Under federal law, the people who can access your mental health records are you, anyone you give written permission to, and a limited set of others named in the HIPAA Privacy Rule: your treating providers, your health insurer for payment purposes, courts acting through a valid order, and specific authorities in emergencies or abuse investigations. Everyone else needs your signed authorization. Some parts of your file, particularly a therapist’s private session notes, are locked down even tighter than the rest.
Your Own Access to Your Records
You have a legal right to inspect and get copies of your mental health records held in a provider’s designated record set. The provider must respond within 30 calendar days of your written request and may extend that once by another 30 days with written explanation.1HHS.gov. Individuals Right Under HIPAA to Access Their Health Information 45 CFR 164.524 Providers may charge a reasonable, cost-based fee for paper copies, and HIPAA limits fees for electronic copies you request.
The 21st Century Cures Act pushed this further by requiring providers to release finalized electronic health information, including clinical notes and test results, as soon as it’s ready. Providers who deliberately block electronic access face penalties of up to $1 million per violation.2OIG. Information Blocking
Two things you cannot demand access to: psychotherapy notes (explained below), and information compiled in anticipation of a legal proceeding.3eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
People You Authorize in Writing
The most common way someone else sees your mental health records is because you signed a HIPAA authorization. A valid authorization names the recipient, describes exactly what information can be shared, states the purpose, and includes an expiration date or event. You can revoke it any time in writing, though disclosures already made cannot be pulled back.
Typical reasons people authorize disclosure include coordinating care between a therapist and a primary care doctor, sharing information with a family member involved in treatment decisions, processing insurance claims, or documenting a legal matter. You control the scope. A release for a treatment summary is not a release for full session records, and you can limit it to one recipient or a defined window of time.
Access Without Your Permission
HIPAA carves out several situations where a covered entity can release mental health records without asking you first. Some are routine; others arise only in specific legal or emergency circumstances.
Your Treating Providers and Health Plan
Providers can share records with each other for treatment purposes without your authorization. A psychiatrist can send medication history to a primary care doctor, and a hospital can pull your mental health information during an emergency admission to avoid dangerous drug interactions. Your health insurer and its business associates can access what they need to process claims. Covered entities can also use records internally for quality improvement, audits, and staff training.4eCFR. 45 CFR 164.506 – Uses and Disclosures to Carry Out Treatment, Payment, or Health Care Operations
For non-treatment disclosures, HIPAA’s “minimum necessary” standard applies. The provider or insurer must limit what it shares to only the information reasonably needed for that specific purpose.5HHS.gov. Minimum Necessary Requirement
Courts and Subpoenas
A court order can compel a provider to release records, but only the specific information described in the order. A subpoena issued by an attorney or court clerk rather than a judge carries less authority. Before responding to a non-judicial subpoena, the provider should have evidence that you were notified and given a chance to object, or that a protective order was sought.6HHS.gov. Court Orders and Subpoenas
Serious and Imminent Safety Threats
When a provider genuinely believes you pose a serious, imminent threat to yourself or someone else, HIPAA permits disclosure of the information necessary to prevent harm. The provider can share with anyone in a position to help, including law enforcement, family, friends, or caregivers. This is the “duty to warn” concept many states have codified, though whether the duty is mandatory or simply permitted varies by state.7HHS.gov. What Constitutes a Serious and Imminent Threat
Law Enforcement
Police can obtain limited information to identify or locate a suspect, fugitive, or missing person. That means basic identifiers such as name, address, date of birth, and distinguishing characteristics. It does not mean law enforcement can browse your file. Broader access requires a court order or warrant.
Child Abuse and Neglect Reports
HIPAA permits providers to disclose information to public health authorities or agencies authorized by law to receive reports of child abuse or neglect.8eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required Every state also mandates reporting of suspected child abuse by healthcare professionals.
Workers’ Compensation and Social Security Disability
If you file a workers’ compensation claim involving a mental health condition, your provider may disclose records to the extent necessary to process it. State workers’ compensation laws control the scope.9HHS.gov. Disclosures for Workers Compensation Purposes
When you apply for Social Security disability benefits, the Disability Determination Services will request mental health records from every provider you identify, and may pursue records from other providers it discovers during the evaluation. SSA typically seeks records covering at least 12 months before the alleged onset date through the date of the request.10SSA. Requesting Evidence – General
Substance Use Disorder Records Have Extra Rules
Substance use disorder treatment records get an additional layer of federal protection under 42 CFR Part 2. Historically, that regulation has required patient consent for almost any disclosure, including to other treating providers.11eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records Some of the treatment-purpose exceptions above do not apply the same way to those records.
