Many people put off getting help because they fear that what they say will get out, to family, to an employer, or to the government. In the United States your mental health and medical information is private and protected by law. Knowing what stays private, and the few narrow situations where a provider may have to act, can make it easier to be honest with someone who is trying to help you.

Your records are private by law

A federal law called HIPAA, the Health Insurance Portability and Accountability Act, requires doctors, therapists, clinics, hospitals, and health plans to keep your identifiable health information private. In general they cannot share it without your written permission, except for a few allowed purposes such as treating you, getting paid for your care, and running the clinic. The HHS Office for Civil Rights explains what you can expect on its Your Rights Under HIPAA page. The private notes a therapist keeps about your sessions, called psychotherapy notes, get extra protection and need your specific, separate permission to share. Keeping your records private is one of your basic rights as a patient (MedlinePlus). For a fuller picture, read Your privacy: who can see your mental health records.

When you first visit a clinic or join a health plan, they must give you a paper called a Notice of Privacy Practices. It explains, in plain words, how they may use and share your information, and it lists your privacy rights. You usually get it at your first appointment, and you can ask for it in your language and ask a community health worker to walk you through it. Keep it, because it also tells you who to call at the clinic if you ever have a privacy question (HHS Office for Civil Rights).

You decide who else can see them

You are in control of who else gets your information. To share your records with a family member, a lawyer, a school, or another clinic, you usually sign a form called a release of information that names exactly who can see what, and for how long. You can say no, you can share only part, and you can cancel your permission later. Do not sign a form you do not understand. You have the right to a free, qualified interpreter to go through it with you first.

Before you sign a release, it is fair to ask.

Saying no to a release does not stop your own care.

The few times a provider may have to act

It is fair to want the honest version, so here it is. There are a small number of narrow exceptions, and even then a provider shares only the minimum that the situation requires:

• Serious, imminent risk of harm to you or someone else. If a provider believes in good faith that this is needed to prevent serious harm, they may share the minimum necessary with someone who can help keep you or another person safe, as the HHS Office for Civil Rights describes.
• Suspected abuse or neglect of a child or a vulnerable adult. Health providers are mandated reporters, which means the law requires them to report a reasonable suspicion so the person can be protected, as the HHS Children’s Bureau explains in Mandatory Reporting of Child Abuse and Neglect.
• A court order. A judge can order that records be released, and a provider must then give only what the order requires.

These exist to protect safety. Outside of situations like these, what you tell a therapist stays private.

Extra protection for substance use treatment

Records from substance use treatment get a higher level of confidentiality than other medical information, under a federal rule known as 42 CFR Part 2. In general these records cannot be shared, even with another provider, without your specific written consent. SAMHSA describes these protections in its statutes and regulations for substance use treatment.

A 2024 update brought this rule closer to HIPAA. You can now sign a single consent that covers future sharing for your treatment, your payment, and running the clinic, so you do not have to sign a new form every time. A strong protection stays in place: these records generally cannot be used against you in a court case or an investigation without your specific permission or a court order (U.S. Department of Health and Human Services).

A clinic is not an immigration agency

A clinic is a place that provides health care. You do not have to share your immigration status in order to get care, and your health information is protected the same way everyone’s is. If you have a worry tied to a legal or immigration case, that is a question for a person, such as a community health worker or a legal aid organization. See Can I get mental health care? Your rights, whatever your status.

How this works for minors

The rules for young people vary by state. In general a parent or guardian can see a minor’s records, but many states let adolescents agree to outpatient mental health care on their own, and most states let a young person get confidential help for drug or alcohol use (Guttmacher Institute). The age and the details differ, so it is worth asking the clinic or a community health worker what applies where you live.

When you are not sure

You can always ask before you share, and ask what will happen with the information. You can ask the chatbot to explain a privacy notice or a release form in your language. The chatbot is AI and can be wrong, so confirm anything high-stakes with a community health worker or someone you trust.

You can see and get a copy of your own records

Your records are there to help your care, and you have the right to look at them and get a copy. When you ask, a clinic must usually give you your records within about 30 days (HHS Office for Civil Rights). If they need more time, they must tell you in writing and give you a date. They may charge a small, reasonable fee for copies, but they cannot make you say why you want them, and asking for your own records cannot be used to punish you. Ask the front desk or the medical records office how to make the request, and say whether you want it on paper or as an electronic copy.

Seeing your own records can help you catch a mistake, understand your diagnosis, or share the right information with a new provider. If you find something that looks wrong, you can ask the clinic to fix it.

