How can a user compare HIPAA compliance and data privacy practices among popular mental health apps and teletherapy platforms?

The key is to separate “HIPAA compliance” from overall privacy. An app can be HIPAA-covered in one part of its service while collecting other data that HIPAA doesn't protect, and some consumer mental-health apps aren't covered by HIPAA at all. HHS specifically notes that HIPAA generally does not protect health information a person voluntarily enters into an app that isn't provided by or on behalf of a HIPAA-covered entity or business associate.

A practical comparison framework

Don't rely on the phrase “HIPAA compliant”

Look for the actual HIPAA relationship. For example, Talkspace's current Notice of Privacy Practices says that, depending on the arrangement, it can act as a HIPAA Business Associate for independently contracted providers or as a Covered Entity when services are provided directly by Talkspace.

That's much more informative than simply seeing a “HIPAA compliant” badge.

Also check whether the company's privacy policy covers all of its products. Talkspace's privacy policy, for example, distinguishes medical information/PHI from other personal data and describes information collected during registration and service use.

Compare privacy practices separately from HIPAA

A useful spreadsheet might have columns for:

1. HIPAA-covered service?
2. BAA with providers?
3. Data categories collected
4. Advertising/tracking?
5. Data sharing with third parties
6. AI/model-training use
7. Session recording/transcription
8. Message retention period
9. Account/data deletion
10. Encryption
11. MFA
12. Independent security audits
13. Breach history and notifications
14. State-law privacy rights
15. Privacy policy last updated

This prevents a common mistake: treating HIPAA = maximum privacy. HIPAA establishes particular legal protections for PHI in particular relationships; it isn't a comprehensive privacy law covering every piece of data an app collects. The FTC also points out that consumer health apps can fall under the FTC Act and Health Breach Notification Rule even when HIPAA doesn't apply.

Pay particular attention to therapy transcripts

For mental-health services, this can be more consequential than ordinary account information. Ask whether text messages, audio/video recordings, transcripts, and psychotherapy notes are retained, who can access them, and whether they're used for anything beyond providing care.

As one concrete example, Talkspace says its therapy transcripts are treated as medical records and retained for 10 years under its retention policy.

Verify security claims

Look for concrete controls rather than marketing language:

• encryption in transit and at rest
• MFA/passkeys
• access controls and audit logs
• independent security assessments
• breach-response procedures
• limits on employee access
• secure deletion
• policies for recordings and transcripts

HHS specifically recommends considering encryption, authentication, and the risks surrounding stored recordings/transcripts when evaluating telehealth technologies.

A good way to compare popular platforms

Rather than producing a single “most private” ranking, make a side-by-side evidence table and link each conclusion to the platform's current privacy policy, HIPAA Notice of Privacy Practices, security documentation, and terms.

For example:

That approach is especially important because privacy policies change, and the answer can differ between therapy provided through an employer/insurer, direct-to-consumer therapy, and a standalone wellness app.

If you're choosing among particular services such as BetterHelp, Talkspace, Headspace, Calm, Brightside, and Teladoc, I can also build this side-by-side comparison using their current 2026 privacy policies and HIPAA disclosures, with citations for each row.

Comparing HIPAA compliance and data privacy practices across mental health apps and teletherapy platforms requires looking past marketing claims and examining technical, legal, and operational realities . Many standalone wellness apps operate completely outside of HIPAA bounds, meaning they answer to lax consumer protection standards rather than strict healthcare laws.

Here is a practical framework a user can follow to evaluate and compare these platforms:

