Telehealth Privacy, Security & Your Rights
Published September 2025 · Written by Paul Paradis, Editor · Educational information – not medical or mental-health advice
Reviewed for educational clarity and safety language by Lisa Lewis, RN, BSN · Updated April 2026
Telehealth privacy is a real concern but a manageable one. Therapy sessions delivered by a HIPAA-covered provider — almost any licensed clinician you find through Headway, Grow Therapy, Rula, Alma, Sondermind, Talkiatry, Talkspace, or Cerebral — are protected by federal privacy law: encryption in transit, secure storage, breach-notification rules, and your right to access your own records. The looser end of the spectrum is the consumer wellness app world (mood trackers, meditation apps, some peer-support tools) where HIPAA may not apply at all and ad-tech data sharing is more common. Two practical questions matter most: is your platform actually a HIPAA-covered entity? and have you hardened your own setup? The single biggest privacy risk for most readers isn't the platform — it's a roommate who hears the session, a session at a coffee shop on public Wi-Fi, or a shared family device with no password. This guide covers HIPAA basics, the publicly-known data-handling posture of the major platforms in plain English, a concrete hardening checklist (2FA, device, network, household), red flags, and your rights if something goes wrong. For broader help, talk to our AI guide, see HIPAA in telehealth, or visit the Insurance & Costs hub.
Understanding HIPAA and Telehealth
The Health Insurance Portability and Accountability Act (HIPAA) is the primary law protecting health information privacy in the United States. Learn more about HIPAA protections for telehealth in our dedicated guide.
What HIPAA Requires
- Privacy Rule: Limits who can access your health information
- Security Rule: Requires safeguards to protect electronic health data
- Breach Notification: Requires notification if your data is compromised
- Patient Rights: Gives you control over your health information
HIPAA-Compliant Telehealth
Legitimate healthcare providers using telehealth must:
- Use secure, encrypted communication platforms
- Protect stored health information
- Train staff on privacy practices
- Provide you with a Notice of Privacy Practices
- Get your consent before sharing information (with limited exceptions)
- Maintain BAAs with all third parties that touch your data
- Implement reasonable safeguards in their workspace
- Provide breach notification if your data is exposed
Reputable platforms like BetterHelp, Talkspace, Teladoc, and Cerebral are designed to meet HIPAA requirements.
Your Privacy Rights
Under HIPAA and related laws, you have the right to:
- Access your records: Request copies of your health information
- Request corrections: Ask to amend inaccurate information
- Know who accessed your data: Get a list of disclosures
- Request restrictions: Ask for limits on how your information is used
- Choose communication methods: Request how and where you're contacted
- File complaints: Report privacy violations to the provider or government
- Receive breach notification: Be told if your data is exposed in a security incident
- Authorize or refuse certain uses: Beyond standard treatment, payment, and operations
- Receive a Notice of Privacy Practices at your first appointment
How Telehealth Platforms Protect Your Data
Technical Safeguards
- Encryption: Data is scrambled during transmission (end-to-end encryption)
- Secure servers: Information stored in protected data centers
- Access controls: Only authorized personnel can view your data
- Audit trails: Systems track who accesses information and when
- Automatic logouts: Sessions end after periods of inactivity
- Network segmentation: Clinical data isolated from marketing systems
- Endpoint protection: Provider devices managed by IT security policies
Administrative Safeguards
- Staff training on privacy practices
- Policies governing data access and use
- Risk assessments and security audits
- Incident response procedures
- Business associate agreements with all third-party vendors that touch PHI
- Required annual training and re-attestation
Physical Safeguards
- Secure data center facilities
- Controlled access to systems
- Proper disposal of data when no longer needed
- Workstation policies for therapists working from home
What Information Is Collected
Telehealth platforms typically collect:
- Personal information: Name, contact details, date of birth
- Health information: Symptoms, diagnoses, treatment plans, medications
- Session content: What you discuss with your provider
- Insurance information: If using insurance coverage
- Payment information: Credit card or bank details
- Technical data: Device information, IP address, usage patterns
- Communication logs: Timestamps of messages and sessions (not always content)
- Engagement metrics: Whether you opened the app, completed exercises, etc.
