In regulated psilocybin services, you are usually asked to complete intake and consent forms, and some programs also require service providers to report aggregated or de-identified data to the state so the program can track access and safety trends.
Why programs collect session data
You will see data collection for two broad reasons. One is program oversight. A regulated system needs a way to confirm that required steps happened, records exist, products and doses are traceable, and adverse reactions are logged in a consistent way. In Oregon’s regulated services model, facilitators and service centers have defined recordkeeping duties tied to preparation, administration and integration, plus product identification and dose details, and adverse reaction records.
The second reason is evaluation at the program level. Some programs collect client demographic fields and high-level reasons for seeking services so they can track who is being served and where barriers show up. Oregon’s quarterly reporting rule lists demographic fields, reasons clients requested services, counts of sessions and denials, average psilocybin analyte dose per administration session, and aggregated counts of adverse reactions and post-session reactions.
You may also see statements that program-level data supports safety tracking and access evaluation. Oregon’s 303 Client Data Form describes the data as aggregated for statewide reporting and describes a goal of assessing safety and accessibility for different client populations, with an opt-out option for having responses included in the totals submitted.
Some states are building newer models that center de-identified outcome and public health tracking. Colorado’s 2025 implementation bill describes a state database focused on public health and program outcomes, with de-identified data and explicit limits on public release. It also describes new data reporting requirements for licensees beginning July 1, 2026.
What clients are commonly asked to provide
You can expect two different buckets of information. One bucket supports your session logistics and safety planning. The other bucket supports required reporting, where it exists.
For session logistics and safety planning, you will often be asked for basic identifying and contact information, an informed consent document, and details that help plan your arrival and departure. In Oregon, facilitators must create and share records with the service center that include an information form, an informed consent document, and a transportation plan. They also must record session dates and times and track product identification and how much product was consumed, plus any deviations from the transportation plan and any adverse behavioral or medical reactions.
Depending on the model, you may also see optional plans tied to extra support. Oregon’s recordkeeping rule lists support person plans and safety and support plans as records created when applicable.
For program reporting, you may be asked to complete a standardized client data form. In Oregon, the rule calls out aggregated client reporting fields like race, ethnicity, preferred spoken and written language, disability status, sexual orientation, gender identity, income, age, veteran status and county of residence where applicable, plus reasons clients requested services.
You should also expect basic session log information to exist on the provider side even when you are not asked to fill it out yourself. For example, Colorado’s regulations include requirements tied to reporting adverse health events within a set time window and maintaining administration session logs with fields like date, duration and number of participants.
Opt-out and consent steps
Opt-out and consent usually show up in three places. One is consent to participate in services at all. Another is consent to disclose identifiable information outside the required provider team. The third is opting out of certain types of reporting or disclosure in programs that allow it.
In Oregon’s model, you can opt out of having your 303 Client Data Form responses included in the aggregated totals submitted to the state program. The state page describing SB 303 data collection says clients have the option to check a box indicating they do not want their data submitted, and the 2026 form includes that opt-out language tied to the totals submitted.
That opt-out does not mean the form disappears. The program’s data privacy document states that service centers are required to store completed 303 Client Data Forms in each client file, and that the form is still stored even if you opted out of having your responses submitted in the compiled totals. It also states that no client records or copies may be stored at a location other than the service center where you participate or intend to participate in an administration session.
Separate from program reporting, you may see a consent requirement for disclosing identifiable client information. Oregon’s confidentiality rule describes limits on who can access client records and indicates a service center needs a completed client consent form to disclose identifiable client information, with required elements like what will be disclosed, who it goes to, the purpose, your signature and an expiration date.
You may also see disclosure and opt-out around de-identified data that a service center or facilitator could share with third parties for purposes like research or marketing. Oregon provides a required notice and an opt-out statement for disclosure of de-identified data by a service center or facilitator. The form defines de-identified data in practical terms and includes an optional opt-out statement for having your de-identified data disclosed to third parties by the named provider.
Other programs use a forms library approach for required disclosures. Colorado’s public forms page lists disclosure forms that include de-identified data and opt-out disclosures, plus privacy and confidentiality disclosures.
How data is stored and shared at a high level
You can think about storage and sharing in layers.