1. Determine HIPAA Applicability vs. FTC Regulation
   • Check if the platform acts as a healthcare provider or a "Business Associate" under HIPAA. If an app is direct-to-consumer (like a standalone mood tracker or meditation tool), it is typically not bound by HIPAA, but rather by Federal Trade Commission (FTC) guidelines and state laws.
   • Teletherapy platforms that connect you with licensed clinicians (e.g., platforms providing formal medical treatment) are much more likely to be covered entities under HIPAA and should readily provide a signed Business Associate Agreement (BAA) if used in an enterprise or institutional context.
2. Audit the Privacy Policy for Data-Sharing and Trackers
   • Look specifically at whether the platform sells, rents, or shares personal data with third-party advertisers, analytics companies, or social media pixels (e.g., Meta/Google trackers).
   • Review independent security evaluations. Organizations like the Mozilla Foundation's Privacy Not Included guide explicitly score and review popular mental health and teletherapy apps for security vulnerabilities, encryption standards, and data-sharing behavior.
3. Examine Data Security and Encryption Standards
   • Verify whether the platform uses end-to-end encryption (E2EE) for video sessions, text messages, and stored journal entries or therapy notes.
   • Check if data is encrypted both in transit (using HTTPS/TLS) and at rest (stored securely on servers).
4. Review User Controls and Data Deletion Rights
   • Assess how easily you can download, export, or permanently delete your complete history, account data, and intake questionnaires.
   • Avoid platforms that allow registration through weak security pathways or third-party social log-ins that can cross-contaminate your identity profile with your browsing or social media data.

If you'd like, let me know:

• The names of the specific apps or platforms you are comparing
• Whether you are using them for independent self-care or live video therapy

I can help you look into their specific privacy standing and data policies.

Comparing HIPAA compliance and data privacy practices among mental health apps and teletherapy platforms requires looking past marketing claims. Many consumer-facing apps operate in a regulatory gray area, meaning they may not legally be bound by HIPAA unless they are acting directly as a "covered entity" (like a healthcare provider) or a "business associate."

A structured, step-by-step approach can help evaluate and compare these platforms effectively:

1. Check for a Business Associate Agreement (BAA)
   The gold standard for HIPAA compliance is whether a platform is willing to sign a BAA. Consumer wellness apps (like general mood trackers or AI journaling tools) typically do not sign BAAs with users, meaning they aren't legally bound to protect your data under HIPAA standards. Dedicated teletherapy platforms used by licensed medical professionals are much more likely to offer this.
2. Consult Independent Privacy Guides and Audits
   Independent consumer watchdogs evaluate app safety and data-sharing behavior. Review resources like the Mozilla Foundation's Privacy Not Included Project or One Mind Psyberguide to see how specific apps rank regarding data sharing, tracking SDKs, and encryption.
3. Inspect the Privacy Policy for Data Monetization
   Read the fine print regarding third-party sharing. Look specifically at whether the platform shares user inputs, assessment scores, or browsing data with ad networks, social media pixels (like Meta Pixel), or data brokers. (Major platforms like BetterHelp have faced Federal Trade Commission penalties for sharing sensitive health data with advertisers).
4. Verify Technical Security Safeguards
   A compliant or secure platform should explicitly document:
   • Encryption: Data must be encrypted both at rest (stored on their servers) and in transit (while being sent or streamed).
   • Access Controls: Support for multi-factor authentication (MFA) and strict role-based access.
   • Data Rights: Clear options allowing you to permanently delete your account and wipe your stored data from their servers.

If you have a specific app or platform in mind, tell me its name and I can help look up its recent privacy evaluations or compliance history.

The key is to separate “HIPAA compliance” from overall privacy. A mental-health app can have strong privacy protections without being HIPAA-covered, and a statement that an app is “HIPAA compliant” does not by itself tell you how much data it collects or shares. HIPAA generally applies to covered health-care entities and their business associates—not every consumer health app.

A practical comparison framework

For each app or teletherapy platform, compare these categories:

The American Psychiatric Association specifically recommends asking about the app's privacy policy, data collected, HIPAA claims and BAA, de-identification, opt-outs, deletion, cookies, third-party sharing and cloud storage.

Don't treat “HIPAA compliant” as the whole answer

This is probably the most important distinction.

If you're using a therapist's telehealth service and the technology provider is acting as the therapist's business associate, HIPAA protections may apply to the relevant protected health information. By contrast, information that a consumer voluntarily enters into an app that isn't a covered entity or business associate generally isn't protected by HIPAA merely because it concerns mental health.