What's Typically NOT Collected (or Shouldn't Be)
- Video recordings of sessions (unless specifically disclosed)
- Unnecessary personal details
- Information about household members without their consent
- Browsing history outside the platform
- Audio captured outside scheduled sessions
Mental Health Privacy Considerations
Mental health information often has additional privacy protections:
- Psychotherapy notes: May have stronger protections than general medical records. Process notes a therapist keeps separately for their own use have heightened protection under HIPAA and require specific authorization to release.
- Substance abuse records: Federal law (42 CFR Part 2) provides extra protection. SUD records can't be released to law enforcement, employers, or in most legal proceedings without explicit patient consent or specific narrow exceptions.
- State laws: Some states have additional mental health privacy laws layered on top of HIPAA, sometimes more protective.
- Genetic and reproductive health information: Increasingly protected by additional laws in many states.
Exceptions to Confidentiality
Providers may be required to break confidentiality in certain situations:
- Danger to self: If you're at serious risk of harming yourself
- Danger to others: If you pose a credible threat to someone
- Child or elder abuse: Mandated reporting requirements
- Court orders: Legal requirements to disclose information
- Insurance requirements: Information needed for coverage
- Subpoenas with proper legal process
Your provider should explain these limits at the start of treatment in the informed consent document. If you have specific concerns, ask your therapist directly during your first session.
Protecting Your Own Privacy
Steps you can take to protect your telehealth privacy:
During Sessions
- Use a private, secure location where you won't be overheard
- Use headphones to keep audio private
- Close other applications on your device
- Ensure no one else can see your screen
- Mute or turn off smart speakers in the room
- Position the camera so the background reveals only what you intend
- Silence phone notifications during the session
Technology Security
- Use a secure, private Wi-Fi network (not public Wi-Fi)
- Keep your devices updated with security patches
- Use strong, unique passwords for healthcare accounts
- Enable two-factor authentication when available
- Log out completely after each session
- Use full-disk encryption on laptops (BitLocker, FileVault)
- Don't save passwords in shared browser profiles
Account Management
- Review the platform's privacy policy before signing up
- Understand what data is collected and how it's used
- Know how to request your data or delete your account
- Be cautious about what you share in written messages
- Periodically check active sessions and devices in your account settings
- Use a personal email address that only you access for the account
Red Flags in Telehealth Privacy
Be cautious of services that:
- Don't clearly state HIPAA compliance
- Have vague or missing privacy policies
- Sell or share data with third parties for marketing
- Don't use encrypted communications
- Use regular video chat tools (Zoom, Skype) without HIPAA configurations
- Don't allow you to access or delete your data
- Have a history of data breaches without proper notification
- Demand excessive personal information unrelated to clinical care
- Use therapy session content for advertising or product training without clear consent
- Display pop-up ads in the patient portal
Apps and Wellness Tools: Different Rules
Important distinction: Not all health-related apps are covered by HIPAA.
- HIPAA-covered: Services provided by healthcare providers or health plans
- Not HIPAA-covered: Many wellness apps, fitness trackers, meditation apps
- Sometimes covered: An app accessed through your employer's mental-health benefit may be HIPAA-covered for that pathway, while the consumer version of the same app isn't
- FTC-regulated: Even non-HIPAA apps are subject to federal consumer-protection rules; misrepresentations about privacy can be enforced by the FTC
Apps like Calm, Headspace, and general wellness tools may not be bound by HIPAA. Review their privacy policies carefully to understand how your data is used. Some publish detailed transparency pages; some don't.
State Privacy Laws
Some states have additional telehealth and health privacy protections. Review telehealth privacy laws by state to understand what applies where you live.
- California: CCPA/CPRA provides additional data rights including a right to know, delete, and opt out of "sale" or "sharing" of personal information.
- Washington: The My Health My Data Act creates strong protections for non-HIPAA-covered consumer health data.
- Connecticut, Colorado, Utah, Virginia: Comprehensive consumer privacy laws with health-data provisions.
- Other states: Various laws may provide extra protections; the landscape is changing rapidly.
See our guide: Telehealth Laws by State. State telehealth-prescribing rules are tracked separately on telehealth across state lines.
What to Do If Your Privacy Is Violated
- Document the issue: Note what happened and when. Take screenshots of any data exposure or unauthorized communication.
- Contact the provider: Report the concern to the telehealth service's privacy officer. HIPAA-covered entities are required to investigate.
- File a complaint: Report to the HHS Office for Civil Rights (OCR). Federal complaints carry weight.
- Contact your state: State attorneys general may also investigate, especially under newer state privacy laws.
