Therapist Insights / Therapy Privacy
Is BetterHelp confidential? What the record says?
The question is usually asked in one sense and answered in another. Whether a therapist keeps what you say private is one thing. Whether a company keeps what you typed into its intake form private is a completely different thing, and the two are frequently sold as one.
THE QUICK TAKEAWAY
Confidentiality in therapy has two separate layers, and the question of whether BetterHelp is confidential collapses them. The clinical layer, what a licensed clinician does with what you say, is governed by state licensure, ethics and, where HIPAA applies, the psychotherapy notes rule at 45 CFR 164.508. The company layer, what a platform does with your email address and intake answers, is governed by its own privacy policy. In March 2023 the FTC announced a proposed order requiring BetterHelp to pay $7.8 million over allegations it revealed such data to advertisers. Professionals worried about disclosure should weigh both layers.
§01 / 09 / Definition
Is BetterHelp confidential, or is the company?
Confidentiality splits into two questions that get asked as one. The first is clinical confidentiality, which governs what a licensed clinician may disclose. The second is corporate data practice, which governs what a company does with the information you gave the company rather than the clinician, and professionals worried about disclosure need both answered.
Clinical confidentiality is old, well defined and enforced by licensing boards. Your clinician can lose their license for breaching it. Corporate data practice is newer, is defined by a privacy policy the company writes itself, and is enforced by consumer-protection regulators after the fact. The material point for anyone weighing this decision is that a platform can be scrupulous at the first layer and still do things at the second layer that you would never have agreed to if the two had been described to you separately. Professionals worried about disclosure tend to ask about the therapist and then assume the answer covers the company.
Five things people actually mean when they ask this
Will my employer find out
Usually the real question. It turns less on the therapy platform than on whether a claim was submitted through a benefits plan your employer sponsors, which is a billing question rather than a therapy question.
Will this reach an underwriter
Life and disability underwriting can reach records you authorize the release of, and a diagnosis code created by an insurance claim is one of the more durable artifacts anyone generates.
Is anything being sold to advertisers
This is a company question rather than a clinician question, and it is answered by reading the privacy policy and the regulatory record rather than by asking your therapist.
Who can subpoena this
A legal question with state-specific answers. What is knowable in advance is which records exist at all, which is why what gets created matters more than what is promised.
Can I do this without a diagnosis on file
Only if nothing is billed to insurance. A billable claim requires a billable code, and that code is the record most people are actually trying to avoid.
▶ Research
On March 2, 2023, the Federal Trade Commission announced a proposed order under which BetterHelp would pay $7.8 million. In the FTC's own words, the company "used and revealed consumers' email addresses, IP addresses, and health questionnaire information to Facebook, Snapchat, Criteo, and Pinterest for advertising purposes," and used consumers' email addresses and the fact that they had previously been in therapy to instruct Facebook to identify similar consumers. Refunds were directed to people who signed up and paid between August 1, 2017 and December 31, 2020. That is a settlement of alleged conduct in a defined historical window rather than a statement about how any company operates today, and it should be read that way. What it establishes is the more general point: the company layer and the clinical layer are governed by different rules, and only one of them is enforced by a licensing board.1
Three things worth knowing before you choose
HIPAA is narrower than most people assume
HHS defines covered entities as health plans, health care clearinghouses and health care providers who transmit standard electronic transactions. An entity outside those categories, in the agency's words, does not have to comply with the HIPAA Rules.
Psychotherapy notes have their own rule
Under 45 CFR 164.508, a covered entity must obtain authorization to use or disclose psychotherapy notes, subject to narrow exceptions such as use by the originator for treatment. That protection is separate from and stronger than the one covering the rest of a chart.
Billing is the fork in the road
The moment a claim is submitted, a diagnosis code enters a payer's systems. Nothing in a therapist's ethics code or a platform's privacy policy can retract it.
Three parties, three different rulebooks
Confidentiality questions get clearer once you separate who is holding what, because each party is bound by a different rule and only one of them is your clinician.
The clinician
Bound by state licensure, professional ethics and, where the clinician is a covered entity, the HIPAA Privacy Rule. This is the layer most people are picturing when they ask about confidentiality.
The platform
A company that holds your account data, your intake answers and your usage patterns. Its obligations come from its own privacy policy and from consumer-protection law, not from your therapist's license.
The payer
If a claim is filed, an insurer receives a diagnosis code and creates a record on its own systems. No promise made by a therapist or a platform reaches inside that file.
