Online therapy is confidential. The same ethical duty of privacy that applies in a therapy office applies on video, and federal and state law add specific rules for the technology used. What changes online is the setting: your therapist can no longer control the room you are sitting in, so part of the privacy is yours to arrange. This guide explains what the law protects, where confidentiality has limits, what California adds, and what you can do before your first session.
Alvaradotherapy
Explore Online Therapy in California
Alvarado Therapy offers online counseling across California, with trauma-informed support for concerns including PTSD, anxiety, grief, and relationship difficulties.
TL;DR
Therapists owe you the same confidentiality online as in person, and the platform they use must meet HIPAA standards.
A few exceptions apply everywhere: risk of harm to you or others, abuse of a child or vulnerable adult, and valid court orders.
California adds its own protections, including a medical privacy law that now reaches digital mental health services.
Most privacy gaps online come from the room, the device or the Wi-Fi, not from the video platform itself.
If you think your information was exposed, you can file a complaint with federal and state regulators.
Table of Contents
Is online therapy as confidential as in-person therapy?
What HIPAA covers, and what it does not
When confidentiality has limits
What California adds
How therapists and platforms protect your information
How to keep your own sessions private
What if you share a home or have no private space?
Perspective: why confidentiality shapes trauma work
Questions to ask a therapist about privacy
If you think your information was exposed
Starting online therapy with Alvarado Therapy
FAQ
Sources
Is online therapy as confidential as in-person therapy?
Yes, in principle. The American Psychological Association explains that therapy works in part because clients have a safe, private space to share deeply personal stories, and that what is said in a therapy office stays there except in a few situations. The same page says the site or app used for online therapy should, at a minimum, be HIPAA-compliant and able to verify the identity of both client and therapist.
The U.S. Department of Health and Human Services states that telehealth appointments, messages and related health and billing information are protected by HIPAA. HIPAA requires covered providers to use telehealth platforms that ensure secure communications and data storage, and the HHS Office for Civil Rights enforces it.
So the legal duty is the same. The practical difference is that an office is a controlled space and your living room is not. A session can be encrypted end to end and still be overheard through a thin wall. That is why good online therapy treats privacy as shared work between therapist and client.
What HIPAA covers, and what it does not
HIPAA is the baseline, but it is not a blanket over everything you do online. Three points are worth knowing.
It applies to covered providers and their vendors. A licensed therapist who bills electronically or otherwise qualifies as a covered entity must follow the Privacy Rule and the Security Rule. The American Psychiatric Association notes that the Security Rule protects information a covered entity creates, receives, maintains or transmits in electronic form, while the Privacy Rule protects identifiable health data and gives you the right to a copy of your records.
Phone-only sessions are treated differently. HHS guidance says the Security Rule does not apply to audio-only telehealth over a traditional landline because the information transmitted is not electronic. It does apply when a provider uses VoIP or mobile technologies. The same guidance notes that a provider is not responsible for the privacy of your information once it reaches your own phone or device, and that you may use any phone system you choose without being bound by the HIPAA rules yourself.
In plain terms: your therapist's obligations stop at your screen. What happens on your side, such as who can see your device, is yours to protect.
Psychotherapy notes get extra protection. The psychiatry.org HIPAA page explains that psychotherapy notes are kept separately from the rest of a record and need your authorization to be released to anyone, because they are primarily for the treating clinician's own use.
When confidentiality has limits
Every responsible therapist explains the exceptions at the start of treatment. They are narrow, and they exist to keep people safe. They apply in the same way online and in person.
A professional overview of exceptions lists six situations where a therapist may be legally or ethically required to break confidentiality:
Suspected abuse or neglect of a child.
Suspected abuse of an elder or dependent adult.
A client who poses an imminent danger to an identifiable third person (the duty to warn or protect).
Imminent risk of suicide or self-harm that meets the threshold for involuntary commitment.
Court orders and legally valid subpoenas.
National security investigations under federal law.
Reporting duties for child abuse apply to licensed mental health professionals in every state. One clinical training source notes the duty exists regardless of any confidentiality agreement, and independently of HIPAA and of the family's wishes.
Two things are worth holding onto. First, these exceptions are rare and specific. Feeling sad, angry, ashamed or overwhelmed, or talking about past trauma, is not a reason for a therapist to disclose anything. Second, a good therapist tells you about these limits in plain language on day one, so a report, if it ever happens, is never a surprise. If your therapist has not covered them, ask.
