Who Owns Your Mental Health Data?

You tell your therapist things you've never told anyone. Your fears, your trauma, your relationship dynamics, your intrusive thoughts. It's the most intimate information that exists about you.

But do you know who owns it?

The Short Answer: Probably Not You

In most U.S. states, your therapist or their practice owns your medical records. Not you.

You have a right to access your records under HIPAA. You can request copies. But ownership — who controls the original records, how long they're kept, where they're stored, and what happens to them if the practice closes — belongs to your provider.

This matters more than most people realize.

What Happens to Your Records When...

Your therapist retires or closes their practice

State laws require providers to retain records for a minimum period (typically 7 years for adults, longer for minors). After that, records can be destroyed. If your therapist retires, they're supposed to notify patients and arrange for records to be transferred or stored. In practice? It's often messy.

Records end up in storage units, on old hard drives, or simply lost. If you need them five years later — for a new provider, an insurance dispute, or a legal matter — good luck.

You switch EHR systems

If your therapist's practice migrates from one electronic health record system to another, your data may not transfer cleanly. Fields get dropped, notes get reformatted, and the nuance of years of clinical documentation can be compressed into a generic summary.

You use a mental health app

This is where it gets concerning. Many mental health apps — mood trackers, journaling tools, chatbot therapy — are not covered by HIPAA. If the app isn't provided by a covered entity (a healthcare provider or health plan), HIPAA doesn't apply.

That means:

• Your data can be sold to advertisers or data brokers
• Your anxiety diagnosis could theoretically affect your insurance rates
• The app company can change their privacy policy at any time
• If the company goes under, your data goes with it (or gets sold as an asset)

The FTC has taken action against several mental health apps for sharing sensitive health data without adequate consent. BetterHelp paid $7.8 million in 2023 for sharing patient data with advertisers including Facebook and Snapchat.

Your Rights Under HIPAA

HIPAA gives you specific rights regarding your protected health information (PHI):

1. Right to access — You can request a copy of your records. Your provider must respond within 30 days.
2. Right to amend — If you believe something in your record is incorrect, you can request a correction.
3. Right to an accounting of disclosures — You can ask who your data has been shared with.
4. Right to restrict — You can ask your provider to limit how your data is used or disclosed (though they don't always have to comply).
5. Right to confidential communication — You can ask your provider to communicate with you in a specific way (e.g., only by email, not by phone).

What HIPAA does not give you: ownership, portability (like you'd have with a bank account), or the ability to delete your records.

Why This Matters Now

Mental health data is uniquely sensitive. It's not like a blood pressure reading or a cholesterol level. It's:

• Your trauma history
• Your relationship and family dynamics
• Your substance use
• Your suicidal ideation history
• Your sexual history
• Your fears, vulnerabilities, and coping mechanisms

As more of this data becomes digital — and as AI tools enter behavioral health — the question of who controls it becomes urgent.

What You Should Do

1. Ask your therapist three questions

• "Where are my records stored?" (EHR system? Paper? What happens if you close your practice?)
• "Who else has access to my records?" (Billing companies? Supervisors? Other providers?)
• "What happens to my data if I stop treatment?"

2. Request your records now

Don't wait until you need them. Request a copy of your records while your provider is active and accessible. You have the right to receive them in the format they're maintained (usually PDF or printout).

3. Check your mental health apps

If you use any mental health app — mood tracking, journaling, meditation, therapy chatbots — check:

• Is it HIPAA compliant? (Look for a BAA, not just a privacy policy)
• Does it sell or share data with third parties?
• Can you export and delete your data?

4. Build your own source of truth

The safest version of your mental health data is the one you control. Consider keeping your own private records — session summaries, progress notes, medication changes, and how you're actually feeling over time.

Platforms like Mozu Health are building tools for exactly this — private, encrypted AI session summaries that you own and control. No one reads them. No one sells them. You can share them with your provider or keep them entirely private.

Because in a world where your mental health data is increasingly valuable to researchers, insurers, and advertisers, the most important thing is that you have access to it — on your terms.

The Future: Patient-Owned Mental Health Data

The healthcare industry is slowly moving toward patient data ownership. The 21st Century Cures Act and information blocking rules are pushing providers to share data more freely. FHIR standards are making health data more portable.

But behavioral health is behind. Most therapy practices still operate on systems where your data is locked inside your provider's EHR, inaccessible to you in any meaningful way.

The practices and platforms that put patient data ownership first — that give you not just access but control — are the ones worth choosing.

Your mental health data is the most sensitive information that exists about you. Start treating it that way.

---

Mai Shimada, MD is the founder of Isha Health and Mozu Health. She is a physician advocate for patient data ownership and HIPAA-compliant AI in behavioral health.