HIPAA and Telehealth: What You Should Know About Privacy in Online Mental Health Care

Questions about HIPAA and telehealth are understandable, especially when you are considering talking about personal experiences from home. This guide explains what privacy protections generally mean in online mental health care, what they do not promise, and questions you can ask before a visit. If you are comparing care options in California, see our guide to telehealth psychiatry appointments in California.

Book a free 15-minute discovery call

Is Telehealth Mental Health Care HIPAA Compliant?

HIPAA is a federal law that sets privacy and security requirements for many health care providers, health plans, and the organizations that handle protected health information for them. It applies to covered providers using telehealth, just as it applies to covered care delivered in person. The U.S. Department of Health and Human Services (HHS) explains that telehealth services provided by covered health care providers and health plans must comply with HIPAA Rules. You can read its guidance on HIPAA rules for telehealth technology.

That does not mean every video call or consumer app is automatically appropriate for a health care visit. Providers need to consider how a platform handles private information and how it is used in their practice. HHS guidance describes the importance of secure communications and data storage for telehealth. Its privacy laws and policy guidance is a useful starting point for understanding those responsibilities.

HIPAA compliance also does not mean that privacy risks disappear. Someone nearby may overhear your side of a conversation. A shared device, unlocked screen, weak account password, or notification preview may expose information. The provider and patient each have a role in making a remote visit as private as reasonably possible.

It also helps to distinguish the law from a specific technology. HIPAA is not a certification label that a patient can apply to any app after seeing a video connection work. Compliance involves the covered provider’s responsibilities, the vendors and services it uses, and its policies and practices. A patient cannot determine the full picture just by looking at a login screen. It is reasonable to ask how the practice conducts telehealth and where to find its privacy notice.

Motivational Mental Health & Wellness provides care through a HIPAA-compliant telehealth platform. The practice does not name its platform here or make claims about specific technical features. To learn about the practice and its clinician, visit the Laurel Kepner, PMHNP-BC profile.

What Information Is Shared During a Telehealth Psychiatric Session?

A telehealth visit may involve much of the same information as an in-person mental health appointment. That can include details you share about your concerns, symptoms, history, treatment goals, medications, and responses to care. Information connected to your identity and health may be protected health information when it is held or transmitted by a HIPAA-covered provider.

Your record may also include practical details needed to provide care, such as contact information, appointment dates, clinical notes, and billing or payment information. The exact information collected depends on the provider and the service. You can ask what information is recorded, how to request a copy of your record, and how to send a private message between visits.

Information typeExamplesPrivacy question to askIdentity and contact detailsName, phone number, email, and details used to coordinate careHow are appointment reminders sent, and can message previews be limited?Health informationConcerns discussed, relevant history, medications, and clinical notesWhat is included in my record, and how can I request access?Visit informationAppointment date and information needed to deliver telehealth careWhat should I do if I lose access to the device or account I use?Payment informationInformation needed to process a session paymentWhich payment details are collected, and who handles them?

The table is a set of examples, not a complete list or a promise that every provider collects each item. If you are unsure, ask the practice directly before sharing sensitive details. You can also review the practice’s contact page to find a way to raise questions before scheduling.

It may be useful to ask what happens at each stage of care rather than treating “the visit” as a single exchange. Information could be provided while arranging an appointment, entered on an intake form, discussed during the video session, or sent afterward through a communication channel. For each step, find out whether the information becomes part of the health record and which channel the practice wants you to use. If you are sending a sensitive question, do not assume that ordinary email or text is the right route; ask for the preferred method first.

Some mental health records may receive additional protections under applicable laws. For example, HIPAA gives specially defined “psychotherapy notes” different treatment from other records in certain circumstances. The term does not automatically mean every note made during therapy. If the distinction matters to you, ask the provider what types of notes are kept and how those records are handled.

Who Can Access Your Mental Health Records?

