For many people, privacy is one of the first questions about mental health care, and it can feel more pressing when the visit happens over the internet. Health care providers have legal duties to protect your information, and patients can take simple steps of their own. This guide covers both, drawing on federal advice from the Department of Health and Human Services (HHS).
HHS explains that the Health Insurance Portability and Accountability Act of 1996, known as HIPAA, created a federal law and standard for protecting personal information, and that HIPAA rules keep paper and digital medical histories private, including what you share during telehealth visits. HHS also publishes a guide for individuals that explains rights under HIPAA, how information may be used or shared, and how to file a complaint if you think your rights were violated.
A practice's privacy notice tells you how it uses and protects information. Ruhwell Med, a video-only psychiatric practice in College Station, posts its Notice of Privacy Practices on its website. Among the rights it lists are getting an electronic or paper copy of your medical record, asking for corrections, asking to be contacted in a specific way or at a specific location, asking to limit certain uses or disclosures, and filing a complaint if you believe your privacy rights were violated. Its notice also states that Texas and federal law may provide additional confidentiality protections for mental health, minor and substance use disorder records, and that the practice will follow the more protective applicable law.
HHS stresses that it is still important to make sure no one can listen in when you are speaking with your provider. Its suggestions include a quiet room at home, a private spot in a community space or library, a car parked somewhere quiet, a quiet room at a friend's home, or an outdoor spot away from crowds. HHS separately advises never having a telehealth visit while driving or running errands.
If you share a home, it may help to tell others you need the room for a set time, or to schedule around when the house is quiet. Some people use headphones so that the clinician's side of the conversation stays private.
HHS lists several steps patients can take. Look for a lock or shield icon before typing personal information into a website. Keep your technology up to date, including antivirus software. Make sure your home Wi-Fi has a password. Do not use free or public Wi-Fi when sharing health information. And use your own device when you can, rather than a shared computer, tablet or phone.
HHS suggests using a patient portal to send and receive messages safely. Many practices also ask people to keep sensitive details out of general contact forms. Ruhwell Med, for example, asks people not to include sensitive medical details in its website contact form, and says it covers those details privately once it is in touch. Its homepage describes its video visits as HIPAA-compliant.
HHS advises against sharing health information with someone who says they are a health care provider unless you are sure. If a call, text or email that claims to come from your provider seems unusual, call the office using the phone number you normally use to confirm before sharing anything.
HHS's patient guidance says that telehealth visits should not be recorded, and that the information saved is the notes your health care provider writes in your private health record. If you have questions about what is documented or who can see it, ask the practice. Under the rights listed in privacy notices like Ruhwell Med's, you can also ask for a copy of your record.
Privacy questions can feel more complicated when the patient is a minor, or when a young adult is on a parent's insurance. Ruhwell Med's notice says patients may, in certain situations, tell the practice how they want information shared with family members, friends or others involved in their care. Before a first visit, it is reasonable to ask any practice how it handles communication with parents and family, and how billing notices are sent.
Finally, remember that portals, email and contact forms are not watched like an emergency line. Ruhwell Med, for example, warns that its website form is not watched for emergencies. If you or someone you know needs help right away, use 988 or 911 rather than a message.
HHS describes protecting health information during telehealth as something you and your provider work on together. The practice is responsible for secure systems and for following privacy law; you can help by choosing a private space, a protected connection and your own device. Asking questions about privacy is a normal part of choosing care, and a practice should be able to answer them plainly.
This article is general information, not medical advice. If you or someone you know is in crisis or thinking about suicide, call or text 988 to reach the 988 Suicide & Crisis Lifeline, or call 911 in an emergency.