Confidential Therapy for Physicians: Questions Before You Start
Privacy rules, records, payment choices and the forms that ask different questions.
Quick Answer
This guide is for physicians who want to understand what happens to their information before starting therapy. It explains which privacy rules can apply to a therapist, how records and payment choices work, how licensing, credentialing and employer questions differ, and what to ask a practice first. It isn’t legal advice and doesn’t promise any outcome.
The papers at breakfast
Ji is an illustrative composite, not a real client. She’s 41, and she’s an internist. It’s a weekday morning before work, and she’s at the breakfast table with a cup of coffee going lukewarm next to a small stack of printed pages. A therapy practice she found last week emailed them as part of its new-patient packet, and she printed them so she could read them with a pen.
There’s a privacy notice. There’s a page about fees and payment. She has a pen in her hand, and she’s underlining as she reads.
In the margin next to one paragraph she’s written who counts as us? Next to another, does this apply if I don’t use insurance? At the bottom of the payment page she’s written a question she hasn’t figured out how to ask anyone: what would I have to say on my renewal?
She hasn’t called the practice. The papers go back into a folder, and the folder goes into her bag.
If you’re a physician and some of Ji’s questions sound like yours, this guide is for you. It won’t tell you what your license, your hospital or your state requires. It can help you understand some of the vocabulary on papers like Ji’s, see where different rules come from, and put together questions you can ask a therapy practice, your hospital, or a qualified advisor before you start.
A quick note on where I’m coming from. I’m a licensed therapist, and I also work as an executive coach. This article is general education. It isn’t legal advice, and it isn’t a description of any particular practice’s policies, including mine. Ji and the other physician in this guide are illustrations, not people.
This article is educational and developmental in nature. It isn’t a substitute for individualized care from a licensed clinician, and reading it doesn’t establish a therapist-client relationship.
If you’re in the United States and you’re in immediate danger, or someone needs emergency medical help, call 911. If you’re having thoughts of suicide, or you’re in a mental health or substance use crisis, call or text 988 to reach the 988 Suicide and Crisis Lifeline. Outside the U.S., contact your local emergency number, or visit Find A Helpline to find a crisis line where you are. Please don’t wait on a form, a policy or a conversation with an attorney before getting help in a crisis.
Which privacy rules apply to a therapist
A lot of reassurance about therapy starts and ends with HIPAA, and it’s worth slowing down there. HIPAA’s Privacy Rule applies to what it calls covered entities, and whether a particular health care provider is one depends on how that provider handles certain transactions.
The HHS Office for Civil Rights summary of the HIPAA Privacy Rule explains that “Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity”. It lists transactions such as claims, benefit eligibility inquiries and referral authorization requests. It adds that using email alone doesn’t make a provider a covered entity. The transmission has to be connected to one of those standard transactions.
not every therapist is covered by HIPAA, and you can’t tell from a website that calls itself private. You can ask the practice directly whether it’s a covered entity under HIPAA.
HIPAA also isn’t the only set of rules a therapist works under. The same HHS summary explains that state laws giving greater privacy protection can apply alongside the federal rule. HHS also notes in its mental health guidance that a provider’s duty to warn generally comes from ethical standards, state laws and court decisions. So a therapist’s confidentiality duties come from more than one place, and they vary by state and by profession.
That’s why a general article can’t tell you exactly what a particular therapist will keep private. A practice can explain its own policies, how it handles records and what its processes are, through its privacy notice, its consent paperwork and a direct conversation. How the law applies to you, or to a particular legal request, is a question for a qualified advisor.
What gets written down, and where it can go
When people picture therapy records, they often picture one private notebook. For a covered provider, it’s usually more layered than that. There’s the clinical record, and there may also be a separate category HIPAA treats differently.
In an HHS answer on mental health information, psychotherapy notes are notes recorded by a mental health professional “documenting or analyzing the contents of a conversation during a private counseling session” that are kept separate from the rest of the medical record. HHS says they don’t include medication prescription and monitoring, session start and stop times, the modalities and frequency of treatment, test results, or summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress.
psychotherapy notes are a specific kind of separate note, not the whole therapy record. The special category doesn’t include things like a diagnosis, a treatment plan or progress summaries, so don’t assume every note about your care gets those special protections.
HHS explains that, with few exceptions, a covered entity needs your authorization before disclosing psychotherapy notes, including for treatment by another provider. The exceptions include disclosures required by other law, such as mandatory abuse reporting, and duty-to-warn situations involving serious and imminent threats. It’s reasonable to ask whether a practice keeps separate psychotherapy notes at all.
