Yes, therapy sessions are confidential. What you tell a licensed therapist is protected by federal health privacy law (HIPAA), by state privacy statutes, and by a legal doctrine called the psychotherapist-patient privilege that keeps therapy communications out of court in most situations. That protection is strong, but it is not absolute. Your therapist can, and sometimes must, break confidentiality when someone’s safety is at stake, when abuse is suspected, when a court orders disclosure, and in a handful of routine administrative situations like insurance billing.
Understanding where the line sits matters more than knowing the general rule. Here is what actually stays private, what doesn’t, and why.
The General Rule: HIPAA Plus State Law
The Health Insurance Portability and Accountability Act sets a nationwide privacy floor for health information, and mental health records are covered. Under HIPAA’s Privacy Rule, your therapist cannot share your identity, what you discuss in sessions, your diagnosis, or your treatment details with anyone unless a specific legal exception applies or you give written authorization. The rule reaches records kept electronically, on paper, and information communicated verbally.1Centers for Disease Control and Prevention. FAQs About HIPAA Privacy Rule
State laws often go further. When state law is stricter than the federal rule, your therapist has to follow whichever standard gives you more privacy.1Centers for Disease Control and Prevention. FAQs About HIPAA Privacy Rule So your actual level of protection depends partly on where you live, though the federal baseline applies everywhere.
On top of that, the U.S. Supreme Court in Jaffee v. Redmond recognized a psychotherapist-patient privilege that protects confidential communications with a licensed psychotherapist, psychologist, or social worker from being compelled as evidence in federal court. The Court rejected a case-by-case balancing approach, so a judge cannot simply decide that the need for the testimony outweighs your privacy.2Justia Law. Jaffee v. Redmond, 518 U.S. 1 (1996) Most states recognize a similar privilege in their own courts. The privilege belongs to you, not to your therapist, which means you can waive it and it can be lost if you put your own mental health at issue in a lawsuit.
When a Therapist Can or Must Break Confidentiality
Ethical therapists explain these exceptions during your first session, often in a written informed consent document. The situations are narrower than people sometimes fear, but they are real.
Threats of Serious Harm to Yourself
If you describe a serious and imminent plan to harm yourself, your therapist can break confidentiality to protect your life. A vague mention of hopelessness is not the same as a detailed plan with a method and timeline. Therapists use clinical judgment to gauge how immediate and concrete the risk is before acting.
Threats of Serious Harm to Someone Else
When a client makes a credible threat of serious violence against an identifiable person, therapists in nearly every state have a legal obligation to act. Some states require warning the potential victim directly. Others require notifying law enforcement. Many require both. A few states make the duty permissive rather than mandatory.
The doctrine traces to the 1976 California Supreme Court decision Tarasoff v. Regents of the University of California, which held that a therapist who knows a patient poses a serious danger to another person has a duty to take reasonable steps to protect the foreseeable victim. That ruling prompted legislatures in almost every state to codify some version of the duty.
Suspected Abuse or Neglect
Therapists are mandated reporters in every state. If your therapist reasonably suspects that a child is being abused or neglected, they must report it to the appropriate authorities regardless of whether you consent. HIPAA explicitly permits disclosures to government authorities authorized to receive reports of child abuse or neglect, as well as reports involving adults who may be victims of abuse, neglect, or domestic violence.3eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required Most states extend mandatory reporting to elder abuse and abuse of dependent adults. Your therapist cannot legally stay silent even if you ask them to.
Court Orders and Subpoenas
A therapist can be compelled to disclose records if a court issues an order for them. A subpoena alone does not automatically require disclosure. HIPAA allows disclosure in judicial or administrative proceedings when the request comes through a court order, or through a subpoena accompanied by satisfactory assurances that you have been notified or that a protective order has been sought.3eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required The psychotherapist-patient privilege still applies where it applies, so a therapist facing a subpoena in litigation should not simply hand over records without notifying you.
Insurance Billing and Care Coordination
If you use insurance to pay for therapy, your therapist shares limited information with your insurer for billing. This typically means your diagnosis, dates of service, and the type of treatment provided. HIPAA lets covered providers use and disclose protected health information for treatment, payment, and health care operations without asking for your authorization each time.4eCFR. 45 CFR 164.506 – Uses and Disclosures to Carry Out Treatment, Payment, or Health Care Operations If keeping your diagnosis entirely off insurance records matters to you, paying out of pocket is the most reliable way to do it.
Psychotherapy Notes: The Most Protected Category
HIPAA draws a sharp line between your general therapy record and something called “psychotherapy notes.” Psychotherapy notes are a therapist’s private notes analyzing what you said during a session, kept separate from the rest of your chart. They do not include your diagnosis, treatment plan, medication information, session dates, or progress summaries. Those items live in your regular medical record.5U.S. Department of Health & Human Services. Does HIPAA Provide Extra Protections for Mental Health Information Compared With Other Health Information
The extra protection is this: a therapist must get your specific written authorization before disclosing psychotherapy notes for almost any reason, including sharing them with another health care provider for treatment or with your insurer for payment.6eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required The exceptions are narrow: the therapist who wrote the notes can use them for your treatment, a training program can use them for supervised education, the therapist can use them to defend against a lawsuit you bring, and disclosures otherwise required by law (like mandatory abuse reporting or duty-to-warn situations) still apply.5U.S. Department of Health & Human Services. Does HIPAA Provide Extra Protections for Mental Health Information Compared With Other Health Information
You have a right to access your general therapy records under HIPAA, but psychotherapy notes are explicitly excluded from that right of access.7eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information A therapist may share them with you voluntarily, but federal law does not force it.
