How can a user compare HIPAA compliance and data privacy practices among popular mental health apps and teletherapy platforms?

A user can compare data protection standards by checking whether a platform signs a Business Associate Agreement (BAA) , reviewing independent safety audits, and analyzing the platform's third-party data sharing practices.

Many standalone mental health apps (like mood trackers or journaling tools) operate as general wellness products and are not legally bound by HIPAA unless they connect directly to a healthcare provider or covered entity.

Steps to Evaluate and Compare Platforms

• Check HIPAA Status and BAAs: Verify if the platform explicitly states it is HIPAA-compliant and willing to sign a BAA with your healthcare provider. Teletherapy platforms designed for clinical care (such as TheraPlatform ) generally support this, whereas consumer self-help apps usually do not.
• Read the Privacy Policy for Data Sharing: Search the privacy policy for disclosures regarding third-party trackers, analytics, or advertising . Many popular apps share user engagement metrics or personal data with marketing networks.
• Review Independent App Transparency Tools: Use resources like Mozilla's Privacy Not Included guide, which regularly audits and scores the security and data practices of mental health and wellness apps.
• Inspect Security Specifications: Look for technical safeguards like end-to-end encryption for video calls, secure messaging portals , and multi-factor authentication options.
• Examine Data Deletion and Control Policies: Check whether the platform allows you to permanently delete your account and wipe your historical mood logs, journal entries, or chat transcripts from their servers.

“Millions of people use mental health apps to track moods, journal emotions, manage anxiety, and support overall behavioral health. But a recent cybersecurity investigation suggests some popular mental health apps may not be adequately protecting user data.”

If you'd like, let me know:

• The specific names of the apps or platforms you are considering
• Whether you are looking for self-guided apps or live teletherapy

I can help you locate their specific privacy guidelines or evaluate their safety features.

A good comparison starts with one important distinction: “HIPAA compliant” does not mean “maximally private.” HIPAA regulates protected health information in particular covered-entity/business-associate relationships; a standalone consumer mental-health app may handle sensitive health data without that data being protected by HIPAA. HHS specifically notes that HIPAA generally does not cover health information a person voluntarily enters into an app that isn't offered by or on behalf of a HIPAA-regulated entity. Other laws, including the FTC Act and Health Breach Notification Rule, can still apply.

A practical comparison framework

Don't compare only the marketing pages

Read three documents for each service:

1. The general privacy policy.
2. The HIPAA Notice of Privacy Practices, if one exists.
3. Any consumer-health-data/privacy supplement.

This can reveal meaningful differences. For example, Talkspace says that U.S. subscriber data is PHI protected by HIPAA and explains that it can act either as a business associate or covered entity depending on the provider relationship.

Headspace similarly distinguishes its general platform privacy practices from its medical-services relationship: its current policy says U.S. care providers are HIPAA-covered entities and Headspace acts as their business associate. Its medical notice separately describes permitted PHI uses and says Headspace Medical will not sell PHI or use it for marketing without the required authorization.

Calm is a useful example of why the specific product and relationship matter: its consumer-health-data policy says Calm Health may be subject to a healthcare provider or insurer's HIPAA notice when the service is provided through that HIPAA-covered entity.

Pay particular attention to therapy transcripts

For teletherapy, ask explicitly:

Are therapy messages, video/audio recordings, transcripts, and clinical notes retained? For how long? Who can access them? Are they used for AI training, quality assurance, research, or product improvement? These can be substantially more sensitive than ordinary account information. For example, Talkspace says its therapy transcripts are treated like medical records and its current retention policy says they are retained for 10 years.

Look beyond HIPAA

A service that isn't HIPAA-covered isn't necessarily a service with no privacy protection. The FTC's Health Breach Notification Rule can apply to certain health apps that aren't subject to HIPAA, and the FTC's 2024 amendments explicitly addressed health apps and similar technologies.

Conversely, HIPAA compliance isn't a privacy score. HIPAA permits numerous uses and disclosures of PHI—for example, treatment, payment, healthcare operations, and certain disclosures required or permitted by law. A platform can therefore comply with HIPAA while having data practices that are less restrictive than what a privacy-conscious consumer might prefer.

A simple scoring system

For each app, give 0–2 points in each category:

• 2: Clearly documented, restrictive practice
• 1: Some protections, but significant qualifications
• 0: Unclear, broad sharing/use, or unfavorable practice

Score separately for:

HIPAA applicability · data minimization · third-party sharing · advertising/tracking · secondary/AI uses · retention/deletion · encryption/security · user rights · breach practices · employer/insurer confidentiality

Then keep HIPAA status as a separate column, rather than treating it as the overall privacy score.

