Mental health data is among the most sensitive — and, increasingly, among the most exposed. The BetterHelp $7.8M FTC settlement and the Cerebral $7.1M settlement both involved mental-health platforms sharing intimate user data with advertising networks.
What HIPAA says about mental health records
HIPAA grants special protection to psychotherapy notes — the therapist’s separate session notes, kept distinct from the rest of your medical record. These notes require your specific authorization to be shared (most other PHI can be shared for treatment, payment, or healthcare operations without your explicit consent each time).
Where the protection breaks down
Most consumer mental-health apps (BetterHelp, Talkspace, Cerebral, Headspace, Calm) are not HIPAA-covered for the parts of their service that don’t involve a licensed provider billing insurance. Your in-app self-reflection journals, mood logs, and search history are typically governed by their privacy policy alone — meaning whatever they wrote.
What to do
If you receive therapy via a HIPAA-covered provider, ask whether your psychotherapy notes are kept separate from the rest of your record (they should be). If you use a consumer mental-health app, assume the data you enter could be shared with advertising platforms unless you’ve reviewed their privacy policy line-by-line.
Full breakdown coming soon.