If you think your privacy was broken

If you believe a clinic shared your information the wrong way, you can speak up, and you cannot be punished for doing so. First, you can ask to talk with the clinic’s privacy officer; their contact is on the Notice of Privacy Practices. You can also file a complaint with the HHS Office for Civil Rights. It is free, and you can do it by mail, fax, email, or online through the OCR complaint portal. A clinic is not allowed to retaliate against you for filing a complaint (HHS Office for Civil Rights). There is a time limit, so file within 180 days of when you learned about the problem. A community health worker can help you write it in your language.

Interpreters keep your information private too

A trained medical interpreter is part of your care team and follows the same privacy rules as your doctor. Their professional code of ethics requires them to keep everything you say confidential (National Council on Interpreting in Health Care). That is one reason it is better not to lean on a family member, a friend, or your child to interpret. They are not bound by these rules, they may leave things out or change them, and sharing private health details in front of them can feel unsafe. You have the right to a free, qualified interpreter, so you do not have to choose between your privacy and being understood.

Answers to common worries

Will my therapist tell my family what I say? No, not without your written permission, unless one of the narrow safety exceptions above applies. Living with family or being married does not give anyone a right to your records. If you want a relative involved, you can sign a release that shares only what you choose.

Can my mental health records be used against my immigration case? A clinic will not hand your records to immigration officials just because you came in for care, and your information is protected the same way no matter your status. Records can be released only if you sign a permission form or if a judge issues a court order. Questions about a specific legal or immigration case belong with a legal aid organization, not a clinic. See Can I get mental health care? Your rights, whatever your status.

Will my employer find out? Your employer cannot get your medical or mental health records from your provider without your written permission, and your health plan cannot share them with your boss for everyday work reasons.

Can my child’s school see this? Not without your permission. If you want the clinic and the school to work together, you sign a release that says exactly what they can share.

Sources

• Guttmacher Institute. Minors and the right to consent to health care. https://www.guttmacher.org/gpr/2000/08/minors-and-right-consent-health-care
• HHS Children’s Bureau, Child Welfare Information Gateway. Mandatory reporting of child abuse and neglect. https://www.childwelfare.gov/resources/mandatory-reporting-child-abuse-and-neglect/
• HHS Office for Civil Rights. Filing a health information privacy complaint. https://www.hhs.gov/hipaa/filing-a-complaint/index.html
• HHS Office for Civil Rights. Individuals’ right under HIPAA to access their health information. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html
• HHS Office for Civil Rights. Information related to mental and behavioral health, including opioid overdose. https://www.hhs.gov/hipaa/for-professionals/special-topics/mental-health/index.html
• HHS Office for Civil Rights. May a covered entity disclose protected health information in response to a court order? https://www.hhs.gov/hipaa/for-professionals/faq/703/may-a-covered-entity-disclose-information-in-response-to-a-court-order/index.html
• HHS Office for Civil Rights. Notice of Privacy Practices. https://www.hhs.gov/hipaa/for-individuals/notice-privacy-practices/index.html
• HHS Office for Civil Rights. Office for Civil Rights complaint portal. https://ocrportal.hhs.gov/ocr/cp/complaint_frontpage.jsf
• HHS Office for Civil Rights. What constitutes a “serious and imminent” threat that would permit a health care provider to disclose PHI to prevent harm without the patient’s authorization? https://www.hhs.gov/hipaa/for-professionals/faq/3002/what-constitutes-serious-imminent-threat-that-would-permit-health-care-provider-disclose-phi-to-prevent-harm-patient-public-without-patients-authorization-permission/index.html
• HHS Office for Civil Rights. Your rights under HIPAA. https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html
• MedlinePlus (U.S. National Library of Medicine). Patient rights. https://medlineplus.gov/patientrights.html
• National Council on Interpreting in Health Care. A national code of ethics for interpreters in health care. https://www.ncihc.org/national-code-of-ethics
• Substance Abuse and Mental Health Services Administration. Substance use disorders: Statutes, regulations, and guidelines (42 CFR Part 2). https://www.samhsa.gov/substance-use/treatment/statutes-regulations-guidelines
• U.S. Department of Health and Human Services. Fact sheet: 42 CFR Part 2 final rule. https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html

---

LINC is a research prototype, not a medical or legal service. Translation can be wrong; you have the right to a free, qualified interpreter. For anything high-stakes, do it with a community health worker or someone you trust. In a crisis, call or text 988, or 911 for immediate danger.