§02 / 09 / Telehealth
What the FTC action against BetterHelp actually said.
The Federal Trade Commission announced a proposed order on March 2, 2023 requiring BetterHelp to pay $7.8 million, alleging the company revealed consumers' email addresses, IP addresses and health questionnaire information to advertising platforms after promising to keep such data private. Professionals worried about disclosure should read that record directly rather than through a summary.
The question becomes answerable
Split into two layers, this stops being a matter of trust and becomes a matter of fact: what is created, who holds it, and under what rule.
The record is checkable
The FTC publishes its actions and HHS publishes what HIPAA covers. You can read both yourself rather than relying on a marketing claim.
The variable is in your control
Whether a claim gets filed is a decision, not a fact of life. It is the single largest determinant of what durable record exists afterwards.
§03 / 09 / Mechanism
BetterHelp confidentiality: where HIPAA applies, and where it stops.
HIPAA binds covered entities, which HHS defines as health plans, health care clearinghouses and health care providers who transmit standard electronic transactions. Professionals worried about disclosure should know that a consumer app outside those categories is not bound by the HIPAA Rules at all.
The HHS page on covered entities is short and worth reading in full. It lists the three categories, and it states plainly that an entity which does not meet the definition of a covered entity or business associate does not have to comply with the HIPAA Rules. That single sentence explains most of the confusion in this area, because a great deal of health-adjacent software sits outside those categories while using vocabulary that sounds like it does not.
Where HIPAA does apply, mental health information carries an additional protection that most people have never heard of. Under 45 CFR 164.508, psychotherapy notes may not be used or disclosed without authorization, with narrow exceptions including use by the originator of the notes for treatment and defense in a legal proceeding brought by the individual. That is a stricter standard than the one governing the rest of the medical record.
BetterHelp's own current privacy policy distinguishes between two United States offerings, an insurance-based path where an associated provider group's notice of privacy practices governs, and a subscription path where the privacy policy itself does. Reading which path you are on is a more reliable exercise than reading the marketing page, and the same is true of every provider, including this one.
► Standard advice vs. CEREVITY's approach
Standard therapy
"Ask a provider whether they are confidential"
CEREVITY
"Ask which records they create, who holds them, and under what rule"
Standard therapy
"Assume an app that handles health information is HIPAA covered"
CEREVITY
"Check whether it meets the HHS definition of a covered entity"
Standard therapy
"Treat billing as an administrative detail"
CEREVITY
"Treat billing as the decision that determines what record exists"
| Standard insurance-based therapy | CEREVITY's specialized approach |
|---|---|
| "Ask a provider whether they are confidential" | "Ask which records they create, who holds them, and under what rule" |
| "Assume an app that handles health information is HIPAA covered" | "Check whether it meets the HHS definition of a covered entity" |
| "Treat billing as an administrative detail" | "Treat billing as the decision that determines what record exists" |
A break from the page
The useful question is what gets created.
A first conversation is confidential and commits you to nothing. CEREVITY is a nationwide network of independent licensed clinicians working private-pay, with no insurance claim submitted. Read the thinking behind the model or start with a private inquiry.
§04 / 09 / Cases
Common challenges we address.
The executive whose benefits plan runs through their own company
The patternSomeone senior enough that the people administering the plan are people they manage, weighing whether to use a benefit that generates a claim inside their own organization's ecosystem.
What we addressThe variable is the claim rather than the therapy. Paying privately means no claim, no diagnosis code and no carrier file exists to be administered by anyone, which is why the model behind the match starts there.
The licensed professional weighing a future disclosure question
The patternA clinician, attorney, pilot or clearance holder who expects to face a form at some point and wants to understand what will exist by then.
What we addressWe will not tell you what your board or your form requires, because that answer is jurisdiction-specific and changes. We will tell you exactly what we generate, which is no claim and no diagnosis code, and point you at the clearance-holder page for how that reasoning runs in practice.
§05 / 09 / Methods
Evidence-based treatment approaches.
Four questions settle it for any provider: whether a claim is filed, what diagnosis code is generated, who holds the clinical record and under what rule, and what the company does with data you gave the company rather than the clinician. CEREVITY answers all four in the open.
Ask whether a claim is submitted
The single highest-yield question. A submitted claim creates a diagnosis code in a payer's systems, and no subsequent promise reaches into that record.
