terms of the reason for writing something down, or the time that it is written, or who wrote it: it is about having a relationship to a persons health.
The definition of psychotherapy notes is mostly tangential. Although a patient has a right to access his PHI per 45 CFR 164.524, there is an exception for psychotherapy notes, that a patient does not have a right to notes recorded by a mental health professional. Also note that
Psychotherapy notes excludes medication prescription and monitoring,
counseling session start and stop times, the modalities and
frequencies of treatment furnished, results of clinical tests, and any
summary of the following items: Diagnosis, functional status, the
treatment plan, symptoms, prognosis, and progress to date.
That is, the other stuff that the mental health professional record other than specifically their professional notes is excluded from the psychotherapy notes category, which was created to exclude patient access. But it is still PHI (there is no paragraph that excludes psychotherapy notes from the scope of PHI).