That produces a much more meaningful comparison than a simple “HIPAA: yes/no.”

A useful rule of thumb

If privacy is the priority, favor platforms whose policies make it easy to answer “what data do you collect, why, who gets it, how long do you keep it, and can I delete it?” A company that provides detailed, product-specific answers is generally easier to evaluate than one relying mainly on a generic “HIPAA-compliant and secure” claim. The FTC itself cautions companies against vague or misleading claims such as “HIPAA certified” or “HIPAA secure.”

If you want, I can also turn this framework into a side-by-side comparison of 5–10 popular platforms (e.g., BetterHelp, Talkspace, Headspace, Calm, Brightside, and Teladoc) using their current privacy policies and HIPAA disclosures.

Comparing HIPAA compliance and data privacy practices among mental health apps and teletherapy platforms requires looking past marketing claims . Many direct-to-consumer wellness apps are not legally bound by HIPAA because they operate as lifestyle or self-help tools rather than traditional healthcare providers or covered entities.

Evaluating and comparing these platforms effectively involves a structured, step-by-step approach:

1. Check for a Signed Business Associate Agreement (BAA)
   • A Business Associate Agreement (BAA) is a legally binding contract required by HIPAA. If a platform refuses or hesitates to sign a BAA with a healthcare provider or with you directly (stating they are just a software conduit), they are typically not assuming HIPAA liability.
2. Consult Independent Privacy Guides and Audits
   • Review consumer security guides like the Mozilla Foundation Privacy Not Included Project , which specifically audits mental health and teletherapy apps for data sharing, trackers, and encryption standards.
   • Look up research studies or regulatory actions (such as FTC enforcement notices) that investigate third-party data tracking and advertising pixels embedded in health applications.
3. Examine the App’s Privacy Policy for Data-Sharing Loopholes
   • Read the fine print to see if the platform sells, rents, or shares "de-identified" or "anonymized" data with third-party advertisers, social media platforms, or data brokers. Many consumer apps track user inputs during intake quizzes before a user even agrees to a privacy policy.
4. Evaluate Technical Security Measures
   • Check whether the platform utilizes End-to-End Encryption (E2EE) for messages, video sessions, and stored digital journals.
   • Verify if they support robust access controls, such as mandatory multi-factor authentication (MFA) and automatic session timeouts.
5. Review Data Retention and Deletion Policies
   • Determine how long your data is kept on their servers after account deactivation. Find out if hitting "delete account" genuinely purges your personal health entries or merely deactivates your profile while retaining historical inputs.

Navigating the Fine Print

When looking at user advocacy reports and investigations into popular platforms, consumer consensus often highlights how tricky these policies can be to parse.

“Many of these apps do not have clear policies on how long they retain your data, and there is no rule requiring them to. HIPAA does not create any records retention requirements — they are regulated by state laws and unlikely to include health apps as...”

“Despite these apps dealing with incredibly sensitive issues — like depression, anxiety, suicidal thoughts, domestic violence, eating disorders, and PTSD — the worst of them routinely share data, target vulnerable users with personalized ads, allow weak...”

If you have a specific app or platform in mind, let me know its name and I can help look up its recent privacy evaluations or specific compliance disclosures.

The key is to separate “HIPAA compliant” from “privacy-friendly.” They overlap, but they are not the same thing. HIPAA generally applies to covered health-care providers and their business associates—not automatically to every consumer mental-health app. HHS specifically notes that information entered into an app that isn't offered by or on behalf of a HIPAA-covered entity may fall outside HIPAA, while other laws such as the FTC Act or Health Breach Notification Rule may still apply.

A practical comparison framework

For each mental-health app or teletherapy platform, check these categories:

Don't rely on the words “HIPAA compliant”

A strong comparison should ask why HIPAA applies and to which data.

For example, HHS says a third-party app selected by a consumer to receive health information directly from a covered entity isn't necessarily a business associate; merely facilitating the individual's requested access does not create a BAA relationship.

So a better question than “Is this app HIPAA compliant?” is:

“Who is the HIPAA-covered entity, what data is covered by HIPAA, what role does this platform play, and what protections apply to everything outside HIPAA?” That distinction can substantially change the comparison.