Ask who holds the clinical record
An individual licensed clinician, a group practice, or a platform. The answer determines which rulebook applies and who you would ask for a copy.
Read the privacy policy, not the homepage
Marketing copy describes intent. The privacy policy describes permissions, including what happens to intake answers and analytics data that never passed through a clinical conversation.
Check the regulatory record
The FTC publishes enforcement actions and HHS publishes what HIPAA covers. Both are free, both are searchable, and both are more informative than a testimonial page.
Ask what happens at the end
Retention periods, what a request for records produces, and what is deleted when you stop. These answers are rarely on the marketing page and are always answerable.
§06 / 09 / Investment
Understanding the investment in private-pay care.
Private-pay, nationwide, and built around discretion
At CEREVITY, our online individual therapy sessions are structured as a direct investment in your mental agility and overall well-being. The investment includes:
- Licensed mental health professional specializing in confidential private-pay therapy
- Evidence-based, one-on-one approaches proven effective for anxiety, burnout, and disclosure fear
- Flexible online scheduling including evenings and weekends
- Complete privacy with no insurance involvement or red tape
- Professionals worried about disclosure expertise and understanding
- Outcome tracking and progress measurement
The cost of online therapy confidentiality going unaddressed
Consider what is at stake when online therapy confidentiality goes unaddressed:
What private-pay actually removes
No claim is submitted, so no diagnosis code and no carrier file are created. That does not make a clinical record disappear, it means the record has one holder, your clinician, rather than several. View our current rates here: cerevity.com/our-pricing-for-therapy/.
Formats and access
Sessions are delivered by secure telehealth nationwide across all 50 states, and the model behind the match is built for people whose reason for asking about privacy is a professional one.
§07 / 09 / Evidence
What the research shows.
The primary sources here are short and public. The FTC's March 2023 press release states the alleged conduct and the $7.8 million figure. The HHS covered entities page states which organizations HIPAA binds and says explicitly that an entity outside those definitions does not have to comply. The regulation itself, at 45 CFR 164.508, sets out the authorization requirement for psychotherapy notes and its narrow exceptions.
► The public record, in three numbers
the payment required under the FTC's proposed order announced March 2, 2023, over allegations that consumer health data was revealed to advertising platforms.
Federal Trade Commission, 2023
categories of covered entity under HIPAA: health plans, health care clearinghouses, and health care providers who transmit standard electronic transactions.
U.S. Department of Health and Human Services
the section of 45 CFR requiring authorization before a covered entity uses or discloses psychotherapy notes, with narrow exceptions.
Code of Federal Regulations, Title 45
Reporting from NPR in July 2022 framed the structural issue before the enforcement action landed, quoting the observation that HIPAA reaches health plans, clearinghouses and providers, which leaves a large category of mental health software outside it. None of this is an argument that online therapy is unsafe. It is an argument that the word confidential is doing two jobs at once, and that anyone with a professional reason to care should insist on knowing which job is being performed.
§§ / 09 / Recap
Key takeaways.
Five things to remember
- Two layers, two rulebooks Clinical confidentiality is enforced by licensing boards. Corporate data practice is governed by a privacy policy and policed after the fact by consumer-protection regulators.
- The FTC action is a matter of record A proposed order announced in March 2023 required a $7.8 million payment over allegations that consumer email addresses, IP addresses and health questionnaire answers reached advertising platforms.
- HIPAA does not cover everything health-shaped HHS binds three categories of entity. Software that sits outside them is not required to comply, whatever its marketing language implies.
- Billing decides what survives A submitted claim generates a diagnosis code inside a payer's systems. Paying privately is the one decision that prevents that record from existing at all.
- CEREVITY provides this through online individual therapy nationwide, with full privacy through its private-pay concierge network and no insurance involvement.
§08 / 09 / FAQ
Frequently asked questions.
Is BetterHelp confidential?
Confidentiality here has two layers and they need separate answers. Licensed clinicians on any platform are bound by state licensure and professional ethics regarding what they disclose. The company layer is different: in March 2023 the Federal Trade Commission announced a proposed order requiring BetterHelp to pay $7.8 million over allegations that it revealed consumers' email addresses, IP addresses and health questionnaire information to advertising platforms. Anyone with a professional reason to care should read the current privacy policy and decide about both layers separately.
Is BetterHelp HIPAA compliant?