What California adds
If you live in California, you have more protection than the federal floor. Several layers apply.
The Confidentiality of Medical Information Act
California's CMIA prohibits disclosing or using residents' medical information for purposes not essential to health care unless an exception applies or you authorize it. Because HIPAA does not override more protective state laws, CMIA applies where it gives greater privacy protection. The same analysis notes that CMIA sets strict rules for what a valid authorization looks like: it must be separate from other language on the page, signed and dated, and state the specific uses and limits of the disclosure.
Digital mental health services
On September 28, 2022, California's governor signed AB 2089. It extends CMIA to mental health services delivered through apps and websites, covering businesses that collect mental health information from a consumer and market themselves as facilitating mental health services. The law also requires businesses that supply such a service to a health care provider to give that provider information about data breaches that must be reported to the California Attorney General.
Rules from the Board of Behavioral Sciences
California therapists, including marriage and family therapists, clinical social workers and professional clinical counselors, answer to the Board of Behavioral Sciences (BBS). Its guidance on online-only therapy platforms says licensees working for such companies must still follow the Board's telehealth laws. That includes determining the client's location, having an emergency response plan and verifying the client's identity to protect confidentiality. The guidance also expects licensees to keep sessions and records secure and to understand the platform's policies on who holds records and who can access them.
The Board's proposed telehealth regulation goes further in describing what a client should expect. It calls for informed consent at the start of telehealth, a statement of the risks and limits of telehealth, and the therapist's license number. It also calls for confirming your name and present address at the start of each session, and for using industry best practices to secure the communication medium in line with CMIA and HIPAA. Because that text was a proposal, ask your therapist how their practice applies these steps today.
The address check is not red tape. It tells the therapist which state's rules apply and where to send help in an emergency. Our article on therapy across state lines explains why your location matters.
How therapists and platforms protect your information
Behind the scenes, a well-run online practice does several things.
Uses a platform built for health care. Professional guidance from the California Association of Marriage and Family Therapists says providers should assess risks to confidentiality and put in place administrative, physical and technical safeguards. Examples include anti-malware software, security updates, strong passwords and a VPN or secured network. It also recommends a Business Associate Agreement with any vendor that transmits or stores protected health information.
Limits who can see what. HHS guidance stresses access controls, audit controls and the minimum necessary standard, which means using or sharing only what is needed for the purpose.
Explains the risks to you. HHS tells providers to describe the privacy and security protections of the tools they offer and to explain that video apps can carry risks, including malware, unpatched software and accidental disclosure when a patient is not in a private place.
Protects their own space. Therapists are expected to work from a closed, secured room where no one can see the screen or hear the audio.
If you are choosing a provider, our guide to finding an online therapist in California walks through licensing and what to ask at the first contact.
How to keep your own sessions private
The HHS patient page on data privacy gives practical steps. Combined with the telehealth privacy guidance for behavioral health from the Center of Excellence for Protected Health Information, they come down to a short checklist.
Before the session
Pick the room. Choose a quiet space with a door that closes. A parked car, a closet or a walk outdoors can work when home is not private.
Use your own device if you can. Shared devices may expose anything stored or sent on them, so remove health information you no longer need.
Update and secure. Keep software current, run antivirus and password-protect your home Wi-Fi.
Skip public Wi-Fi. HHS advises avoiding public Wi-Fi when sharing health information. If you have no other option, use cellular data.
Check the link. Look for the lock or shield icon before entering personal details, and confirm that you are on your therapist's real portal.
During the session
Wear headphones and avoid speakerphone, so no one hears the other side of the conversation.
Turn off nearby listening devices. Smart speakers and voice assistants can overhear or record what you share.
Do not record the session. HHS advises patients against it, since a recording sits outside every protection your therapist maintains.
Use the portal for messages. Ordinary text or email is not where clinical details belong.
Tell your therapist if someone enters the room. A code word or a pause is enough. Your therapist would rather stop and reschedule than have you hold back.
For a longer walk-through, see our step-by-step guide to preparing for an online therapy session.
What if you share a home or have no private space?