Read three documents, not just the marketing page

For each service, collect:

1. Privacy policy — focus on collection, sharing, advertising, retention, deletion, and AI/research provisions.
2. Terms of service — look for ownership/licensing of user content and provisions concerning providers, recordings, communications, and AI.
3. Security/HIPAA documentation — look for HIPAA statements, BAAs, security controls, encryption, certifications/audits, and subprocessors.

Then record the findings in a spreadsheet rather than relying on each company's privacy-language summaries.

A useful scoring system

You could score each platform from 0–2 in each category:

• 0 = poor/unclear
• 1 = moderate or conditional
• 2 = strong/explicit

For example:

Privacy score

• Minimal data collection
• No targeted advertising based on health data
• No sale of health information
• Clear third-party disclosures
• Clear deletion/retention policy
• Strong user controls
• Transparent AI/data-training practices

Security score

• Encryption in transit
• Encryption at rest
• MFA
• Access controls
• Security audits/certifications
• Incident-response process
• Transparent breach history

Regulatory score

• Clearly identified HIPAA-covered relationship
• BAA where appropriate
• Appropriate breach-notification obligations
• State privacy-law compliance
• No misleading privacy claims

I would not collapse everything into a single “HIPAA score.” A platform could have a legitimate HIPAA-covered service while still having comparatively aggressive practices around analytics, advertising, or non-PHI consumer data.

Pay special attention to non-HIPAA data

This is particularly important with mental-health apps. HHS explicitly says HIPAA generally doesn't protect health information stored in consumer apps that aren't provided by a covered entity or business associate.

That doesn't mean the information is unprotected. The FTC says its Act can apply to companies outside HIPAA, and its Health Breach Notification Rule applies to many health apps and was amended in 2024 to emphasize its application to most health apps.

Consequently, a good comparison should have columns for:

HIPAA protections | FTC protections | state-law protections | company's voluntary privacy practices

rather than treating HIPAA as the entire privacy picture.

For teletherapy specifically

Also investigate the therapist/provider, not just the platform. Ask:

• Is the therapist independently licensed in the relevant state?
• Who is the actual provider of the health-care service?
• Is the platform acting as the provider, a technology vendor, or a marketplace?
• Who maintains the clinical record?
• Can the therapist use another EHR or platform?
• What happens to records if the therapist leaves the platform?
• Are sessions recorded? If so, why, where are recordings stored, and how long are they retained?
• Are transcripts generated by AI?
• Are messages between patient and therapist part of the clinical record?
• Can the platform use therapy conversations for model training or product development?

This helps distinguish a telehealth provider with a HIPAA-regulated clinical relationship from a consumer wellness app that happens to offer access to therapists.

Best bottom line

For a user choosing among popular services, I'd rank them on privacy practices first and HIPAA status second:

Who gets my mental-health data, what exactly do they get, why do they get it, how long do they keep it, can they use it for advertising/AI/research, and what happens if there is a breach? HIPAA is an important baseline, but “HIPAA compliant” alone is not a sufficient privacy recommendation. HHS itself emphasizes that HIPAA's applicability depends on whether an entity is a covered entity or business associate.

For primary-source checking, the hhs.gov and ftc.gov are particularly useful starting points.

Best bottom line

For a user choosing among popular services, I'd rank them on privacy practices first and HIPAA status second:

Who gets my mental-health data, what exactly do they get, why do they get it, how long do they keep it, can they use it for advertising/AI/research, and what happens if there is a breach? HIPAA is an important baseline, but “HIPAA compliant” alone is not a sufficient privacy recommendation. HHS itself emphasizes that HIPAA's applicability depends on whether an entity is a covered entity or business associate.

This is particularly important with mental-health apps. HHS explicitly says HIPAA generally doesn't protect health information stored in consumer apps that aren't provided by a covered entity or business associate.

That doesn't mean the information is unprotected. The FTC says its Act can apply to companies outside HIPAA, and its Health Breach Notification Rule applies to many health apps and was amended in 2024 to emphasize its application to most health apps.

A good comparison should separate HIPAA coverage from overall privacy. “HIPAA compliant” is not a synonym for “private,” and an app can have strong privacy practices even when HIPAA does not apply to all of its consumer-facing data.

1. First determine what HIPAA actually covers

HIPAA applies to covered entities and their business associates, not automatically to every mental-health app.