- Consider legal advice: For serious violations, consult an attorney. Class-action firms sometimes pursue large breaches.
- Change passwords on all related accounts even if not directly affected.
- Monitor financial accounts if any payment data may have been exposed.
- Request the breach-notification letter the platform is legally required to provide if PHI was actually exposed.
Questions to Ask About Privacy
Before using a telehealth service, consider asking these questions—or browse our comparison of platforms with strong privacy protections:
- Is this platform HIPAA-compliant?
- How is my data encrypted and stored?
- Who has access to my health information?
- Is any data shared with third parties?
- Are sessions recorded? If so, how are recordings stored?
- How can I access or delete my data?
- What happens to my data if I cancel my account?
- Does the platform use advertising-related tracking on logged-in pages?
- What's the policy on training AI models with patient data?
- How are subcontractors and business associates managed?
- Is the platform certified under any independent privacy or security framework (HITRUST, SOC 2)?
Privacy on Shared and Family Devices
Family devices are one of the most common privacy weak points. Practical steps:
- Create a separate operating-system user account with its own login. This is more isolated than a separate browser profile.
- Set the device to require a password on wake, even after just a few minutes.
- Don't save the therapy account password in any shared password store.
- Use the platform's mobile app on a personal phone for messaging if possible, rather than the family laptop.
- If you must use a family computer, log out fully after every session, clear browser cache, and don't enable "remember me" options.
- Check notification settings so message previews don't pop up on the lock screen for everyone to see.
- For minors and teens on family devices, the same applies in reverse — give them privacy by setting them up with their own user account.
If You Live With Someone You Can't Talk Freely Around
Some readers can't have a private session in their home. The realistic options:
- Parked car. Reliable. Quiet. Private. Many people do this.
- Library private room or study room. Many libraries have free, bookable private rooms with Wi-Fi.
- Friend's home. If you have someone whose home you can borrow for an hour, that works.
- Office or workplace. Some employers offer private wellness rooms; check with HR.
- Outdoors. A park bench at a quiet hour with headphones is private if no one is within audio range.
- A coffee shop with strong headphones as a last resort — only for sessions that don't involve highly sensitive content, since you're audible if you speak above a whisper.
Talk to your therapist about your living situation up front. Most are very used to creative location solutions and can help you plan.
HIPAA Basics in Plain English
HIPAA covers "covered entities": licensed healthcare providers, health plans, and healthcare clearinghouses. Most of the platforms you'd reasonably consider for therapy or psychiatry — including independent therapists running through Headway, Grow Therapy, Rula, Alma, Sondermind, the psychiatrists at Talkiatry, and the clinical operations of Talkspace and Cerebral — are operating as covered entities. That means:
- Your session content is protected health information (PHI). The clinician can't share it without your written authorization, with limited exceptions (court orders, mandatory reporting, imminent danger).
- Encryption is required for PHI in transit and at rest.
- Business associate agreements (BAAs) govern any third-party service that touches PHI — billing systems, EHR vendors, video providers, transcription services. The provider is required to have BAAs in place.
- You have rights: access your records, request corrections, get a list of disclosures, file complaints with HHS Office for Civil Rights.
- Breaches must be disclosed. If your data is exposed, you have to be told.
What HIPAA doesn't cover: a lot of the consumer wellness app market. A mood tracker that isn't operated by a healthcare provider isn't a HIPAA covered entity even if it collects very personal data. Read those privacy policies carefully.
Where the Major Platforms Stand on Data — In Plain English
Each platform's data practices change, and we don't pretend to have insider knowledge — what follows summarizes publicly-known categories of practice based on each platform's published policies and reporting. Always read the current privacy policy before signing up.
BetterHelp
BetterHelp's clinical operations are HIPAA-covered. The published privacy policy describes use of analytics and advertising tools across the platform; in 2023 the FTC reached a public settlement with BetterHelp regarding past advertising-data practices. Today the company publicly states it does not share session content for advertising and limits ad-related data sharing. If you sign up, read the current privacy policy and adjust opt-out controls in your account. The takeaway: your therapy session content has the same HIPAA protections as anywhere else; the historical concern was metadata and advertising-related data, which is something to watch on any large consumer-facing health platform.
Talkspace
Similar HIPAA-covered structure. Public policy describes data collection for service operation, limited sharing for billing where insurance is used, and analytics for product improvement. As with BetterHelp, your clinical content is HIPAA-protected; the area to read carefully is what metadata is collected and how it's used.