HIPAA obligations depend on whether an entity meets the HHS definition of a covered entity, which is limited to health plans, health care clearinghouses, and health care providers who transmit standard electronic transactions. BetterHelp's current privacy policy distinguishes between an insurance-based path, where an associated provider group's notice of privacy practices governs, and a subscription path governed by the policy itself. Professionals worried about disclosure should read which path applies to them rather than relying on a general claim in either direction.
Does online therapy show up on my insurance record?
Only if a claim is filed. Billing insurance requires a billable diagnosis code, and that code enters the payer's systems and can persist there. Professionals worried about disclosure often assume the therapy itself creates the record, when the billing decision is what creates it. Paying privately, as CEREVITY clients do, means no claim and no code are generated at any point.
What are psychotherapy notes and are they protected differently?
Psychotherapy notes are the clinician's own process notes, kept separately from the rest of the record. Under 45 CFR 164.508, a covered entity must obtain authorization before using or disclosing them, with narrow exceptions such as use by the originator for treatment or defense in a legal proceeding brought by the individual. CEREVITY clinicians explain that distinction at intake, because it is stricter than the standard applying to the general chart.
How is CEREVITY different on privacy?
CEREVITY is 100% private-pay and does not bill insurance or provide superbills, so no claim, no diagnosis code and no carrier file are created. The clinical record is held by the individual licensed clinician under HIPAA and privilege rather than by a platform, and released only with written authorization apart from the narrow legal exceptions your clinician reviews at intake.
What should I ask a therapy provider about privacy?
Four questions cover most of it. Is a claim submitted to any insurer. What diagnosis code, if any, is generated. Who holds the clinical record and under which rule. What does the company do with the data you gave the company rather than the clinician, including intake answers and analytics. CEREVITY answers all four plainly, and any provider that cannot is telling you something useful.
How does your private-pay pricing structure work?
As a private-pay concierge network, we offer structured investments in your mental health without the restrictions or privacy risks of insurance. You can review our full fee schedule and specific session lengths directly on our website. While this costs more than insurance copays, it provides the flexibility, total privacy, and highly specialized care that standard options cannot offer. View our current rates here.
How do you protect my privacy?
Privacy is foundational to our network. As a private-pay network, your sessions never appear on insurance records or EOBs that could be seen by employers, boards, or family members. We use HIPAA-compliant nationwide telehealth platforms, and you can attend sessions from anywhere with a private internet connection.
§09 / 09 / Begin
Ask what exists. Then decide.
Privacy is not a feeling about a brand, it is a set of records that either exist or do not. CEREVITY is a nationwide network of independent licensed clinicians providing confidential, private-pay care with no claim ever filed. Call (562) 295-6650 or send a private inquiry.
Seven days a week · Sessions 7 AM to 9 PM Pacific · Support 8 AM to 8 PM Pacific§§ / Author
About Christa Smith, PhD.
Christa Smith, PhD
Dr. Smith is a Licensed Clinical Psychologist who specializes in psychological and neuropsychological assessment and evidence-based therapy for adults. Her clinical work integrates cognitive behavioral therapy, acceptance and commitment therapy, and trauma-informed approaches with formal assessment when clarity on diagnosis or cognition is needed. She sees clients through CEREVITY's nationwide private-pay telehealth network. View full bio →
§§ / Sources
References.
- Federal Trade Commission. FTC to Ban BetterHelp from Revealing Consumers' Data, Including Sensitive Mental Health Information, to Facebook and Others. 2023. ftc.gov
- U.S. Department of Health and Human Services. Covered Entities and Business Associates. 2024. hhs.gov
- Code of Federal Regulations. 45 CFR 164.508: Uses and disclosures for which an authorization is required. 2026. ecfr.gov
- NPR. How to protect your privacy when using online therapy apps. 2022. npr.org
- BetterHelp. Privacy Policy. 2026. betterhelp.com
- CEREVITY. High-stakes anxiety therapy. cerevity.com/high-stakes-anxiety-therapy
- CEREVITY. High-functioning anxiety and depression therapy. cerevity.com/anxiety-and-depression-therapy
- CEREVITY. Executive burnout therapy. cerevity.com/executive-burnout-therapy
⚠ Crisis resources
If you are experiencing a mental health crisis or having thoughts of suicide, please reach out immediately. 988 Suicide & Crisis Lifeline · Call or text 988 Crisis Text Line · Text HOME to 741741 National Alliance on Mental Illness · 1-800-950-NAMI (6264)