For each service, ask:

• Is the therapy/psychiatry provider a HIPAA-covered health-care provider?
• Is the platform acting as that provider's business associate?
• Does the platform have a BAA where one is required?
• Does HIPAA apply to the particular product/account you're using, or only to a medical-service component?
• What happens to information collected by the app outside the treatment relationship?

This last question is particularly important: HHS says HIPAA generally doesn't protect health information that a person voluntarily enters into an app that isn't provided by or on behalf of a HIPAA-regulated entity. Other laws, including FTC rules, can nevertheless apply.

2. Compare the privacy policies—not just the HIPAA claim

For each platform, look for specific answers about:

For example, Talkspace currently says U.S. subscriber data is treated as PHI under HIPAA and describes encryption of server data and communications. Talkspace Help Center Talkspace Headspace's current materials distinguish its general consumer privacy policy from its HIPAA-covered medical services and publish a separate HIPAA Notice of Privacy Practices.

3. Pay special attention to tracking technologies

This is an often-overlooked differentiator.

HHS says tracking technologies on authenticated telehealth pages can have access to PHI, and regulated entities have to ensure that disclosures to tracking vendors comply with HIPAA. HHS also notes that information such as IP addresses, device identifiers and geolocation can become relevant health information in particular circumstances.

So don't just ask, “Is the video session encrypted?” Ask:

“What information about my use of the service is sent to analytics, advertising, social-media, or other third-party tracking companies?”

4. Distinguish clinical records from consumer-app data

This is crucial when comparing a meditation/self-help app with a teletherapy service.

A teletherapy provider may maintain a formal medical record subject to HIPAA, while the same company's general wellness features, website activity, advertising identifiers, or other consumer data may have different legal treatment.

Similarly, a standalone mental-health app doesn't necessarily become HIPAA-covered merely because it handles very sensitive mental-health information. The FTC specifically notes that many health apps not covered by HIPAA may instead be subject to its Health Breach Notification Rule.

5. Look for evidence rather than marketing language

Give more weight to:

• A current HIPAA Notice of Privacy Practices
• Clearly described business-associate relationships
• A detailed privacy policy
• Security documentation
• Specific retention/deletion rules
• Transparency about third-party vendors
• Clear breach-notification procedures
• Independent security assessments or certifications, where applicable

Be cautious with vague statements such as “bank-level security,” “100% confidential,” or “HIPAA compliant” without details. HIPAA itself imposes specific obligations concerning privacy, security, disclosures and business associates.

6. Use a simple scoring framework

You could score each platform from 0–2 in these categories:

• HIPAA applicability & documentation
• Encryption/security
• Third-party sharing
• Advertising/tracking
• AI/model-training practices
• Data retention
• Deletion/control
• Transparency
• Breach history/response
• State-law and consumer-privacy protections

Then weight the categories according to your priorities. For someone choosing therapy, for example, third-party sharing, clinical-record handling, tracking, retention and AI use may matter more than the number of security certifications.

Finally, check the policies at the time you sign up. Privacy practices change, and even within one company different products or services can have different HIPAA status. HHS's current guidance specifically emphasizes examining the nature of the app, the information it collects, and the relationships among the app, providers and vendors.

For a rigorous comparison of specific platforms such as BetterHelp, Talkspace, Headspace, Calm, Teladoc, and traditional teletherapy platforms, I would compare their current 2026 privacy policies, HIPAA notices, tracking practices, data-retention rules, and AI policies side by side, rather than relying on their marketing claims.

So don't just ask, “Is the video session encrypted?” Ask:

“What information about my use of the service is sent to analytics, advertising, social-media, or other third-party tracking companies?”

4. Distinguish clinical records from consumer-app data

This is crucial when comparing a meditation/self-help app with a teletherapy service.

A teletherapy provider may maintain a formal medical record subject to HIPAA, while the same company's general wellness features, website activity, advertising identifiers, or other consumer data may have different legal treatment.

Similarly, a standalone mental-health app doesn't necessarily become HIPAA-covered merely because it handles very sensitive mental-health information. The FTC specifically notes that many health apps not covered by HIPAA may instead be subject to its Health Breach Notification Rule.

5. Look for evidence rather than marketing language

Give more weight to:

Comparing HIPAA compliance and data privacy practices among mental health apps and teletherapy platforms requires looking past marketing claims and examining technical architecture, legal agreements, and independent third-party evaluations . Many consumer-facing wellness apps operate outside of HIPAA entirely, making a direct comparison tricky.