Cerebral and Brightside
Both operate clinical services as HIPAA-covered entities. Cerebral has been the subject of regulatory scrutiny over historical prescribing and advertising practices; both companies have published updated privacy policies. As always, the question is what advertising-pixel and analytics data may be collected on the consumer-facing pages versus the authenticated clinical environment.
Insurance-First Platforms (Headway, Grow Therapy, Rula, Alma, Sondermind, Talkiatry)
These operate as HIPAA-covered entities by design — they bill insurance, which forces tight HIPAA compliance. The clinical content lives in HIPAA-compliant EHR systems, billing flows through HIPAA-compliant clearinghouses, and the websites themselves are typically more conservative about advertising-related tracking on logged-in pages. Privacy posture is generally tighter than the subscription consumer brands.
Wellness Apps (Calm, Headspace, Insight Timer, Woebot, etc.)
Most wellness apps are not HIPAA-covered. They may collect substantial data and may share it with third parties for advertising or analytics. Read the privacy policy. Some now publish "trust" pages with detail. If a wellness app is covered by your employer's mental-health benefit, that piece may be HIPAA-covered — but the consumer version often isn't.
The Honest Bottom Line
For a therapy session itself: your content is protected by federal law regardless of which licensed-clinician platform you choose. The variation between platforms is mostly about what metadata they collect on the marketing/account side, not about whether the actual session is private. For the most privacy-conservative posture, insurance-first platforms tend to be tightest because regulators and insurers look closely at their data flows.
The Practical Privacy Checklist (Before Your First Session)
Most privacy issues for everyday users are not platform issues — they're setup issues. Run through this list before your first session and you'll have eliminated 90% of practical risk.
Account & password hygiene
- Use a strong, unique password (not reused from another site). A password manager makes this easy.
- Turn on two-factor authentication (2FA) if the platform supports it. Use an authenticator app rather than SMS where possible.
- Don't use a shared family email address for the account. Use one only you access.
- Set the platform to log out after a period of inactivity.
- Don't save the password in a shared browser profile.
Device
- Use a device only you log into, ideally with a lock screen and full-disk encryption (BitLocker, FileVault).
- Keep the operating system and browser current with security updates.
- If you must use a shared device, use a separate user account with its own password — not just a separate browser profile.
- Don't screenshot or save session content unless you must, and store it encrypted.
Network
- Use a private Wi-Fi network, not public airport/coffee-shop Wi-Fi. Mobile data is fine.
- If you're at home with shared internet, your network is fine; the risk isn't the network itself but other people in the house.
- Avoid VPN on top of telehealth platforms unless you understand it — sometimes VPNs cause connection issues without adding meaningful privacy benefit.
Physical environment
- Use headphones. The single highest-impact privacy step. Audio is the easiest thing to overhear.
- Pick a room with a door that closes. Tell housemates you'll be in a private call for an hour.
- If you live with someone whose presence affects what you can talk about, take the session in a parked car, on a walk, or in a private room you have to yourself for an hour.
- Position the camera so nothing in the background tells more about you than you want.
- Mute the doorbell, smart-speaker, and notifications during sessions.
Recordings & screenshots
- Most reputable platforms do not record sessions by default. Confirm with your therapist on day one.
- If a session is being recorded for any reason (training, supervision), you have the right to know and to consent.
- Don't record sessions yourself unless your therapist agrees; recordings of you may be discoverable in custody, employment, or legal contexts.
- Screenshots of messages with your therapist live somewhere on your device. Treat them like sensitive documents.
Minors and shared devices
- If a teen is using a family device for therapy, set up a separate user account for them with its own password.
- For Teen Counseling specifically, the platform separates teen and parent channels by design.
- Even within a family, the teen's session content is theirs; resist the urge to look.
Red Flags That Should Make You Stop
These are the warning signs that warrant pausing or walking away:
- The platform doesn't clearly state HIPAA compliance.
- The privacy policy is vague, missing, or written so loosely that almost any data use is permitted.
- The platform sells, "shares," or "discloses" personal information to third parties for marketing.
- Communications aren't encrypted (sessions over plain consumer Skype/Zoom not configured for HIPAA, ordinary email for treatment content, etc.).
- There's no clear path to access or delete your data.
- A history of breaches without proper notification.
- Therapist credentials aren't verifiable on a state licensing board.
