Is Therapy Confidential? HIPAA, Notes and the Limits

Therapy is confidential in most circumstances, but not absolutely. What you say in a session is generally protected by state law and professional ethics, and often by HIPAA, the federal health privacy law. That protection has real limits: a therapist may have to disclose information when someone is in danger, when a court orders it, or when state law requires reporting child abuse. Insurance claims share some information, and apps that are not covered by HIPAA may share more. Knowing what is protected, what is not, and what to ask before the first session helps you decide what to share and when.

What HIPAA covers in a therapy session

HIPAA protects health information held by covered entities: health plans, health care clearinghouses and most health care providers. A therapist in private practice who bills insurance electronically is a covered entity, so the notes and records from your sessions fall under HIPAA. A therapist who takes only cash and does not bill electronically may not be a covered entity, but state licensing laws and professional ethics still require confidentiality.

HIPAA sets national rules for how your information can be used and shared. It also gives you rights: to see your records, to ask for corrections, to get a copy, and to receive a notice of privacy practices. Ask for that notice at the first session. It explains in plain language how the therapist may use and share your information, and how to complain if something goes wrong.

Psychotherapy notes and the regular record

Your therapy file usually has two parts, and they have different levels of protection.

Psychotherapy notes are a mental health professional’s notes on the content of a counseling session, kept separate from the rest of the medical record. They do not include medication records, session start and stop times, the type and frequency of treatment, test results, or summaries of diagnosis, symptoms, treatment plan and progress. Those items stay in the regular record.

Most uses and disclosures of psychotherapy notes need your specific authorization. The regular record is shared more easily for treatment, payment and health care operations, though HIPAA still limits who can see it and for what purpose.

Can you see your therapy records?

You have a right to see and get a copy of your records, but not of the therapist’s psychotherapy notes. A provider must act on a request for records within 30 days, with one possible extension of up to 30 days given in writing. A provider cannot refuse a copy because a bill is unpaid, and may charge only a reasonable cost-based fee.

If you want to see your file, ask the therapist how the practice handles records requests and which parts are kept as psychotherapy notes. Some people find it useful to read the regular record; others prefer not to. Either choice is reasonable.

When confidentiality has limits

Confidentiality is strong, but it is not absolute. The main limits are:

• Risk of harm. A therapist may disclose information without consent where the law requires it or permits it for a valid purpose, such as protecting you or others from harm. Social workers may disclose to prevent serious, foreseeable and imminent harm, and then only the minimum necessary.
• Mandated reporting. Mental health professionals are mandated reporters of child abuse and neglect in many states. Rules vary by state, so ask your therapist what their state requires.
• Court orders and legal proceedings. A judge can order records or testimony in some cases, and the rules differ by state. Ask the therapist how they would handle a court order or subpoena.
• Insurance and payment. If you use insurance, the plan may ask for information to approve sessions or review a claim. That is usually a treatment plan or a summary, not the full content of sessions.
• Supervision and consultation. A therapist in training or under supervision may discuss cases with a supervisor. Many therapists also consult with colleagues. Good practice is to share only what is needed and to keep identifying details to a minimum.

Ask about these limits at the first session. A therapist should explain them before you share sensitive information, not after.

What insurance claims share

When a therapist bills your health plan, the claim usually includes a diagnosis code, the type of service, the date and the provider’s information. The plan may also ask for a treatment plan or a summary of progress to approve ongoing care. The full content of your sessions is not usually sent.

If you pay out of pocket, no claim is filed, but the therapist may still keep a record. If you use out-of-network benefits, you may file a claim yourself using the provider’s itemized statement, often called a superbill. That statement usually includes a diagnosis code. Ask the therapist what appears on it before you decide.

Couples, family and group sessions

Confidentiality works differently when more than one person is in the room. In couples or family therapy, the therapist usually asks everyone to agree on what can be shared outside sessions. A common arrangement is that the therapist will not keep secrets between partners, or will say in advance if something needs to be shared. Group therapy usually has its own ground rules about what members may discuss outside the group.