HIPAA is designed to protect health information and limit uses and disclosures, while allowing information to be used for care and certain related purposes. Depending on the circumstances, information may be shared with people involved in your care or with service providers working for a health care practice. Other disclosures may be allowed or required by law. The details depend on the situation, and this article is general education rather than legal advice.

In most cases, a family member, friend, employer, or other person does not get automatic access to your mental health record just because they know you or help you. A provider may discuss information with someone you identify as involved in your care in situations allowed by law, but you can ask how to set boundaries or limit what is discussed. If you want another person included in an appointment, discuss that with the clinician first.

You generally have rights under HIPAA to access and request copies of protected health information in a designated record set, subject to limited exceptions. You may also request corrections or ask how to submit a privacy concern. HHS provides information about HIPAA and telehealth, including patient privacy resources. For a specific request, contact your provider and ask about its process.

If you want to make an access request, keep it simple and specific. Identify the records you are asking for, state how you would like to receive them, and use the provider’s stated process. Ask whether there is a form, how identity will be verified, and what timeline applies. If you are seeking a correction, explain the specific information you believe is inaccurate and ask how the practice handles amendments. A request does not require you to explain why you want your own records, although the provider may need to confirm your identity and apply the rules that govern the request.

Privacy also includes the practical question of who can see your account or correspondence outside the clinical record. A family member who shares your phone, email, or device might see a notification even without having access to the record itself. If that is a concern, tell the practice which contact method is safest and check whether reminders can be sent in a less revealing way. Do not assume the practice knows that a device or inbox is shared.

Confidentiality is important, but it is not absolute. Legal requirements and safety situations can create exceptions. A provider should explain relevant privacy practices and answer questions about what happens if an exception may apply. If you want to read the practice’s current privacy terms, ask for its own Notice of Privacy Practices rather than relying on another organization’s policy.

When Can a Mental Health Provider Disclose Information?

Some disclosures may be permitted or required by law. The exact rules can depend on the type of information, the circumstances, and applicable federal and state requirements. It is better to ask the provider how a particular concern would be handled than to assume that every conversation is either fully confidential or routinely shared.

Examples of important limits can include suspected abuse, an imminent danger to yourself or someone else, and a valid court order. These are not a complete list, and the response depends on the facts and legal obligations. If you are concerned about what you might disclose, you can ask about confidentiality before you begin discussing the issue. The provider can explain the practice’s policies in plain language.

Asking about a limit does not mean you must disclose everything at once. You can begin with a broad question, such as, “Can you explain what could happen if you become concerned about immediate safety?” You can also ask who might be contacted, what information could be shared, and whether the provider would discuss the steps with you when possible. A clinician can clarify how the practice approaches these situations, while the answer to a particular case depends on its facts and applicable rules.

HHS provides resources on privacy and security for telehealth, including privacy tips for telehealth patients. These materials can help you think through practical privacy questions, but they do not replace a provider’s explanation of their own policies or legal advice about an individual situation.

How Can You Protect Your Privacy During an Online Mental Health Visit?

You do not need a perfect home setup to have a useful telehealth conversation. A few small choices can reduce the chance that someone overhears or sees private information. Choose what is realistic for your space, and tell your provider if privacy at home is difficult.

• Choose a private spot. If possible, close the door and let others know you need uninterrupted time. Headphones may help keep the other side of the conversation from being overheard.

• Check who can hear you. Consider nearby rooms, thin walls, roommates, family members, and shared spaces. If you cannot be fully alone, discuss a workable option with the provider.

• Use a device you can control. Avoid a public or shared computer when possible. Sign out after the visit, use a screen lock, and do not leave a record or message open where others can see it.

• Review notifications. Appointment reminders or messages can appear on a lock screen or shared email account. Ask how communications are sent and adjust device settings if needed.

• Use a private connection when available. A trusted home network is often preferable to an open public Wi-Fi network for a confidential appointment. Do not join from a place where other people can view your screen.

• Verify the appointment link. Use the instructions provided by your practice. If a link or message seems unexpected, contact the practice using a known channel before entering personal information.