Non-HIPAA apps aren't necessarily unregulated, though. The FTC's Health Breach Notification Rule can apply to certain health apps and personal health-record companies and requires notification following qualifying breaches of unsecured identifiable health information.

Also be skeptical of marketing language. The FTC warns companies against making misleading claims such as “HIPAA Certified” or “HIPAA Secure.”

Compare the actual privacy policies

For popular services, don't rely on a third-party “HIPAA apps” list. Open each company's current:

• Privacy Policy
• HIPAA Notice of Privacy Practices, if applicable
• Consumer Health Data Privacy Policy
• Terms of Service
• Security documentation
• Data deletion/account-closure documentation

For example, Headspace currently states that it is subject to HIPAA in its role as a business associate to its care providers, while its medical services have a separate HIPAA Notice of Privacy Practices. Headspace Headspace That illustrates why it's important to determine which service/product and which relationship with the provider you're evaluating rather than assigning one HIPAA label to an entire company.

A simple scoring system

You can make a spreadsheet and score each platform from 0–2 in each category:

• 0 = poor/unclear
• 1 = reasonable
• 2 = strong/explicit

I'd give extra weight to:

1. Third-party sharing
2. Advertising/tracking
3. Secondary use of health data
4. Ability to delete data
5. Encryption/security controls
6. HIPAA/BAA status when receiving clinical care
7. Clarity of the privacy policy

This is broadly consistent with established mental-health-app evaluation criteria, which include whether sensitive data are collected, whether security practices are explained, whether users can opt out/delete data, where data are stored, and which third parties receive them.

One useful rule of thumb

For actual therapy, prioritize the privacy protections surrounding the clinical relationship—not merely the consumer app's privacy label. For a self-help app, scrutinize what happens to your data even more carefully because HIPAA may not apply.

And don't assume that “anonymous,” “de-identified,” or “encrypted” means “private.” Ask what can be linked back to you, who has access, and for what purposes the information can subsequently be used. The APA likewise recommends looking beyond an app-store description and examining the company's privacy practices and evidence for its claims.

If you want, I can also make a side-by-side comparison of specific popular platforms (e.g., BetterHelp, Talkspace, Headspace, Calm, Teladoc, and a few others), including their current HIPAA status, data-sharing practices, tracking, deletion options, and privacy-policy red flags.

Comparing HIPAA compliance and data privacy practices among mental health apps and teletherapy platforms requires looking past marketing claims . Many direct-to-consumer wellness apps are not legally bound by HIPAA because they operate outside traditional healthcare provider networks.

A structured approach helps evaluate and compare these platforms effectively:

• Check the Legal Status and Covered Entity Scope: Determine if the platform is a "covered entity" (like a digital portal tied directly to a healthcare provider) or a consumer wellness app. Consumer apps usually fall under Federal Trade Commission (FTC) jurisdiction rather than HIPAA, meaning they have fewer strict federal mandates on data disclosure.
• Review Independent Privacy Guides and Audits: Consult established, third-party consumer reports. For instance, the Mozilla Foundation's *Privacy Not Included Guide explicitly evaluates mental health and wellness apps for data tracking, sharing, and security standards.
• Examine the Privacy Policy for Data Monetization: Read the fine print to see if the platform sells, rents, or shares de-identified data or user behavior metrics with third-party advertisers, social media pixels, or analytics firms.
• Verify Business Associate Agreements (BAAs): If you are using a teletherapy platform through a licensed therapist, confirm whether the company signs a BAA. A BAA is a legally binding contract required under HIPAA that holds the software vendor accountable for protecting your Protected Health Information (PHI).
• Assess Technical Security Measures: Look for explicit commitments to end-to-end encryption for video and messaging, multi-factor authentication (MFA) availability, and clear data deletion or export options.

If you'd like, let me know:

• The specific names of the apps or platforms you are considering
• How you plan to use them (self-guided tools vs. live video therapy with a licensed professional)

I can help you look into their specific data-sharing practices and compliance standing.