- The platform asks for excessive personal information unrelated to clinical care.
- Marketing to you continues using sensitive health information even after sign-up.
- Pressure to leave reviews, refer friends, or share account access.
If Your Privacy Is Violated
If you suspect a real privacy violation:
- Document it. Note the date, what happened, what data was involved, who you informed.
- Contact the platform's privacy officer. HIPAA-covered entities are required to have one and to investigate.
- File a complaint with HHS OCR at hhs.gov/hipaa/filing-a-complaint. Federal complaints are taken seriously.
- Contact your state attorney general for state-level privacy violations.
- Consult an attorney for serious cases, particularly if you've experienced concrete harm.
- Change passwords on all related accounts, even ones you don't think were affected.
- Monitor for identity theft if any account or financial data was exposed.
Privacy When You Use Insurance
Using insurance puts a diagnosis code on your record with your insurer. Insurance claims data is HIPAA-protected and isn't visible to your employer or random third parties — but if you're concerned about specific contexts (security clearances, custody disputes, future life-insurance underwriting), some people choose cash-pay specifically to keep diagnoses out of insurance records. There's no right answer; it's a personal trade-off. Our insurance coverage guide walks through how billing actually flows.
What to Do Next
- Confirm the platform is HIPAA-covered. If you're going to a licensed clinician through Headway, Grow Therapy, Rula, Alma, Sondermind, Talkiatry, Talkspace, Cerebral, BetterHelp, or similar, you're in covered-entity territory.
- Run the practical checklist above — 2FA, headphones, private location, separate user account on shared devices.
- Read the platform's current privacy policy before signing up. Take 5 minutes; most are skimmable.
- Decide on insurance vs. cash-pay based on your privacy threshold, not just price.
- Talk it through with our AI guide if you want help reasoning through your specific situation. See also HIPAA in telehealth, platforms compared, and verifying therapist credentials.
Frequently Asked Questions
Are online therapy sessions actually private?
Sessions with a HIPAA-covered licensed clinician are protected by federal privacy law: encrypted in transit, stored securely, and not shareable without your written consent except in narrow legal exceptions. Your real privacy risk is usually environmental — who can hear you, who can see your screen, what device you're on.
Does HIPAA apply to wellness apps and meditation apps?
Often not. Apps that aren't operated by a healthcare provider or health plan typically aren't HIPAA-covered. They may collect substantial personal data and share it with advertising or analytics partners. Read the privacy policy carefully.
Can my employer see what I discuss in therapy?
No. Therapy content is HIPAA-protected and is not shared with employers. If you use insurance, your employer may know the plan was used for behavioral health (because they pay premiums in aggregate) but not what you talked about. EAP sessions are similarly confidential.
What about session recordings?
Most reputable platforms do not record sessions by default. If a session is recorded for training or supervision, you have the right to know and to consent. Don't record sessions yourself unless your therapist agrees.
Is BetterHelp safe to use after the FTC settlement?
The 2023 FTC settlement with BetterHelp addressed past advertising-data practices. Therapy session content itself is HIPAA-protected. The platform's published policies have been updated; review the current privacy policy and adjust opt-out controls in your account before signing up.
What's the safest setup for online therapy?
Headphones, a private room with a door that closes, a personal device with a strong password and 2FA, a private home network or cellular, and a HIPAA-covered platform. That combination eliminates the vast majority of practical privacy risk.
Can I use telehealth from a parked car or on a walk?
Yes — many people do. A parked car offers good privacy if you're alone in it. Walks are fine if your environment isn't crowded with strangers within audio range. Headphones are essential.
What if I share a device with family?
Set up a separate operating-system user account with its own password — not just a separate browser profile. Don't save passwords in a shared browser. Always log out fully after sessions. For minors using a family device, the same applies.
Special Situations Worth Calling Out
A few specific privacy situations come up enough to deserve their own paragraph:
Custody and family law
If you're in or near a custody situation, the privacy of your therapy is especially important. Therapy records are generally protected, but courts can order disclosure in custody disputes, and notes can be subpoenaed. Tell your therapist on day one if custody is in play; they can document accordingly. Cash-pay reduces the insurance paper trail. Don't record sessions, and be careful what you write in messaging.