Ask the therapist at the start how confidentiality works in this format, who is considered the client, and what will go in the record. If you are in couples therapy and also see an individual therapist, ask how the two providers will communicate, if at all.

Apps and online tools outside HIPAA

HIPAA protects health information held by covered entities. Once you send your information to an app that is neither a covered entity nor a business associate, HIPAA no longer protects it. The FTC’s Health Breach Notification Rule applies to many health apps not covered by HIPAA, and it was amended in July 2024, but that rule is not the same as HIPAA.

Before you use a mental health app, read its privacy policy. Look for whether it says it is HIPAA-covered, what it shares with third parties, and whether you can delete your data. A therapy app that connects you with a licensed therapist may be covered by HIPAA if the therapist is a covered entity, but the app’s other features may not be. Ask the therapist how messages and video sessions are stored.

Online therapy adds a few practical privacy questions. Where will the session take place, and who else might hear? Is the platform encrypted? Does the therapist confirm your location at the start of each session? For more on how online and in-person therapy compare, see online therapy versus in-person therapy.

Therapy across state lines and privacy rules

Whether a provider may treat you in another state depends on state law. A full license from a state board permits practice in that state; other routes are temporary practice laws, reciprocity, licensure compacts and telehealth registration where a state offers them. Providers should verify your location before an appointment.

In California, for example, a therapist must hold a current California license or registration to treat clients located in California, including by telehealth, and must get the client’s consent to telehealth and confirm the client’s location at the start of each session. Other states set their own rules. If you travel or move, ask the therapist whether they can continue seeing you and what they need to confirm.

What to ask before the first session

A first session is a good time to ask about privacy. The first therapy session usually includes a conversation about confidentiality, records and fees. Questions worth asking:

• What is kept in psychotherapy notes, and what goes in the regular record?
• Who else in the practice can see the file?
• What are the limits of confidentiality in this state, including mandated reporting?
• If insurance is used, what information is sent to the plan?
• How are messages, emails and video sessions stored?
• What happens if a court order or subpoena arrives?
• How can records be requested, and what is the process?

Psychologists must inform clients as early as feasible about the nature and expected course of therapy, fees, involvement of third parties and the limits of confidentiality, and discuss confidentiality at the outset. If a therapist is vague about these points, that is a reason to ask again or to consider whether the fit is right. Therapist red flags and when to switch therapists covers other warning signs.

What goes wrong

A common misconception is that therapy is completely confidential in every situation. It is not. Another is that psychotherapy notes are the whole file; in fact, the regular record holds the diagnosis, treatment plan and progress notes, and those are shared more easily. Some people assume that paying cash means no record exists, but the therapist still keeps one. Others assume that an app is private because it is about health, when it may fall outside HIPAA.

A second set of problems comes from not asking. A therapist may not explain the limits clearly, or may not mention that a supervisor or billing service will see part of the file. If you are in couples therapy, unclear ground rules about secrets can undermine the work. If you move states, a therapist may not be able to continue without a license in the new state.

If something about privacy feels wrong, say so. You can ask for an explanation, request a copy of the privacy notice, or talk with the therapist about what will be shared and with whom. If you believe your privacy rights have been violated, you can file a complaint with the therapist’s practice, with the state licensing board, or, where HIPAA applies, with the Office for Civil Rights at HHS.

If you are in crisis

In the US, anyone can call or text 988 (the 988 Suicide & Crisis Lifeline), or call 911 in an emergency. The 988 line is available 24/7, every day of the year, and conversations are free and confidential. It is for anyone who is struggling, not only for suicidal thoughts, and people can also call about someone they are worried about.

Confidentiality is one of the reasons therapy works: it gives you a place to speak freely. Knowing its limits helps you use that space with clearer expectations.