The regular record follows different rules. The HHS summary explains that a covered entity may use and disclose protected health information for its own treatment, payment and health care operations. It also describes other permitted disclosures without your authorization, including disclosures required by law and to health oversight agencies for legally authorized oversight activities.
If you’ve worried about court or legal requests, here’s what the summary says. A covered entity may disclose information in a judicial or administrative proceeding in response to an order from a court or administrative tribunal. It may also disclose in response to a subpoena or other lawful process if certain assurances about notice to you or a protective order are provided. That’s neither automatic, unrestricted access nor a guarantee that records can never be reached. It’s a set of conditions, and how they apply to a real situation is a question for an attorney.
Paying with insurance, paying yourself, or using an EAP
You may have heard that one way of paying for therapy is the safe one. I’d rather you understand what each option involves and choose what fits your care, your budget and your situation.
If you use insurance, payment is one of the purposes for which the HHS summary says a covered provider may use and disclose information. It’s fair to ask the practice what it sends to your health plan and to ask your plan what it keeps.
If you pay out of pocket in full, HHS’s model notice of privacy practices for health care providers describes a specific right. You can ask the provider not to share information about that fully paid service with your health insurer for payment or health care operations, and the model notice says the provider will say yes unless a law requires the sharing. HHS is describing a HIPAA right that applies under stated conditions:
- It applies to a covered provider.
- It covers a service or item you’ve paid for in full.
- You have to ask.
- It’s about sharing with your health insurer for payment or operations.
- It doesn’t apply when a law requires the information to be shared.
It doesn’t mean there’s no record, and it doesn’t change the other rules on this page. The model notice explains a HIPAA right. It isn’t the policy of any particular practice. Ask how a practice handles this kind of request, and keep in mind that its notice isn’t a guarantee that no other disclosures can happen.
If you’re considering an Employee Assistance Program, ask the EAP how its records are kept, who provides the counseling, and what, if anything, goes back to your employer. Ask the specific program rather than assuming it works like another one.
Whichever route you take, the useful questions are the same: who will have this information, for what purpose, and what can I ask them not to share?
Two forms, two different sets of questions
Lin is also an illustrative composite, not a real client. She’s 47, and she’s a radiologist. It’s midafternoon, and she’s at her desk between reading sessions with two documents open side by side. One is her state license renewal. The other is a notice from the hospital’s medical staff office about reappointment and credentialing, with its own forms attached.
She’s noticed that they don’t ask the same questions. The wording is different, the time frames are different, and one of them uses a phrase she keeps rereading. She’s copied both questions into a note on her phone, word for word, so she can compare them later.
Lin’s noticing something real. A state medical board’s licensing application, a hospital’s credentialing process and an employer’s own questions are separate things, written by different bodies for different purposes.
In April 2018, the Federation of State Medical Boards adopted a policy on physician wellness and burnout with recommendations for state medical boards. Among them, it recommended that where boards keep mental health questions on licensing applications, those questions focus on current impairment rather than on illness, diagnosis or previous treatment. It also recommended that hospitals revise their credentialing questions where necessary in line with those licensing recommendations, so the questions don’t discourage physicians from seeking treatment. Those are recommendations from 2018, not a description of what any particular board or hospital asks today. The form in front of you is the thing to read.
Employers are a third category. HHS’s page on employers and health information in the workplace explains that the Privacy Rule doesn’t protect employment records, even health-related ones. It also says that if your employer asks your health care provider directly about you, the provider can’t give the employer that information without your authorization unless other laws require it. HHS adds that the Privacy Rule generally applies to disclosures by your health care provider, not to the questions your employer may ask. If you work for a hospital that’s also a covered provider, HHS notes that your records as a patient are protected, while your employment records aren’t covered by the rule.
This article can’t tell you how to answer a question on any of those forms. If you’re unsure what a question means for you, a healthcare attorney or another qualified advisor who knows the rules where you practice is the right person to ask.
Physician health programs: what to ask first
Physician health programs, often called PHPs, are easy to misunderstand in both directions.
The Federation of State Physician Health Programs describes a PHP as a confidential resource for physicians and other licensed health professionals with potentially impairing conditions. It says PHPs coordinate evaluation, treatment and continuing care monitoring, and can provide documentation verifying a participant’s compliance. It also says relationships between PHPs and state licensing boards differ. Some PHPs are independent nonprofits, some are affiliated with state medical associations, some are operated by the licensing board, and many have written agreements with the board.
How someone comes to a PHP matters too. The FSPHP describes board-compelled participation and employer-mandated referrals, and notes that obligations depend on state rules. Contacting a program on your own is a different situation from being referred by a board or an employer, and it’s worth asking how that difference affects what’s documented and shared.