• Ask about recording. Do not record a visit without first discussing it with the provider and following applicable requirements. Ask whether any recording is part of the service and how to raise concerns.

• Plan for interruptions. Keep a phone nearby if appropriate, and discuss what you and the provider should do if the video connection drops during an important conversation.

Try a quick privacy check before you connect. Look around the room for other people, windows, or reflective surfaces that could reveal your screen. Check whether your laptop or phone is signed in to a shared account, and close other tabs or apps that contain personal information. If you use headphones, test the microphone and sound before the appointment so you are not troubleshooting while discussing something sensitive.

Consider what you want to do if the room stops feeling private. You might pause the conversation, move to another room, switch to an agreed phone option, or reschedule. Ask the provider about a backup plan before the visit, especially if you expect interruptions or an unstable connection. If another person unexpectedly enters, you can tell the clinician that you need a moment rather than continuing before you feel comfortable.

These steps support privacy but cannot guarantee that information will never be exposed. HHS has additional telehealth privacy and security guidance for providers. If you want to understand how the practice approaches confidentiality, ask before booking or during your first conversation.

What Should You Ask Before a Telehealth Mental Health Appointment?

Privacy questions are a normal part of choosing care. You can raise them in a short introductory conversation without having to share your full history first. A free, no-obligation 15-minute discovery call is available through Motivational Mental Health & Wellness. It is an opportunity to ask whether the service seems like a fit and clarify practical questions.

To make that conversation useful, choose the questions that matter most to you instead of trying to cover every possible detail. For example, if other people use your phone, start with how scheduling messages appear. If you are unsure about disclosure limits, ask for a plain-language explanation of the practice’s confidentiality policy. You can write the questions down beforehand, then note any follow-up information you want to review after the call.

• What platform do you use for telehealth, and what should I do to join the appointment?

• What information do you collect before and during a visit?

• How are appointment reminders and messages delivered?

• How can I access my record or ask for a correction?

• What are the limits of confidentiality, including safety or legal exceptions?

• What should I do if I cannot find a private place for a video visit?

You may also ask what to expect if your appointment is interrupted or the connection fails, whether someone else may join the session, and how to tell the clinician that you need to pause. If you prefer not to discuss a sensitive topic until you understand a policy, say so. You can request clarification before deciding whether to proceed. Clear answers help you make a considered choice; they do not require you to share details before you are ready.

Motivational Mental Health & Wellness serves adults 18 and older who are California residents, with a particular focus on Fresno, Madera, and the Central Valley. Care is delivered by telehealth. To learn about the available California telehealth appointments, or to review the free mental health consultation, use the practice’s own information pages. You can also learn about medication management or psychotherapy if you are comparing types of support.

Book a free 15-minute discovery call

Frequently Asked Questions

Does HIPAA apply to online therapy?

HIPAA applies to covered health care providers and other covered entities, including in telehealth settings. A service’s use of video does not, by itself, tell you whether a particular provider or platform meets every applicable requirement. Ask the practice how it handles privacy and what platform it uses.

Can I have a telehealth appointment if someone else is home?

Often you can, but consider whether the person can hear or see the visit. Use a private room or headphones when possible, and tell the provider if you cannot speak freely. You can discuss options for your specific circumstances.

Can my family read my mental health record?

Family members do not generally receive automatic access merely because they are related to you. Access and permitted disclosures depend on the circumstances and applicable law. Ask your provider how to document your preferences and what exceptions may apply.

What if I am worried about privacy before I begin?

Ask the provider about confidentiality, records, communication methods, and legal or safety exceptions before sharing details. You can also ask whether the practice offers an introductory call to discuss fit and practical concerns.

What should I do in a mental health emergency?

This article is educational and is not a substitute for individualized medical advice, diagnosis, or emergency care. If you face immediate psychiatric or medical danger, call 911 or go to the nearest emergency room. For suicide or mental health crisis support in the United States, call or text 988.

Understanding the protections and limits of confidentiality can help you make a more informed choice about online mental health care and prepare questions that matter to you.