Confidentiality is understandably important to survivors of sexual violence. Generally speaking, what happens in therapy stays in therapy—but there are exceptions you should know about.
These two laws can help you understand how your privacy is protected and when a therapist may be required to break confidentiality:
- HIPAA: A federal law that protects medical information
- Mandatory Reporting: State laws that protect people
HIPAA: What Survivors Should Know
When you go to therapy, your privacy is protected by the Health Insurance Portability and Accountability Act (HIPAA). HIPAA is designed to keep your health information private and secure. This includes your mental health records and anything that could identify you, like your name or address.
Understanding your privacy rights can help you feel safer and more in control during therapy. If you have concerns about how your information might be used or shared, don’t hesitate to ask your therapist to explain your rights under HIPAA. Your privacy is important, and you deserve to feel supported.
These are a few examples of how HIPAA’s rules apply to therapy:
Your Protected Health Information (PHI)
Your mental health records and personal details are part of your Protected Health Information (PHI). Your therapist cannot share this information without your permission, except in very specific situations (like mandatory reporting).
Under HIPAA, you have the right to:
- See your medical and billing records
- Request corrections to those records
- Ask for your records to be shared electronically with someone else
Exception: Your therapist’s private psychotherapy notes—their personal reflections or thoughts—are not part of your medical record and aren’t accessible under HIPAA.
If You’re Under 18
If you’re younger than 18, your parent or legal guardian may have the legal right to access your PHI. But if your parent or guardian has been abusive, this can feel unsafe.
Talk to your therapist about your concerns. They may be able to keep your PHI from being shared with an abuser or anyone linked to them.
Your Privacy at Work
Your employer can ask for basic health information, like a doctor’s note, for instance. However, your therapist cannot share details with your employer unless you give written permission.
Your Privacy in Legal Cases
- Law Enforcement. Police or other officials can’t access your PHI without your permission or a court order.
- Court Orders. If a court orders your PHI to be shared, your therapist can only release the exact information listed in the order.
- Subpoenas. An attorney might subpoena your PHI, but your therapist cannot release it unless they inform you first or the court issues a protective order to safeguard your information.
Mandatory Reporting: What Survivors Should Know
While most things you share in therapy are private, mandatory reporting creates an exception to keep people safe.
Mandatory reporting means that certain professionals, like therapists and counselors, are legally required to report specific situations to authorities. These situations usually involve:
- Suspected child abuse or neglect
- Elder abuse
- Threats of self-harm or harm to others
- Dangerous situations
Understanding mandatory reporting can help you feel prepared and informed when you talk to a mental health professional. If you’re unsure about what might get reported, don’t be afraid to ask your therapist to explain their reporting responsibilities. You deserve to feel safe and supported.
The rules about mandatory reporting can be a little different depending on the state you’re in. For example, what counts as “abuse” or when a report is required might vary.
- Explore your state’s mandatory reporting laws for children under 18 and adults over 65
Medical Disclaimer: Please note that content on this site does not constitute medical advice, and RAINN is not a medical expert. If, after reading this information, you have further questions, please contact a local healthcare professional or hospital.
Last updated: July 10, 2025