Key Frameworks for Comparison

1. Determine HIPAA Applicability vs. Consumer Privacy
   • Traditional telehealth and Electronic Health Record (EHR) platforms are generally subject to HIPAA if they handle Protected Health Information (PHI) on behalf of a covered healthcare provider.
   • Direct-to-consumer mental health apps (like meditation or mood-tracking apps) often market themselves as lifestyle products, meaning they are governed by FTC rules and general privacy policies rather than HIPAA. Check the HHS Mobile Health App Guidance to understand when an app is legally considered a business associate.
2. Verify the Business Associate Agreement (BAA)
   • A signed BAA is the baseline requirement for HIPAA compliance. Vendors must be willing to legally commit to safeguarding electronic PHI (ePHI). If a teletherapy platform or app refuses or fails to offer a BAA for clinical use, it is not HIPAA-compliant. Reputable platforms make BAA terms explicit on their pricing or legal pages (e.g., TheraPlatform Compliance Info or Doxy.me).
3. Inspect Technical and Administrative Safeguards
   • Encryption: Confirm end-to-end or robust encryption (such as AES-256 for data at rest and TLS 1.3 for data in transit).
   • Access Controls & Authentication: Look for mandatory Multi-Factor Authentication (MFA), role-based permission tiers, and automatic session timeouts.
   • Audit Logging: Ensure the system automatically timestamps and logs who views, exports, or edits client files or messages.
4. Review Data Sharing and Monetization Policies
   • Read the fine print in the app’s privacy policy regarding third-party trackers, analytics, and advertising SDKs (such as Meta/Facebook Pixel or Google Analytics), which have historically raised red flags for mental health apps.
   • Check if user data (even when labeled "anonymized") is shared with or sold to data brokers and advertisers.
5. Consult Independent Reviews and Evaluation Databases
   • Utilize trusted consumer and professional evaluations rather than relying solely on the company's homepage. Resources like Consumer Reports Health Privacy investigate hidden data-sharing practices.
   • Refer to structured evaluation frameworks like the American Psychiatric Association’s app evaluation model or institutional resources like the MindApps App Evaluation Library which score apps on privacy and security criteria.

If you'd like to narrow this down, tell me:

• Are you comparing consumer mental health apps (mood trackers, meditation) or teletherapy/EHR software?
• Do you need a breakdown of a specific platform or app's reported privacy practices?

Comparing HIPAA compliance and data privacy practices among mental health apps and teletherapy platforms requires looking past marketing claims . Most standalone wellness apps (mood trackers, meditation tools, or AI chat companions) are not legally covered by HIPAA because they are tech companies rather than traditional healthcare providers or insurers.

A step-by-step framework helps users evaluate and compare these platforms effectively:

1. Determine HIPAA applicability and Business Associate Agreements (BAAs ): Check if the platform explicitly acts as a covered entity's business associate and signs a BAA . If an app functions purely direct-to-consumer without a licensed clinical infrastructure, it typically operates outside HIPAA.
2. Review third-party data tracking and sharing: Inspect whether the app embeds software development kits (SDKs ), pixel trackers, or analytics tools (such as Meta or Google trackers) that log intake questionnaires or browsing behaviors before or without explicit consent.
3. Analyze encryption standards: Look for verifiable end-to-end encryption for data both in transit and at rest, ensuring that even the platform operators or third-party cloud hosts cannot read session notes or message contents.
4. Assess data retention and deletion policies: Check if the platform provides clear, time-bound data retention limits and allows permanent, verifiable account and data deletion upon request.
5. Consult independent privacy watchdogs: Cross-reference the platform with specialized safety and privacy evaluations, such as the Mozilla Foundation Privacy Not Included Guide or One Mind PsyberGuide , which regularly audit digital health tool tracking and policy transparency.

Expert and Consumer Perspectives

Independent evaluations often reveal stark gaps between user expectations and actual app behavior.

“Most ignored our requests for transparency completely.”

“If another app picks up intimate information from the mental health or well-being app, details entered by the student aren't covered and can be sent elsewhere.”

If you have a specific app or teletherapy platform in mind, let me know its name so I can help you look into its specific privacy disclosures and compliance history.

A good comparison starts with one important distinction: “HIPAA compliant” is not the same thing as “private.” HIPAA applies to covered health-care entities and their business associates, not automatically to every mental-health app. Consumer-facing apps outside HIPAA can still be subject to the FTC Act and, in some cases, the FTC Health Breach Notification Rule.

