What HIPAA actually protects (and what it doesn’t)

Most of what people think HIPAA covers, it doesn’t. And most of what people actually worry about when they think about HIPAA isn’t even a HIPAA question. The acronym became cultural shorthand for “medical privacy in general,” but the law itself is narrower than that, and the parts where it doesn’t apply are usually the parts that matter most to the guy sitting across the desk asking whether seeing a psychiatrist is about to cost him his job, his gun, or his kids.

What HIPAA actually does

HIPAA stands for the Health Insurance Portability and Accountability Act, a 1996 federal law with a privacy section that governs how “covered entities” handle “protected health information.” Covered entities are hospitals, clinics, insurers, and the contractors they pay to do specific things on their behalf (called business associates). The law says those entities can’t sell your records, can’t share them outside specific exceptions for treatment, can’t disclose them to third parties without your authorization, and that they have to give you access to your own records when you ask for them. It’s a privacy framework for the formal healthcare system, not a global gag order on everyone who happens to know you’ve been to therapy.

If you tell your boss you’re on Lexapro (a common SSRI antidepressant), and your boss tells someone else, that isn’t a HIPAA violation, because your boss isn’t a covered entity. If your wife reads your discharge summary off the kitchen counter and tells her sister, also not a HIPAA violation, same reason. If your cousin who works in IT at a hospital pulls up your chart out of curiosity, that absolutely is a HIPAA violation, and a serious one, because she’s an employee of a covered entity acting outside the scope of treatment. The fact pattern matters. The shorthand “is that a HIPAA violation” question doesn’t always have the answer the person asking thinks it does.

Where it doesn’t apply at all

HIPAA doesn’t cover therapy apps and direct-to-consumer mental health platforms that aren’t structured as covered entities. BetterHelp, Talkspace, Cerebral all have their own privacy policies but they aren’t bound by HIPAA the same way your local clinic is, unless they’ve specifically structured a piece of their business to be a covered entity (some of them have, partially, for the parts involving insurance billing). The BetterHelp settlement with the Federal Trade Commission in 2023 was for sharing user data with Facebook for advertising targeting, which is the kind of thing HIPAA would prohibit at a hospital and which wasn’t prohibited the same way at a direct-to-consumer therapy app. That’s the gap the FTC stepped into because nobody else was going to.

HIPAA also doesn’t cover what you tell your friends, what you put on social media, or what you write in a Substack about your own diagnosis. People disclose their own protected health information all the time and HIPAA has nothing at all to say about it. If you tell your CrossFit class you’re on Adderall, that’s not a HIPAA situation, that’s you telling your CrossFit class you’re on Adderall.

Guns and licensure, which is the question I get most

This is the big one. The vast majority of guys who hesitate to see a psychiatrist are hesitating because somewhere in the back of their head is the idea that mental health treatment ends with losing their guns, or their CDL (commercial driver’s license, the trucking license a lot of guys in OR/WA depend on for income), or their concealed carry, or their job. The short answer is that going to a psychiatrist doesn’t show up on a background check. Taking a psychiatric medication doesn’t show up on a background check. Even being voluntarily admitted to a psychiatric unit usually doesn’t show up on a background check.

What does show up is being involuntarily committed to a psychiatric facility through a civil court process, or being adjudicated by a court as a danger to yourself or others. That gets reported to the National Instant Criminal Background Check System in most states, and it’s a federal prohibition on firearm purchase under 18 USC 922(g)(4), which is the federal statute. Voluntary treatment, outpatient treatment, and being on medications don’t trigger any of that. The bar to losing your right to buy a gun in this country is meaningfully higher than “saw a shrink.”

The professional licensure piece varies by state and by profession. In Oregon and Washington, the medical and nursing boards have narrowed their mental health questions substantially over the last decade, and they mostly ask whether you have a current condition that impairs your ability to practice safely. Past treatment isn’t generally something you have to disclose. CDL licensure for commercial drivers has its own rules under the federal DOT (Department of Transportation) medical card process, and certain medications, particularly benzodiazepines and some stimulants, can complicate getting the card recertified. Most antidepressants, mood stabilizers, and non-stimulant ADHD medications are fine for the DOT card. If you’re in any of those professions and you’re worried, get the actual answer from the actual licensing board (or from a lawyer who does this kind of work) instead of letting your friend’s uncle who knows a guy decide for you.

The military, security clearances, and certain federal employment slots have stricter frameworks, and those conversations are real. If you’re applying for a TS/SCI (top-secret with sensitive compartmented information access, the high-end clearance category), the disclosure rules around mental health treatment aren’t the same as they’re at most jobs, and that conversation is worth having with somebody who knows that system before you start treatment, not after.

School disclosures, because parents ask

FERPA, not HIPAA, governs most education records. FERPA is the Family Educational Rights and Privacy Act, the 1974 federal law that protects student records. If your kid is in a public school and getting mental health services through the school counselor’s office, those records are FERPA-governed and a different set of rules applies. Schools can share certain records with other school personnel and sometimes with law enforcement under specific circumstances without parental consent. Schools generally can’t share with employers, colleges, or third parties without parental or student consent.