Psychotherapy Notes Are Locked Down Tighter
HIPAA singles out one category of mental health records for stronger protection: psychotherapy notes. These are a therapist’s personal notes analyzing the content of your sessions, kept separate from the rest of your chart.12HHS.gov. Does HIPAA Provide Extra Protections for Mental Health Information Compared with Other Health Information
With very few exceptions, a provider must get your specific written authorization before disclosing psychotherapy notes to anyone, including other providers involved in your care. That’s a stricter rule than the one that applies to your general chart, which providers can share with each other for treatment without asking. The narrow exceptions include mandatory abuse reporting and credible threats of serious, imminent harm.
Several things that feel like therapy content are not psychotherapy notes and live in your general medical record under the standard rules:
- Medication prescriptions and monitoring
- Session start and stop times, frequency, and type of treatment
- Diagnosis, treatment plans, symptoms, prognosis, and progress notes
- Results of clinical assessments or psychological tests
So your diagnosis, medications, and treatment plan can be shared more easily than what you actually talked about in session. You also have no HIPAA right to access your own psychotherapy notes; a provider may share them with you, but is not required to.13HHS.gov. HIPAA Privacy Rule and Sharing Information Related to Mental Health
Parents of Minor Children
Parents usually act as their child’s “personal representative” under HIPAA, which gives them the right to access and authorize disclosure of the child’s records. Mental health treatment is one of the main areas where that access narrows. HIPAA defers to state law, and many states let minors consent to mental health treatment without a parent’s involvement, at ages that range roughly from 12 to 16 depending on the state.
A parent is not the child’s personal representative for treatment records in three situations:14HHS.gov. The HIPAA Privacy Rule and Parental Access to Minor Childrens Medical Records
- The minor consented to the treatment on their own under state law.
- The child is receiving treatment at a court’s direction.
- The parent agreed that the child and provider would have a confidential relationship.
A provider may also deny a parent access if it reasonably believes the child has been or may be abused or neglected, or that giving access could endanger the child. Whether you can see your teenager’s therapy records depends heavily on where you live.
Employers and Schools
Your employer generally has no right to your mental health records. Under the Americans with Disabilities Act, employers can only make disability-related inquiries or require medical examinations when they are job-related and consistent with business necessity. An employer needs objective evidence that your ability to perform essential job functions is impaired, or that you pose a direct threat, before requiring any medical information, and even then cannot demand your complete records.15EEOC. Enforcement Guidance on Disability-Related Inquiries and Medical Examinations of Employees Under the ADA
If you request a reasonable accommodation and your condition is not obvious, your employer may ask for documentation sufficient to confirm a disability and the need for accommodation. It cannot go fishing through your therapy records. Any medical information the employer does obtain must be kept in a confidential file separate from your personnel records and shared only with a limited group, such as supervisors who need to know about work restrictions.
College and university health clinics operate under different rules. Student health records at these clinics are typically excluded from HIPAA and covered instead by the Family Educational Rights and Privacy Act.16HHS.gov. Does FERPA or HIPAA Apply to Records on Students at Health Clinics Run by Postsecondary Institutions FERPA has a special category called “treatment records” for notes made by campus therapists or psychologists that are used solely for providing treatment. Those are not available to anyone other than the treating professionals, unless the student chooses to have them reviewed by a physician or professional of their choice. If the school discloses treatment records for any purpose beyond treatment, they lose that protected status and become regular education records under FERPA.
Apps and Services That Aren’t Covered by HIPAA
HIPAA only applies to covered entities and their business associates. If you use a mental health app, mood tracker, meditation platform, or online therapy service that isn’t a HIPAA-covered provider, your data may not be protected by HIPAA at all. Once your health information sits in a non-covered app, even if it came from a covered provider at your request, HIPAA’s restrictions stop applying.17HHS.gov. The Access Right, Health Apps, and APIs
The FTC’s Health Breach Notification Rule provides a limited backstop by requiring vendors of personal health records to notify consumers if their unsecured health data is breached.18FTC. Health Breach Notification Rule Notification after a breach is not the same as restricting who can access your data in the first place. Before entering sensitive mental health information into any app, check whether the company is a HIPAA-covered entity or business associate. If not, your data’s privacy depends on that company’s terms of service.
State Law Can Be Stricter
HIPAA is a floor, not a ceiling. Many states impose stricter rules on mental health records specifically. Some require separate consent forms for mental health disclosures. Some limit release even in circumstances HIPAA would permit. When state law gives you stronger privacy protection than HIPAA, the stricter rule wins.
If You Think Someone Accessed Your Records Improperly
You can file a complaint with the U.S. Department of Health and Human Services’ Office for Civil Rights, which investigates HIPAA violations against providers, insurers, and business associates.19HHS.gov. Filing a Health Information Privacy Complaint State attorneys general also have independent authority under the HITECH Act to bring civil actions for HIPAA violations on behalf of state residents and can seek damages or court orders stopping the offending conduct.20HHS.gov. State Attorneys General