The FSMB’s 2018 policy also recommended that state boards consider offering what it called safe haven non-reporting for license applicants who are receiving appropriate treatment and are in good standing with a PHP. That was a recommendation for boards to consider, with conditions. This recommendation doesn’t tell you whether an option exists or applies in your state.
So if you’re thinking about a PHP, the most useful thing you can do is ask the specific program in your state how it works: who runs it, what its relationship with the board is, and what it would share, with whom, in your situation.
Both/And: questions deserve answers, not guarantees
Both of these things are true at once. Your worry about therapy and your license is reasonable, and it deserves a real answer. Wanting clarity about your records and your professional forms before you share anything is understandable.
And the answers you get won’t be guarantees. A general article can’t give you your individual legal answer. It doesn’t know your state, your board, your hospital, your contract, or what’s in your history. The honest thing I can offer is vocabulary, sources you can open yourself, and questions to take to the people who can answer them for your situation.
Ji and Lin are both holding real questions. Neither of them has an answer that fits her situation yet, and neither of them needs to pretend she does.
The Systemic Lens: when care and oversight share a hallway
If you’re considering therapy while also completing renewal or credentialing papers, you may be facing separate questions at once. There’s the relationship with a clinician who’s there to help, and there are the bodies whose job is professional oversight: the licensing board, the hospital’s credentialing process, and sometimes an employer. Each has its own forms, deadlines and vocabulary.
Care and oversight aren’t the same thing, and they’re not supposed to be. But when they show up in the same season, with a renewal due and a reappointment packet open, it’s easy for do I need help? to get folded into what will I have to report? That’s a real administrative burden, and it lands on top of the work itself.
The FSMB’s 2018 recommendations point at the same tension. They ask boards and hospitals to consider whether their questions discourage physicians from seeking treatment. You don’t have to resolve the tension on your own before you’re allowed to look after yourself. You can separate the two tracks on purpose: one set of questions for the people who might care for you, and another for the people who oversee your practice.
Questions to ask before your first session
You’re allowed to ask a practice about all of this before you book anything. These are ordinary questions. Here are some to start with.
- Are you a covered entity under HIPAA? Can I see your notice of privacy practices before my first appointment?
- What goes into my record, and do you keep separate psychotherapy notes?
- Under what circumstances would you share information without my permission?
- If I use insurance, what do you send to my health plan? If I pay in full myself, how do I ask you not to share that service with my insurer?
- If a court, a board or another organization asks for my records, what’s your process?
- Do you have any connection to my hospital, my employer or my EAP?
For questions about your own forms, your board or your hospital, take them to a healthcare attorney or another qualified advisor who knows the rules where you practice.
Where the two illustrations end
Back at the breakfast table, Ji takes the folder back out of her bag. On the privacy notice, she circles the word we. On the payment page, she writes who receives billing information? She hasn’t made the call yet.
In her separate illustration, Lin has closed both forms and left the note on her phone where it is. She knows the questions are different now. She doesn’t know yet what she’ll do about either one.
Neither of them is finished, and neither of them has been reassured by anyone. That’s a real place to be. You can gather your questions first, ask them plainly, and decide what to do with the answers once you have them.
Warmly,
Annie.
Next steps in your recovery
The Master Course
Fixing the Foundations™
The core self-paced course for the whole architecture of relational trauma recovery. Seven phases, 48 lessons, and a 200-page workbook on family-of-origin patterns, nervous-system repair, and rebuilding the proverbial House of Life™ from the foundation up.
Focused Mini-Course
Enough Without the Effort
A self-paced mini-course for driven women whose worth got tangled up with their productivity, who never feel like enough, and who can’t remember the last time they rested without earning it.
Employers and Health Information in the Workplace
HHS explains how the HIPAA Privacy Rule applies when an employer asks about your health information, and what it doesn’t cover.
Your Rights Under HIPAA
HHS’s overview of the rights the HIPAA Privacy Rule gives you over your health information.
Frequently asked questions.
Does HIPAA apply to every therapist?
No. HHS explains that a health care provider is a covered entity when it electronically transmits health information in connection with certain standard transactions, such as claims. Using email alone doesn’t make a provider covered. Therapists also have confidentiality duties under state law and professional ethics, which vary. You can ask a practice directly whether it’s a covered entity.
What are psychotherapy notes?
They’re a specific kind of note a mental health professional may keep about the contents of a counseling session, separate from the rest of the record. HHS says the category doesn’t include things like diagnosis, treatment plan, symptoms or progress summaries, so don’t assume every note about your care gets those special protections. With few exceptions, HIPAA requires your authorization before a covered entity discloses them.