The key is to separate “HIPAA-covered” from “private”. They overlap, but they are not the same thing. HIPAA generally applies to covered health-care providers, health plans, clearinghouses, and their business associates—not automatically to every consumer mental-health app. HHS specifically warns that information voluntarily entered into a consumer app that isn't offered by a HIPAA-regulated entity generally isn't protected by HIPAA.

A practical comparison framework

When comparing popular apps and teletherapy platforms, look at these dimensions:

Don't stop at a "HIPAA compliant" badge

For example, Talkspace currently states that its technology is HIPAA compliant and describes encryption and annual assessments. Its current Notice of Privacy Practices also explains that Talkspace can act as a HIPAA business associate for independently contracted providers or as a covered entity when services are provided directly by Talkspace employees.

Headspace similarly distinguishes between its general platform privacy practices and its health-care services: its privacy policy says Headspace is subject to HIPAA as a business associate of its care providers, while Headspace Medical has its own HIPAA Notice of Privacy Practices.

That's much more informative than simply seeing the words “HIPAA compliant.” The FTC specifically cautions companies against misleading claims such as “HIPAA certified” or “HIPAA secure,” and stresses that consumers should understand what health data is collected, how it is used, where it goes, and how long it is retained.

Compare the privacy policies, not just the marketing pages

For each service, I'd make a one-page scorecard:

• HIPAA coverage: Yes / No / Depends on service
• BAA: Yes / No / Not applicable
• Therapy-session data: collected? retained?
• Therapy messages: collected? retained?
• Advertising use: None / limited / targeted
• Third-party sharing: None / vendors / marketing / other
• AI training: Yes / No / opt-out
• Deletion: available? exceptions?
• Encryption: transit / at rest
• Breach notification: described?
• Employer/insurer access: what exactly is disclosed?
• Privacy-policy clarity: easy to understand / ambiguous

Then give each category a simple 0–2 score rather than trying to determine which company is universally “most private.”

One especially important distinction

A non-HIPAA app isn't necessarily unregulated. The FTC's Health Breach Notification Rule can cover certain health apps that aren't subject to HIPAA, and the FTC says its 2024 amendments clarified the rule's application to many health apps and similar technologies.

So a good comparison asks:

“What legal protections and contractual promises govern my data in this particular service?” rather than simply:

“Is this app HIPAA compliant?” Finally, remember that device-level privacy matters too. HHS notes that HIPAA generally doesn't protect health information simply because it is stored on your personal phone or tablet, and other app/device companies may collect information outside HIPAA's scope.

If you're comparing specific services such as BetterHelp, Talkspace, Headspace, Calm, Cerebral, and traditional telehealth providers, I can also build a current side-by-side privacy/HIPAA comparison using their actual policies.

Comparing HIPAA compliance and data privacy practices among mental health apps and teletherapy platforms requires looking past marketing claims.

Because the U.S. Department of Health and Human Services (HHS) does not officially "certify" consumer software or issue a universal compliance badge, users and evaluators must systematically audit platforms across legal, technical, and operational dimensions.

Step 1: Consult Independent Trust & Privacy Guides

Before diving into legalese, check expert security audits that specifically rate consumer mental health technology:

• Explore the Mozilla Foundation's Privacy Not Included Guide to see if specific apps have received warning labels for tracking, data-sharing, or weak password requirements.
• Review independent academic and consumer health tech evaluations (such as the American Civil Liberties Union (ACLU) Privacy Analysis ) which break down hidden third-party tracker integrations in popular platforms.

Step 2: Key Criteria for Comparison

When contrasting two or more platforms, structure your evaluation around these core pillars:

1. The Business Associate Agreement (BAA) Policy
   • The Test: Does the platform explicitly sign a BAA—a legal contract required under HIPAA outlining responsibility for protected health information (PHI)—with users or enterprise healthcare providers?
   • The Reality: Direct-to-consumer wellness apps often explicitly state in their Terms of Service that they are not a covered entity under HIPAA and do not sign BAAs, meaning your chat logs and mood inputs are legally treated like casual social media data.
2. Data Tracking and Third-Party Sharing
   • The Test: Do they embed analytics tools, marketing pixels (like Meta/Facebook pixels), or software development kits (SDKs) that leak de-identified or behavioral data to third-party ad tech?
   • How to check: Read the privacy policy specifically looking for sections on "how we use your information" or "analytics and advertising partners." Many non-compliant apps share "anonymized" telemetry, which can still re-identify vulnerable users.
3. Encryption Standards (In Transit and At Rest)
   • The Test: Is data encrypted end-to-end using robust protocols (e.g., TLS 1.2 or higher for transmission, AES-256 for data at rest)?
   • Where to look: Look for a dedicated "Security" or "Trust" center page rather than just the generic privacy policy.
4. Data Retention and Deletion Policies
   • The Test: How long do they keep your session transcripts or assessment inputs, and does deleting your account permanently wipe your records from their servers?
   • The Reality: Many apps have opaque data retention timelines because non-HIPAA health apps aren't bound by strict medical record retention/destruction mandates.

Step 3: Build a Side-by-Side Comparison Matrix

To make a clear evaluation, create a simple checklist matrix mapping out your shortlisted platforms:

If you have specific apps or platforms in mind (e.g., Talkspace, BetterHelp, Wysa, or Calm), let me know their names and I can help you look up their specific documented privacy findings and compliance postures.

A user can compare HIPAA compliance and data privacy practices among mental health apps and teletherapy platforms by looking beyond a simple “HIPAA compliant” label. HIPAA status is only one part of the picture: some apps handle protected health information (PHI) as healthcare providers or business associates, while others may collect sensitive mental health data without being covered by HIPAA in the same way.

1. First determine what “HIPAA compliant” actually means

Create a distinction between:

• HIPAA-covered teletherapy services: Platforms that connect users with licensed providers or operate on behalf of healthcare organizations may have HIPAA obligations.
• Consumer mental health apps: Meditation, mood tracking, journaling, or chatbot apps may not be HIPAA-covered entities or business associates, even if they collect very sensitive information.

Questions to ask:

• Does the company say it is a HIPAA covered entity, a business associate, or simply “HIPAA compliant”?
• Will a therapist’s records be stored in the platform?
• Does the platform sign a Business Associate Agreement (BAA) with healthcare providers? A BAA is an important indicator when a vendor handles PHI on behalf of a covered entity.

2. Compare privacy policies side by side

Make a table for each platform:

Health apps can collect information outside traditional medical records, and privacy protections may differ depending on the app’s relationship to healthcare providers.

3. Evaluate security practices

Look for:

• Encryption in transit and at rest
• Multi-factor authentication
• Security audits or certifications (such as SOC 2 or ISO 27001, if applicable)
• Employee access controls
• Breach notification policies
• Independent security testing

A platform should clearly explain how it protects sensitive information rather than relying only on marketing language.

4. Check therapist and clinical data handling

For teletherapy platforms, compare:

• Are therapy notes stored by the platform or only by the clinician?
• Who owns the records?
• Can users download their records?
• Are messages between therapist and client encrypted?
• Are sessions recorded? If so, why and how are recordings protected?

5. Review third-party tracking and analytics

Look for disclosures about:

• Cookies and tracking pixels
• Advertising SDKs in mobile apps
• Analytics providers
• Data shared from sign-up pages or symptom questionnaires

Tracking technologies can create privacy concerns when sensitive health information is shared with third parties, especially for HIPAA-regulated entities.

6. Compare user controls

Higher-privacy platforms typically offer:

• Clear privacy settings
• Opt-outs where legally available
• Easy account deletion
• Data export tools
• Transparent consent choices

Useful questions:

• Can I delete my account without contacting support?
• Can I remove my therapy history?
• Can I disable optional data collection?

7. Look for independent reviews and complaints

Useful sources include:

• Regulatory enforcement actions
• Security breach announcements
• Consumer privacy reviews
• App store reviews (especially complaints about billing, data, or account deletion)

Example comparison scorecard

A user could score each platform from 1–5:

A platform with a strong HIPAA posture may still collect more data than a privacy-focused competitor, and a non-HIPAA consumer app may still have good security practices. The key is matching the platform’s privacy model to how sensitive the information is and how much control the user wants over their data.