The first layer is your identifiable client record. In Oregon’s model, the rules and program guidance emphasize that records are stored at the service center and transferred there, with access limits for facilitators tied to clients they served. The informed consent rule reinforces that client records and copies must be stored at the service center where you participate or intend to participate.
The second layer is what the provider reports to the program. Oregon’s reporting rule requires service centers to aggregate and submit quarterly data, with a client opt-out for withholding client data from submission, and with rules stating that data may only be reported to the program and may not be shared except for representatives of the service center that collect and maintain the data.
The third layer is what becomes public. In Oregon’s description of SB 303 reporting and on the 303 form background text, the program describes compiling statewide data and de-identifying it before publishing to a data dashboard.
Confidentiality rules can sit above all layers. Oregon statute restricts disclosure of information that could identify a client or communications made during services, with exceptions that include client consent, certain safety-related disclosures and reporting required program data.
Some states are writing explicit limits into law for program databases. Colorado’s 2025 bill describes a de-identified database as confidential and not subject to open records, subpoena, discovery, or civil court use, with limited release for approved research, public health tracking and regulatory duties and with a requirement to release only the minimum necessary data without personal identifying information.
Privacy questions to ask before you participate
You can get clearer quickly if you ask direct questions that map to the layers above. You are trying to understand what is required for service delivery, what is required for program reporting and what is optional disclosure.
Here are questions that fit most regulated models.
- Ask where your identifiable records are stored and who can access them day to day. Oregon’s rules place storage at the service center and limit facilitator access to clients they served unless you give written consent.
- Ask which forms you must complete before services start. In Oregon, recordkeeping includes an information form, an informed consent document and a transportation plan, and providers must record product identification, dose details and adverse reactions.
- Ask what gets reported to the state program and in what form. Oregon requires aggregated quarterly reporting that includes demographic fields, reasons for requesting services, counts of sessions and denials, an average psilocybin analyte dose and aggregated adverse reaction counts.
- Ask if you can opt out of having your responses included in aggregated reporting totals. Oregon’s client data form includes an opt-out checkbox, and program guidance describes that option.
- Ask what happens to the form if you opt out. Oregon’s program privacy document says the completed form is still stored in your client file even when you opt out of having responses submitted in the compiled totals.
- Ask if the provider shares de-identified data with third parties for any purpose and what opt-out exists. Oregon provides a required notice and opt-out statement for disclosure of de-identified data by a service center or facilitator.
- Ask how long records are kept and how corrections work if you spot an error. You may see retention and correction practices described in program guidance or provider policy, and you can ask for the version you will sign.
- Ask how adverse reactions are documented and reported. Oregon requires recording adverse reactions at the provider record level and reporting aggregated counts quarterly, and Colorado’s rules include a short timeline for reporting adverse health events to the state division.
What good reporting can improve over time
When reporting is consistent and privacy controls are clear, programs can learn without putting client identities at risk. You usually see three areas of improvement.
One area is safety tracking that stays grounded in program operations. Oregon’s reporting rule calls for aggregated counts of adverse reactions and post-session reactions, and it also calls for reporting in a way that protects confidentiality and prevents unauthorized access.
Another area is access and equity monitoring. Oregon’s 303 client form background text frames demographic reporting as a way to describe who is receiving services and to support evaluation of accessibility for different client populations. That helps programs and the public see trends in who is served and who is not.
A third area is clearer baselines for what programs can responsibly publish. Oregon describes compiling statewide data and de-identifying it before publishing on a dashboard. That gives you a way to watch trends without tying data back to individual people.
You can also expect 2026 to bring more formal outcome tracking in some places. Colorado’s 2025 law describes a de-identified public health database and sets July 1, 2026 as the start date for de-identified data reporting requirements for licensees.
If you are comparing regulated service program reporting to research studies, keep in mind that program reporting is built for oversight and public health tracking. Clinical trials use separate protocols, data governance and consent language. If you want a quick reference point while you are already thinking about that difference, you can scan this internal page on clinical trial context. clinical trial context
We are Rose Hill Life Sciences, a psychedelic research organization specializing in the production and research of Psilocybe cubensis, operating at the intersection of science and therapeutic integration. We are based in Massachusetts.