Situations Where the Rules Shift
Group, Couples, and Family Therapy
Confidentiality works differently when other people are in the room. Your therapist is still bound by HIPAA and professional ethics. The other participants are not. Another group member who repeats what you said in session has not violated any health privacy law. Therapists typically ask participants to sign a confidentiality agreement, but enforcing that agreement against another patient is a contract matter, not a HIPAA case.
Many couples and family therapists use a “no secrets” policy. Under this approach, the therapist treats the couple or family as the patient. If you disclose something in an individual side session, the therapist reserves the right to share it with the full group if it is clinically relevant. If you need to talk through something you want kept from your partner, a separate individual therapist is the safer choice.
The legal privilege can also be weaker in group settings. Some courts have found that the presence of people who are not essential to treatment undermines the expectation of privacy that privilege requires. Outcomes depend on the facts and the state.
Minors and Parental Access
Parental access to a minor’s therapy records sits at the intersection of federal and state law. Under HIPAA, parents are generally considered the personal representative of their minor child and can access the child’s medical records, including diagnosis, symptoms, and treatment plans. Psychotherapy notes are excluded from this access right, just as they are for adults.8U.S. Department of Health & Human Services. Does a Parent Have a Right to Receive a Copy of Psychotherapy Notes About a Child’s Mental Health Treatment
State law controls many of the details. Some states allow minors above a certain age to consent to mental health treatment without parental knowledge, and when a minor lawfully consents to their own care, the parent may lose access to those records. HIPAA defers to state law on who counts as a personal representative and when a minor can act independently.8U.S. Department of Health & Human Services. Does a Parent Have a Right to Receive a Copy of Psychotherapy Notes About a Child’s Mental Health Treatment For substance use disorder treatment, federal rules say that when a state allows a minor to consent to treatment without parental involvement, only the minor can authorize disclosure, even to the parent.9eCFR. 42 CFR 2.14 – Minor Patients
Ask the therapist directly about the rules in your state before the first session. The answer depends on the child’s age, the type of treatment, and local law.
Telehealth Sessions
Virtual therapy carries the same confidentiality protections as an in-person appointment. HIPAA applies fully, and therapists providing telehealth are expected to use a HIPAA-compliant, encrypted platform from a vendor that has signed a business associate agreement.10U.S. Department of Health & Human Services. HIPAA Rules for Telehealth Technology The bigger practical risk with virtual sessions is on your end: someone overhearing at home, an unsecured Wi-Fi network, or a shared device. Headphones, a private room, and your own device help.
Employee Assistance Programs
Therapy accessed through an employer’s EAP is confidential. The EAP cannot confirm or deny your participation to your employer without your written consent. The most an employer can learn without your permission is that you attended an appointment, and only when you used work time to do so with a supervisor’s approval. What you discussed and any diagnosis stay private. If your employer mandated the referral after a workplace incident, the EAP may provide the employer a general compliance statement (“the employee completed the recommended sessions”) without disclosing clinical content.
Substance Use Disorder Treatment
If you are receiving treatment for a substance use disorder, a separate federal regulation known as 42 CFR Part 2 applies on top of HIPAA. These records historically could not be disclosed without specific written consent, and unlike regular medical records, they could not be used against you in criminal, civil, or administrative proceedings even with a subpoena.11eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
A final rule from HHS aligns Part 2 more closely with HIPAA, with a compliance deadline of February 16, 2026. A single patient consent can now cover all future uses and disclosures for treatment, payment, and health care operations. One important protection survives the alignment: substance use disorder records still cannot be used as evidence against you in legal proceedings without your consent or a court order. The updated rules also create a category of “SUD counseling notes” that work like psychotherapy notes and require specific written consent to disclose.12U.S. Department of Health & Human Services. Fact Sheet – 42 CFR Part 2 Final Rule
If You Think Your Confidentiality Was Breached
Start by raising the issue directly with your therapist or their practice. Unauthorized disclosures sometimes come from administrative errors rather than deliberate misconduct, and a direct conversation can clarify what happened.
If that does not resolve it, you have two formal routes. First, file a complaint with your therapist’s professional licensing board. Every state has boards overseeing psychologists, clinical social workers, and licensed counselors, and they can impose discipline ranging from a formal reprimand to license revocation.
Second, for HIPAA violations, file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. The OCR investigates alleged violations of the HIPAA Privacy, Security, and Breach Notification Rules.13U.S. Department of Health & Human Services. Complaint Portal You can submit online, by mail, or by calling 1-800-368-1019.14U.S. Department of Health & Human Services. Office for Civil Rights Complaints must generally be filed within 180 days of when you learned about the violation, though OCR can extend that period for good cause.15U.S. Department of Health & Human Services. How to File a Health Information Privacy or Security Complaint Civil penalties for providers who violate HIPAA are substantial, and the most serious intentional misuse of health information can carry criminal penalties including imprisonment.