Comparing HIPAA compliance and data privacy practices across mental health apps and teletherapy platforms requires looking past marketing language and examining technical safeguards, legal frameworks, and third-party data sharing. Because many consumer-facing wellness apps fall outside of HIPAA jurisdiction, a structured evaluation framework is essential.

1. Determine HIPAA Applicability (The BAA Test)

• HIPAA-Covered Entities vs. Consumer Apps: HIPAA only applies if the platform is a covered entity (like a traditional healthcare provider) or a business associate, and if they process Protected Health Information (PHI) on behalf of a provider. Most self-care, meditation, or mood-tracking apps are consumer tech products , meaning they are regulated by the FTC—not HIPAA—and are subject to weaker federal oversight unless data leaks trigger the FTC Health Breach Notification Rule.
• Business Associate Agreements (BAAs): A genuine teletherapy or psychiatry platform must be willing to sign a BAA. If a platform cannot or will not state in writing that they sign BAAs for clinical use, they are not HIPAA compliant.

2. Inspect Data Sharing and Third-Party Trackers

• SDKs and Trackers: Many apps embed analytics and marketing software development kits (SDKs) that leak user activity, search habits, or questionnaire responses to entities like Meta, Google, or data brokers.
• Specialized Evaluators: Utilize expert evaluation resources that specialize in behavioral tech privacy:
  • Review independent audits from Mozilla's Privacy Not Included guide, which explicitly flags whether mental health apps sell or share data.
  • Consult One Mind PsyberGuide , an expert-backed evaluation platform that scores mental health apps specifically on privacy, data security, and credibility.

3. Audit Technical Security Controls

• Encryption Standards: Verify whether data is encrypted both in transit (via TLS 1.3 or higher) and at rest (AES-256 or end-to-end cryptographic isolation).
• Access Controls & Authentication: Check if the platform enforces Role-Based Access Control (RBAC), automatic session timeouts, and mandatory Multi-Factor Authentication (MFA) for administrative and clinical portals.
• AI & Zero-Retention Policies: If the platform uses AI chatbots or automated note-taking, check for a zero-retention inference policy —ensuring prompts and conversation logs are processed ephemerally and never fed into public LLM training sets.

Community Perspectives

Users and digital rights advocates frequently note that consumer mental health tools often fail basic user trust expectations regarding data handling:

“Mozilla's mental health apps investigation returned dismal results, with researchers saying that mental health apps were ‘worse than any other product category’ when it comes to privacy and security.”

“Many other apps were packed with trackers, with the app Cerebral setting a new record for number of trackers: 799 within the first minute of download.”

If you have a specific app or platform in mind , let me know its name. I can help you look into its privacy policy, tracking disclosures, and compliance standing.

The key is not to treat “HIPAA-compliant” as synonymous with “private.” HIPAA applies only in particular contexts—typically when a provider is a covered entity or a platform is acting as its business associate. A consumer wellness app may hold highly sensitive mental-health information without being subject to HIPAA in the same way. HHS explicitly notes that HIPAA generally does not protect information a person voluntarily enters into a non-HIPAA-regulated app, although other laws, including the FTC's Health Breach Notification Rule, may apply.

A practical comparison framework

For each app or teletherapy platform, check these categories:

1. Separate the therapy service from the wellness app

This is especially important with companies that offer both meditation/wellness products and clinical care.

For example, Headspace currently says its U.S. care providers are HIPAA-covered entities and Headspace acts as their business associate. Its separate consumer-health-data policy also addresses information covered by state consumer-health privacy laws.

So instead of asking “Is Headspace HIPAA compliant?”, ask:

“Which Headspace service am I using, who is the healthcare provider, and which of my data is covered by HIPAA?” That's a much more useful question.

2. Read the HIPAA Notice and the ordinary Privacy Policy

Don't stop at a company's HIPAA statement.