If I pay for therapy myself, does that keep it private?
Paying in full gives you a specific right with a covered provider: you can ask that information about that service not be shared with your health insurer for payment or health care operations, and HHS’s model notice says the provider will say yes unless a law requires sharing. It doesn’t mean there’s no record, and it doesn’t change the other rules that apply. Ask the practice how it handles that request.
Can my employer find out I’m in therapy?
HHS says that if your employer asks your health care provider directly, the provider can’t share the information without your authorization unless other laws require it. HHS also says the Privacy Rule governs what providers disclose, not the questions employers ask, and it doesn’t cover employment records. If you’re using an EAP, ask how it handles records and what your employer receives.
Will I have to disclose therapy on my license renewal or credentialing forms?
I can’t answer that for you, and I’d be wary of anyone who promises an answer in general terms. Boards, hospitals and employers each write their own questions. In 2018, the FSMB recommended that licensing questions focus on current impairment rather than diagnosis or previous treatment, but that’s a recommendation, not a description of your form. Read the current wording, and take specific questions to a healthcare attorney or another qualified advisor.
Is a physician health program confidential?
The Federation of State Physician Health Programs describes PHPs as confidential resources, and it also says their relationships with state licensing boards differ and that rules vary from state to state. The FSPHP describes board-compelled participation and employer-mandated referrals, and notes that obligations depend on state rules. Ask the specific program in your state how it works before you share details.
Who do I contact if I’m in crisis right now?
In the U.S., call 911 if you’re in immediate danger or need emergency medical help. Call or text 988 if you’re having thoughts of suicide or you’re in a mental health or substance use crisis. Outside the U.S., contact your local emergency number or visit findahelpline.com. Please don’t wait on a form or an attorney before getting help in a crisis.
Written by Annie Wright, LMFT (legal name Elizabeth Anne Wright; CA LMFT95719). She is licensed in 15 U.S. jurisdictions, including Colorado for telehealth only, and registered to provide telehealth in Florida under Fla. Stat. 456.47. With more than 15,000 clinical hours. She is an EMDRIA Certified Therapist and an EMDRIA Approved Consultant-in-Training. She is accountable to all content published under her name; content reflects her clinical training and current practice.
First published . Last substantive update . See the editorial process and update policy for how this article is maintained.
Her writing is grounded in current professional literature and in her own clinical training and experience. The examples in this article are illustrative composites, not real clients.
Written and Edited by Annie Wright, LMFT. Annie is responsible for the content of this article. See our Editorial Policy for details.
This article is educational and not a substitute for therapy, diagnosis, or a clinical relationship with a licensed mental health provider. If you’re in crisis or having thoughts of suicide, in the United States call or text 988 for the Suicide and Crisis Lifeline. Outside the US, visit findahelpline.com for local crisis resources.
We publish substantive updates to our clinical articles on a rolling basis. If you spot an error, please email support@anniewright.com. See the site-wide update log for all revisions.
WAYS TO WORK WITH ANNIE
Individual Therapy
Trauma-informed therapy for driven women healing relational trauma. Licensed in 15 U.S. jurisdictions and registered to provide telehealth in Florida.
Learn MoreExecutive Coaching
Trauma-informed coaching for driven women navigating leadership and burnout.
Learn MoreFixing the Foundations
Annie's signature course for relational trauma recovery. Work at your own pace.
Learn MoreStrong & Stable
The Sunday conversation you wished you'd had years earlier. 28,000+ readers.
Join Free
Annie Wright, LMFT
LMFT · Relational Trauma Specialist · Author, W.W. Norton 2027
Helping driven women finally feel as good as their résumé looks.
Annie Wright is an EMDR-certified licensed psychotherapist and relational trauma specialist with over 15,000 clinical hours, and she's been in practice since 2013. She draws on psychodynamic and somatic approaches alongside EMDR, and she is licensed in 15 U.S. jurisdictions and registered to provide telehealth in Florida (California, Colorado (telehealth only), Connecticut, the District of Columbia, Illinois, Maine, Maryland, Massachusetts, New Hampshire, New Jersey, New York, Texas, Utah, Virginia, and Washington). Annie works with driven and ambitious women from relational trauma backgrounds, and everything she writes about is field-tested across thousands of clinical sessions. She is the founder and former CEO of Evergreen Counseling, a multimillion-dollar trauma-informed therapy center she built, scaled, and successfully exited, and is currently writing her first book, The Everything Years: Navigating the Pressure and Promise of Your Thirties, with W.W. Norton (2027). A regular contributor to Psychology Today, her expert commentary has appeared in USA Today, Forbes, Business Insider, Inc., NBC, and The Information.
Work With Annie