This is the most common real obstacle, and it has workable answers. Tell your therapist early. Sessions can be timed for when the house is empty, held from a parked car or an outdoor spot with headphones, or scheduled at an hour when others are out. For trauma work, where you may cry or speak about things you have never said aloud, privacy matters even more, and a therapist who knows your constraints can plan around them.
Narrow your conversation if you must. Some people start with topics that are safe to say aloud and move to more sensitive material once they have a reliably private slot. That is a decision you and your therapist make together.
Perspective: why confidentiality shapes trauma work
In our practice, confidentiality is not a form you sign. It is the condition that makes trauma therapy possible. People who have lived through childhood trauma, violence or loss often learned that speaking up was unsafe. They will only start to talk when they believe the room is truly theirs.
We provide therapy online across California, in English and Spanish, and we treat the privacy conversation as part of the clinical work. We explain the limits of confidentiality in plain words, ask where you are and who is nearby, and help you find a setup that feels safe, including for survivors who live with family or a partner they cannot talk freely around.
We also believe privacy is part of being culturally responsive. For many Latinx, BIPOC and LGBTQ+ clients, fear of exposure, in a family, a community or a workplace, is a real reason people delay care. Being able to start from home, with a therapist who understands that fear, is often what finally makes treatment possible.
Our own EMDR clients often tell us that the safety they feel in a private, well-prepared online session is what lets the deeper work begin. Our guidance for clinicians on EMDR via telehealth in California reflects the same standard we hold ourselves to.
Juiced
Questions to ask a therapist about privacy
A therapist who takes confidentiality seriously will welcome these questions in a first call.
Which platform do you use for sessions, and is it designed for health care and HIPAA?
Where are my records stored, and who can access them?
What are the limits of confidentiality in your practice, in plain language?
What happens if the connection drops or someone enters my room?
Do you confirm my location at each session, and what is your emergency plan?
How do I contact you between sessions securely?
You should leave the call knowing the answers, not guessing at them.
If you think your information was exposed
Start with your therapist or practice. Ask what happened, which information was involved and what they have done. Covered providers have duties when protected health information is breached, and a clear written explanation is a reasonable request. Keep your own notes: dates, what you saw, and any messages.
If you are not satisfied, two regulators take complaints:
Federal: The HHS Office for Civil Rights accepts HIPAA privacy and security complaints through its online portal or in writing. A complaint must name the provider or business involved and describe what you believe violated the rules.
California: The Board of Behavioral Sciences reviews complaints about its licensees and registrants, which you can file online. The Board notes that complaints filed by someone other than the client may be difficult to pursue because clients hold the right to confidentiality of their records.
If the exposure caused you real harm, such as a leak of sensitive details to an employer or family member, a licensed attorney can advise you on other options.
Starting online therapy with Alvarado Therapy
We offer online therapy to adults across California, including EMDR, individual counseling, couples therapy and EMDR intensives, in English and Spanish. If you want to talk through how privacy works in our sessions before you commit, you can start on our individual counseling and EMDR therapy page. If you prefer concentrated work, our EMDR intensives are offered as 1-day (4 or 6 hours) or 3-day formats.
Not sure what online care looks like? Our guide to accessing online therapy in California for trauma healing covers the process from the first booking to the first session.
FAQ
Can my therapist tell my family or employer that I am in therapy?
No, not without your written authorization, except in the narrow situations the law requires. Under California's CMIA, a valid authorization has to be specific, signed and dated. If you are an adult, your family has no right to your records.
Is video therapy on Zoom or a similar app confidential?
It can be, when the provider uses a version configured for health care and has the vendor agreements that HIPAA expects. Ask your therapist which platform they use and how it is set up. Your own privacy steps, such as headphones and a closed door, matter just as much.
Are phone sessions less private than video?
Not necessarily. A landline call is outside the HIPAA Security Rule because the information is not electronic, but your therapist's ethical duty of confidentiality still applies. The more relevant question is who can hear you at your end and what network you are using.
Does my therapist have to report what I say about my past?
Usually no. Reporting duties focus on current or imminent situations: suspected abuse of a child or dependent adult, serious risk of harm and court orders. Because rules vary by situation, ask your therapist to explain exactly how they apply to you before you begin.
Sources
Managing confidentiality with minors and families (Clinical Events)
Proposed telehealth regulation, Section 1815.5 (California BBS)
Telehealth privacy considerations for behavioral health providers (CoE-PHI)