The HIPAA notice tells you what happens to PHI within the HIPAA framework. The broader privacy policy may describe other personal information—such as account information, device information, website activity, advertising/analytics data, or inferences—that can be governed by different rules.

Talkspace, for example, distinguishes between its HIPAA Notice of Privacy Practices and its broader Privacy Policy. Its current notice says that, depending on the service arrangement, Talkspace can act as a HIPAA business associate or covered entity.

3. Pay particular attention to tracking and advertising

This is one of the easiest things to overlook.

HHS says that identifiable health information collected through a regulated entity's website or app can constitute PHI, including information transmitted to tracking-technology vendors.

For a consumer app outside HIPAA, however, different rules may apply. The FTC's Health Breach Notification Rule can cover certain health apps that aren't HIPAA-regulated.

Look specifically for language concerning:

• Google/Meta/TikTok advertising pixels
• analytics SDKs
• targeted advertising
• sale or sharing of personal information
• “business purposes”
• “affiliates”
• data brokers
• combining health information with other datasets
• AI/model training

4. Compare retention, not just security

A company can have excellent encryption and still retain your information for a very long time.

Ask:

“If I stop using the service today, what happens to my messages, assessments, recordings, transcripts, and account information?”

This can produce substantial differences between providers. For example, Talkspace says its therapy transcripts are treated similarly to medical records and retained for 10 years.

Also determine whether “deletion” means actual deletion or merely removal from the active account while legally required records remain archived.

5. Examine employer and insurance arrangements

An employer-sponsored mental-health benefit deserves special scrutiny.

Ask:

“Can my employer or health plan see that I used the service?” and separately:

“Can they see what I discussed with my therapist?” These aren't necessarily the same thing.

Headspace, for example, says its Headspace Care service does not share an individual's activity, signup information, or private data with the health plan, instead providing aggregated/anonymized reports.

6. Look beyond the word “HIPAA”

Useful security indicators include:

• SOC 2 Type II
• ISO 27001/27002
• HITRUST
• documented risk assessments
• encryption at rest and in transit
• strong authentication
• access controls/audit logging
• penetration testing
• independent security assessments
• documented breach-response procedures

These don't automatically make a service better, but they provide additional evidence about its security program. Headspace, for example, says its security program aligns with HIPAA, HITRUST, SOC 2 Type II, and ISO 27001/27002.

A simple scoring system

For a personal comparison, you could score each platform 0–2 in six areas:

1. HIPAA coverage — 0 none/unclear, 1 partial, 2 clearly applicable to the service
2. Data minimization — 0 extensive collection, 1 moderate, 2 minimal
3. Secondary use — 0 broad sharing/advertising, 1 restrictions unclear, 2 strong restrictions
4. Security — 0 little evidence, 1 reasonable controls, 2 strong independently validated controls
5. Retention/deletion — 0 indefinite/unclear, 1 mixed, 2 clear and limited
6. Transparency/user control — 0 poor, 1 moderate, 2 strong

I'd also give extra weight to secondary data use and third-party sharing. A platform can be technically HIPAA-compliant while its overall privacy practices still aren't what a privacy-conscious user expects.

Finally, read the current policies immediately before signing up. Privacy policies, vendors, AI practices, and legal requirements change. For the regulatory side, HHS's current mobile-health guidance and the FTC's Mobile Health Apps Interactive Tool are particularly useful starting points.

If you want, I can also make a side-by-side 2026 comparison of BetterHelp, Talkspace, Headspace, Calm, and major teletherapy alternatives, focusing specifically on HIPAA status, data sharing, AI use, advertising/tracking, retention, and deletion.

“Can my employer or health plan see that I used the service?” and separately:

“Can they see what I discussed with my therapist?” These aren't necessarily the same thing.

Headspace, for example, says its Headspace Care service does not share an individual's activity, signup information, or private data with the health plan, instead providing aggregated/anonymized reports.

6. Look beyond the word “HIPAA”

Useful security indicators include:

HHS says that identifiable health information collected through a regulated entity's website or app can constitute PHI, including information transmitted to tracking-technology vendors.