Security clearance and government employment
Federal security clearance forms (SF-86) ask about mental health treatment. Treatment by itself is not generally disqualifying — the modern guidance treats seeking help as a positive sign of judgment — but treatment for certain conditions or particular circumstances can require additional review. If you have or seek clearance, it's reasonable to discuss this candidly with a therapist.
Life insurance underwriting
Some life insurance applications ask about mental health diagnoses or medication history. They typically pull pharmacy records and may pull medical records with your consent. This is a legitimate reason some people choose cash-pay therapy without a billed diagnosis on the medical record.
Employment
Employers generally cannot access your treatment records, and the ADA prohibits discrimination based on mental-health conditions. That said, drug testing and pre-employment medical exams are separate issues; certain controlled-substance medications (some ADHD stimulants, benzodiazepines) may show on drug screens with prescription documentation.
Children and teens
Minors have privacy rights too, though they vary by state. In most states, parents have access to a minor's medical records, but therapists generally negotiate ground rules with the family up front so the teen can speak honestly. Teen Counseling structures this with separate channels by design.
Domestic violence and abusive households
If your home isn't safe and you can't have a session in it, talk to your therapist. Many will accommodate alternate arrangements (parked car, library private room, friend's home). Use a device the abuser doesn't have access to, and be careful about app icons and notification text.
Privacy on the Insurance Side
Using insurance puts a diagnosis code on your record with your insurer. Things to know:
- Insurance claims data is HIPAA-protected. Your employer can't see it as individual data.
- Health data brokers exist; some are pushed back on by state privacy laws.
- Insurance companies cannot deny health insurance based on a mental-health diagnosis (ACA pre-existing-condition rule), but life and disability insurance underwriting is different.
- Some people choose cash-pay specifically because they don't want a behavioral diagnosis on their insurance record. That's a personal trade-off, not a privacy emergency.
- If you want maximum privacy, cash-pay through an independent therapist with no superbill avoids creating insurance records of treatment entirely.
What Good Privacy Practices Look Like Long-Term
Privacy isn't a one-time setup. A few habits that hold up over months and years:
- Review platform privacy policy updates when notified. They change. Skim the email; the meaningful changes are usually flagged.
- Rotate passwords annually on healthcare accounts.
- Periodically check what apps have access to your email and accounts; revoke ones you don't recognize.
- Don't post about therapy session content publicly. Even general posts can identify a therapist.
- Audit your phone's notification settings. Therapy app notifications shouldn't show full message content on the lock screen.
- If you change therapists or platforms, request your records be deleted per the privacy policy.
- Be careful with AI chat tools like consumer-grade ChatGPT. Pasting therapy session content into a non-HIPAA AI tool moves your data outside the protected envelope.
Related Guides
- HIPAA & Your Privacy in Telehealth
- Telehealth Laws by State
- Telehealth Technology Setup Guide
- How to Choose an Online Therapy Platform
- How to Verify Therapist Credentials
- Best Online Therapy Platforms
- Telehealth Across State Lines
- Online Therapy With Insurance
- Online Therapy Cost Guide
- How to Prepare for a Telehealth Appointment
- What to Expect in Your First Online Therapy Session
- Ultimate Guide to Online Therapy
Bottom Line
For the typical reader using a HIPAA-covered platform with sensible setup hygiene, online therapy is meaningfully private — privacy levels comparable to in-person therapy in most respects. The two areas of legitimate concern are environmental privacy (who can hear or see you in your space) and data practices on the marketing/account side of consumer-facing platforms. Both are manageable. Pick a HIPAA-covered platform, run the practical checklist, and you've handled the substance of telehealth privacy.
For specific questions, the AI guide can help, and the HIPAA telehealth guide goes deeper on the federal framework.
Important Reminder
This guide provides general educational information only. It is not legal advice. Privacy laws and regulations change, and specific protections vary by state and situation. Consult with qualified legal professionals for guidance on your specific privacy concerns.
If you have concerns about a telehealth provider's privacy practices, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.
About the editor
Paul Paradis is the founder and editor of Telehealth Navigator. His background is two-plus years inside a forensic mental health hospital and a long personal history with mental health in his own family — which is why this site exists at all. For every guide on this page, Paul works from publicly-available clinical guidance (APA, NIMH, SAMHSA) and federal health-policy documents (CMS, HealthCare.gov), and links back to those sources so nothing on the page is left floating. He is not a doctor, therapist, or licensed clinician, and this guide should not be read as clinical advice. The full editorial process, review cadence, and correction policy live on the editorial standards page.