If your kid is being evaluated for special education services, the IEP (Individualized Education Program, the legal document that lays out what services a kid is entitled to) process generates records that follow him through the system into other schools, sometimes through college accommodations decisions, sometimes into early adulthood depending on what gets requested. Those records are FERPA-governed and parents have rights to review and challenge them. Mental health diagnoses inside those records can affect school placement, accommodations, and disciplinary procedures, which is mostly the point of having them, but can also follow your kid in ways some parents don’t fully anticipate when they consent to the initial evaluation. Worth asking what the records say and where they go before you sign.

The pattern that comes up

The uniformed-services guy who finally shows up (deputy, paramedic, firefighter, active-duty) is usually carrying a moderate depression after a partner’s suicide on the job, or a kid he couldn’t save, or some other weight the job hands out that nobody talks about, deputy sheriff or paramedic or firefighter or active-duty military, who’s been quietly hauling around a moderate depression for a year, a kid he couldn’t save, some other weight the job hands out that nobody really talks about. The first three sessions are almost entirely about whether seeing a psychiatrist is going to cost him his job. He’s grown up with the assumption that going to a shrink means turning in your gun and your badge, and a lot of his coworkers reinforce that assumption because they think it’s true too.

The actual walk-through is undramatic. His department’s fitness-for-duty process is triggered by performance issues, near-misses, or direct concerns reported up the chain, not by self-referral to outpatient mental health. His state licensure as a peace officer or paramedic isn’t at risk for being on Zoloft (sertraline, a common SSRI). His department’s Employee Assistance Program (the confidential short-term counseling benefit most agencies offer, called EAP) is confidential in the same way other outpatient therapy is, and the EAP can refer him to a real therapist whose visits are also confidential. He starts the medication, does a few months of CBT (cognitive behavioral therapy, the worksheet-and-thought-record kind) with somebody his EAP referred him to, and stays on the job.

Here’s what actually happens when he tells his sergeant: when he eventually tells his sergeant, more often than not, the sergeant says some version of “I’ve been on Zoloft for eight years, two of the lieutenants are on it too, I’m glad you said something.” Because the rumor that uniformed services are full of guys quietly carrying things they shouldn’t be is true, and so is the rumor that more of them are getting treatment than anyone admits. Wait, can you say that out loud… yeah, because most departments would actually rather you say it out loud than have you grind through it for two years and then crash out catastrophically.

The custody question

Custody disputes are the other place where the HIPAA-versus-not-HIPAA confusion gets ugly. Your therapy and medication records can in some circumstances be subpoenaed in a custody case, depending on the state and the specifics. The standard for getting them released is usually higher than just asking, and a decent family-law attorney can fight a fishing expedition pretty effectively. But the rumor that “if you go to therapy your ex can use it against you” is exaggerated enough that a lot of guys avoid treatment that would have helped them stay sane through the divorce. Future you is either going to thank you or call you a dick about that decision. The version of you who held it together through the custody process tends to thank you.

Going to a psychiatrist doesn’t show up on a background check. Taking a psychiatric medication doesn’t show up on a background check. Most of what people think HIPAA covers, it doesn’t.

The thing the rumor mill keeps getting wrong

The general pattern across all of this is that the rumor is more conservative than the law. The rumor says you’ll lose your gun, your badge, your CDL, your custody, your clearance, your job. The actual law mostly says you won’t, for routine voluntary outpatient care, in 2026, in most jurisdictions. There are real exceptions and they tend to involve the high-clearance world or commercial driving on certain medications, and for those the right move is to ask the licensing body or a lawyer who does that work, not to assume the worst and avoid treatment that could meaningfully help you.

The cost of acting on the rumor is the depression you keep carrying around, the marriage that quietly fails because you’re not present, the years you don’t get back. The cost of getting the actual answer is one phone call to your department’s HR or your licensing board, asked anonymously, and then a real decision based on real information instead of what your coworker told you over a beer about what happened to a guy three years ago.

Bottom line

HIPAA covers narrower ground than people think. The things people are most often worried about (job, gun, custody, professional license) are mostly governed by other laws, most of which turn out to be more permissive than the rumor suggests. Voluntary outpatient mental health treatment is, almost always, your own business and stays your own business. If you’ve been avoiding care because you weren’t sure, the move is to get the actual answer to the actual question, not to let the rumor do the deciding. The rumor has cost a lot of people a lot of years they didn’t need to lose.

Sources

1. U.S. Department of Health and Human Services. The HIPAA Privacy Rule. 45 CFR Part 160 and Subparts A and E of Part 164.
2. Federal Trade Commission. FTC Action Against BetterHelp on Health Data Sharing. 2023 settlement.
3. National Instant Criminal Background Check System (NICS). Federal Firearms Prohibitions Under 18 USC 922. FBI guidance, 2024.