Psychiatric Evaluation

Is a Psychiatric Evaluation Confidential? Records, Insurance and Employers

By Dr. Stacey Forbes, DNP, APRN, PMHNP-BC · Updated October 12, 2026

A psychiatric evaluation is confidential in the way most medical care is: what you say becomes part of a protected health record that your provider cannot share with your employer, school, or relatives without your permission. The real limits are narrower than most people fear. Your health plan sees what it needs to pay a claim. Clinicians may act to prevent serious, imminent harm and must report suspected child abuse. Courts can sometimes compel records. Knowing exactly where those lines are can make it easier to be honest in the room, which is what makes an evaluation useful.

Why this matters for the evaluation itself

An evaluation is only as good as the information in it. People leave things out when they are afraid of who will find out: drinking, drug use, a past hospitalization, thoughts of suicide, an affair, a problem at work. Those are often exactly the details that change the diagnosis or the safety of a medication.

So it is reasonable to ask about privacy before you start. A good clinician will not be offended by "Who sees this?" or "Does this go to my insurance?" At Willow & Stone, the privacy policy is published, and you can ask about any of it at the start of the integrative psychiatric evaluation.

HIPAA in plain language

The HIPAA Privacy Rule applies to health care providers who bill electronically, to health plans, and to the businesses that handle records for them. It treats your evaluation note, diagnoses, prescriptions and lab results as protected health information. Without your written authorization, a provider may use and share it mainly for three purposes: your treatment, payment for that treatment, and the practice's own health care operations, plus a list of specific exceptions set by law.

Some practical consequences:

• Other clinicians treating you can receive information for treatment. In practice, many psychiatric providers still ask your permission before contacting your therapist or primary care clinician, and you can ask that they do.
• Family members generally do not get information about an adult patient unless you agree, with limited exceptions such as emergencies. Parents of minors are a separate topic with state-specific consent rules; see our Texas teen consent guide and the sibling pages for other states.
• You have a right to a copy of most of your record. How that works is covered in after your psychiatric evaluation.

State laws can add stronger protections for mental health information, and where they are stricter than HIPAA, the stricter rule generally applies.

Insurance: what your plan actually sees

If you use insurance, the provider sends the plan a claim. A claim normally carries your identity, the date and type of service (as a procedure code), and a diagnosis code that justifies it. HIPAA requires that disclosures for payment be limited to the minimum necessary to accomplish the purpose. Plans can ask for more when they review a claim or authorize a treatment, but they are not entitled to your full narrative history by default.

There is one strong tool if this worries you. HIPAA requires a provider to agree to your request not to disclose a service to your health plan when you, or someone other than the plan, have paid for that service in full and the disclosure is not otherwise required by law. In other words, paying out of pocket and asking in writing keeps that visit off your insurance record.

At Willow & Stone, insurance is accepted only for Texas patients, depending on the plan. Outside Texas, care is direct-pay, and you receive a superbill you can choose to submit for possible out-of-network reimbursement. Whether you submit it is up to you. Our pricing page and the guide to paying for a psychiatric evaluation explain both routes.

Employers and schools

Your employer, acting as an employer, is not a HIPAA-covered entity, and your provider cannot send it your records without your authorization. The main legal exceptions are narrow and specific, such as workers' compensation claims, which follow their own laws.

What employers can ask you directly is limited by the Americans with Disabilities Act. The U.S. Equal Employment Opportunity Commission explains that in most situations you can keep a mental health condition private, and that an employer may ask medical questions only in four situations: when you request a reasonable accommodation; after a job offer but before you start, if everyone in that job category is asked; for voluntary affirmative-action tracking; or when there is objective evidence you may be unable to do the job or may pose a safety risk. If you do disclose, the employer must keep it confidential.

If you ask for an accommodation, the employer may ask for a letter from your provider confirming the condition and the need. You decide whether to authorize that letter, and it can be limited to what is needed rather than your full history.

Schools follow a different federal law, FERPA, for education records. A college counseling center or a school nurse may keep records under that framework rather than HIPAA. A private psychiatric practice does not send anything to a school unless you, or a parent with authority for a minor, sign a release.

Psychotherapy notes: the extra-private category

HIPAA has a special category called psychotherapy notes: notes a mental health professional writes to document or analyze what was said in a counseling session and keeps separate from the rest of the medical record. These get more protection than the rest of your chart. Almost any use or disclosure of them requires your specific authorization, and they are excluded from the general right of access.

The definition is narrow, though. HIPAA specifically says psychotherapy notes do not include:

So the private-notebook protection applies mainly to a therapist's separate process notes. A psychiatric evaluation note, which is a summary of history, diagnosis and plan, is part of the regular medical record.

When confidentiality can be broken

Every clinician should explain the limits at the start. They are narrower than most people expect.

• Serious and imminent threat. HIPAA permits a provider, consistent with law and ethics, to share information if they believe in good faith it is necessary to prevent or lessen a serious and imminent threat to someone's health or safety, and to share it with people reasonably able to prevent it, including the person threatened.
• Duty to warn or protect. Since the California Tarasoff case, almost every state has adopted a duty-to-warn or duty-to-protect law, according to the National Conference of State Legislatures. Some make warning mandatory and some only permit it, and who it applies to differs. The exact rule depends on the state where you receive care.
• Child abuse and neglect. HIPAA permits reports to the authorities who receive them, and state laws generally require clinicians to report suspected child abuse. Many states have similar rules for abuse of older or dependent adults.
• Court orders and other legal requirements. Records can sometimes be compelled in legal proceedings, under rules that vary by state and by the type of case.

Talking about feeling suicidal, or about angry thoughts, does not automatically trigger any of these. Clinicians hear those things every day. The point of the conversation is to understand risk and make a plan with you. If you are worried about this, ask the clinician to explain how they handle it before you go into detail.

Substance use records and 42 CFR Part 2

Records from federally assisted substance use disorder treatment programs carry an additional federal protection, 42 CFR Part 2, which is stricter than HIPAA in important ways. A 2024 final rule, published 16 February 2024, brought Part 2 closer to HIPAA while keeping its core protections, and programs had to comply by 16 February 2026. Under the updated rule:

• A patient can give a single written consent for future uses and disclosures for treatment, payment and health care operations, and can revoke it in writing.
• Part 2 records generally cannot be used in civil, criminal, administrative or legislative proceedings against the patient without the patient's consent or a court order.

Part 2 covers specific kinds of programs, not every mention of alcohol or drug use in a general psychiatric chart. If you are or were in a substance use treatment program and want to understand how its records are handled, ask that program directly. For how substance use affects a psychiatric picture, see anxiety, depression and substance use.

Common Questions

Sources & Further Reading

• eCFR — 45 CFR 164.501, Definitions (psychotherapy notes)
• eCFR — 45 CFR 164.512, Uses and disclosures for which authorization is not required
• eCFR — 45 CFR 164.522, Rights to request privacy protection
• Federal Register — Confidentiality of Substance Use Disorder (SUD) Patient Records, final rule (89 FR 12472, 16 Feb 2024)
• U.S. EEOC — Depression, PTSD, & Other Mental Health Conditions in the Workplace: Your Legal Rights
• NCSL — Mental Health Professionals' Duty to Warn

This article is general education, not a diagnosis or advice for your situation. Only a clinician who has evaluated you can diagnose a condition or recommend treatment.