What HIPAA actually covers

HIPAA applies to covered entities — healthcare providers, health plans, and clearinghouses — and to the business associates who handle data on their behalf, including telehealth platform vendors. A licensed psychiatric practice is a covered entity. Its video platform is bound by a business associate agreement.

In practice that means your provider cannot disclose your information without your authorization, must use reasonable safeguards, has to tell you if there is a breach, and must give you access to your own records on request.

What it does not cover is broader than people assume. HIPAA does not apply to most consumer wellness apps, direct-to-consumer symptom checkers, online support forums, or anything you type into a general-purpose chatbot. Those are governed by their own terms of service, which are frequently permissive.

The exceptions to confidentiality

Confidentiality is strong but not absolute, and knowing the limits in advance is better than discovering them mid-conversation. A provider can or must disclose in a narrow set of circumstances:

• Imminent risk of serious harm to you or an identifiable other person.
• Suspected abuse or neglect of a child, an older adult, or a dependent adult — mandatory reporting, and the specifics vary by state.
• A court order. A subpoena from an attorney is not the same thing as a judge’s order, and providers routinely resist the former.
• Billing your insurance, which necessarily transmits a diagnosis code and dates of service.

Ordinary disclosures — that you feel awful, that you drink more than you should, that you have thoughts you are ashamed of — are not in that list. Passive suicidal thoughts without intent or plan do not automatically trigger anything beyond a safety conversation.

Who actually sees your record

Your insurer

If you bill insurance, the plan receives the diagnosis code, dates, service codes, and provider name. It does not receive what you said. That is the trade-off for coverage, and it is why some people choose to self-pay for psychiatric care specifically.

Your employer

Your employer does not receive your clinical records, even when it sponsors your health plan. What it may see is aggregate, de-identified utilisation data. An employer requesting individual mental health records from a provider would not get them without your written authorization.

Psychotherapy notes get extra protection

HIPAA treats a therapist’s private process notes as a separate category from the medical record, with a higher bar for disclosure — they generally require specific authorization and are not included in a routine records release. This is worth knowing if you are ever asked to sign a release: you can often authorize the medical record without authorizing psychotherapy notes.

Controlled substance prescriptions

If you are prescribed a controlled medication — a stimulant for ADHD, a benzodiazepine — that prescription is recorded in your state’s prescription drug monitoring program. Prescribers and pharmacists can query it. This applies identically to in-person care; it is not a telehealth issue, but people are often surprised by it.

Life and disability insurance

Applications commonly ask about mental health history and request authorization to obtain records. You can decline to sign, and the insurer can decline to underwrite. This is a genuine consideration for some people and worth thinking through before, not after.

The bigger risk is your phone, not your appointment

This is the part that deserves more attention than it gets.

Mental health apps have repeatedly been found sharing user data with advertisers and analytics companies — and the data in question is unusually sensitive. Not “visited a health website,” but self-reported mood, anxiety scores, sleep patterns, crisis-line usage, and what you searched for at 3am.

Because most of these apps are not HIPAA-covered entities, their obligations come from their own privacy policy, which they can revise. Some have been the subject of regulatory action over exactly this.

The practical implication is not “avoid all apps.” It is that a licensed psychiatric provider on a compliant platform is one of the more protected places to discuss your mental health, not one of the riskier ones. People frequently have this backwards — hesitating over a HIPAA-covered video appointment while a free mood tracker monetises the same information.

How to check a provider before booking

• Verify the licence. Every state board has a free public lookup. Confirm they are licensed in your state.
• Ask what platform they use and whether it is HIPAA-compliant with a business associate agreement in place. A consumer video app used for appointments is a warning sign.
• Read the Notice of Privacy Practices. Providers must supply one. It states what is collected and when it can be disclosed.
• Ask how records are stored and how long they are retained.
• Ask whether sessions are recorded. They generally should not be. If a service records for any reason, you should be told and asked to consent.

Protecting privacy on your side

The most common privacy failure is not technical. It is being overheard.

Use headphones — they solve half the problem instantly. Take the appointment behind a closed door, or in a parked car, which is a normal and widely used solution. Avoid public Wi-Fi where you can; cellular data is generally the better choice. Set your phone to do not disturb so a notification does not read out on screen share. And if you share a device, check who else can see the browser history and the patient portal login.

If someone in your household is a reason you cannot speak freely, say so at the start of the appointment. Providers work around this routinely, and it changes how they ask questions.

Is it clinically safe?

Privacy is one question; clinical safety is another. For the common outpatient conditions, remote psychiatric care produces outcomes comparable to in-person treatment, and the assessment methods — history-taking and mental status examination — transfer well to video.

Where it is genuinely not the right setting: acute crises, active psychosis or mania, supervised withdrawal, and anything needing a physical examination or an injection. A provider who recognises those limits and refers on is demonstrating good practice, not inadequacy. The full comparison is here.

Frequently asked questions

Can my employer find out I saw a psychiatrist?

Not from your provider, and not from your health plan in individually identifiable form. Records require your written authorization to release.

Will this show up on a background check?

Standard employment background checks do not include medical or psychiatric records.

Is a phone appointment as private as video?

Yes, from a confidentiality standpoint. Both are protected when conducted by a covered provider.

What if I do not want it billed to insurance?

Self-pay is always an option and keeps the encounter out of your claims history. Ask the practice for its self-pay rate — it is often lower than the amount billed to insurers.

Can I get a copy of my own records?

Yes. You have a right of access under HIPAA. Psychotherapy notes are the narrow exception a provider may withhold.

Are mental health apps covered by HIPAA?

Usually not. Unless the app is operating as a covered entity or its business associate, it is governed by its own privacy policy rather than by HIPAA.

Licensed provider, compliant platform

Samz Mental Health provides psychiatric care by video with a board-certified psychiatric nurse practitioner licensed in your state, on a HIPAA-compliant platform. Self-pay available if you prefer to keep it out of your claims history.

Book an Evaluation