What to compare

How I'd compare popular platforms

For each platform—whether it's a teletherapy service such as BetterHelp or Talkspace, a provider-connected platform, or a mental-wellness app—make a spreadsheet with these columns:

Platform → HIPAA role/status → BAA → data collected → advertising → third-party sharing → recording/transcription → AI use → encryption/security → retention → deletion → breach history/notifications → privacy-policy date.

Then give each category a 0–2 score:

• 2 = clearly disclosed and privacy-protective
• 1 = ambiguous/limited disclosure
• 0 = concerning practice or no meaningful disclosure

I'd weight secondary data use, advertising, third-party sharing, therapy recordings/transcripts, and deletion/retention more heavily than marketing claims such as “secure” or “HIPAA-ready.”

Don't rely on the HIPAA badge alone

A platform saying “HIPAA compliant” doesn't necessarily answer the question a consumer actually cares about: “What happens to my information when I use this service?” The FTC specifically cautions companies against misleading claims such as “HIPAA Certified” or “HIPAA Secure.”

Conversely, lack of HIPAA coverage isn't automatically proof that an app is unsafe. The FTC's Health Breach Notification Rule now expressly covers many health apps that aren't HIPAA-covered, and the FTC Act independently applies to misleading or unfair health-data practices.

A practical evidence hierarchy

When researching an app, prioritize:

1. Current privacy policy and terms
2. HIPAA/BAA documentation
3. Security/privacy documentation
4. Specific disclosures about advertising, analytics, AI, and third parties
5. FTC/HHS enforcement or breach records
6. Independent security audits/certifications, if publicly documented
7. Marketing claims and app-store descriptions last

Also check the date of the privacy policy; data practices can change substantially after an app is acquired, introduces AI features, or changes its advertising model.

For an especially sensitive use case, the strongest option is generally a provider/platform arrangement where you can establish exactly who is the HIPAA-covered entity, who is the business associate, what data is PHI, and what secondary uses are permitted, rather than assuming that the consumer app itself is comprehensively protected by HIPAA.

HHS HIPAA guidance for health apps · FTC Mobile Health App Interactive Tool ·

The key is to separate “HIPAA compliance” from overall privacy. An app can have strong security and privacy practices without being covered by HIPAA—and a HIPAA-covered provider can still have privacy practices you may dislike.

1. First, determine whether HIPAA actually applies

HIPAA generally applies to covered entities (such as healthcare providers, health plans, and clearinghouses) and their business associates. A consumer-facing mental-health app isn't automatically covered merely because it handles mental-health information. HHS specifically notes that information voluntarily entered into an app that isn't offered by or on behalf of a HIPAA-regulated entity may fall outside HIPAA.

So don't treat a badge saying “HIPAA compliant” as the end of the investigation. Ask:

• Is the company itself a HIPAA covered entity or business associate?
• Whose behalf is it processing your information?
• Does it offer a BAA where one is appropriate?
• What categories of information are actually treated as PHI?
• Does HIPAA cover information collected by the consumer-facing app, or only information handled through a healthcare-provider relationship?

2. Compare the privacy policies, not just the marketing pages

For each platform, look specifically for:

Pay particular attention to vague phrases such as “business purposes,” “service providers,” “affiliates,” “partners,” and “de-identified information.”

3. Check the company's actual privacy history

A company's enforcement history can tell you more than a polished privacy page.

For example, the FTC alleged that BetterHelp shared sensitive information—including email addresses, IP addresses, and answers to health questions—with companies such as Facebook and Snapchat for advertising, despite privacy representations it had made to consumers. BetterHelp ultimately agreed to a $7.8 million FTC settlement and restrictions on sharing sensitive health data for advertising.

That doesn't necessarily tell you what BetterHelp's practices are today, but it is highly relevant historical evidence when comparing platforms.

4. Examine tracking separately from the therapy record

This is an especially important distinction. HHS says information collected by a mobile app operated by a HIPAA-regulated entity can constitute PHI, including information subsequently disclosed to tracking-technology vendors. But information voluntarily entered into a non-HIPAA-regulated consumer app isn't automatically protected by HIPAA.

For a privacy-conscious user, therefore, ask:

“Does this app send information about what I'm doing or what I'm seeking help for to analytics or advertising companies?”

rather than simply:

“Is this app HIPAA compliant?”

5. Look beyond HIPAA for consumer privacy laws

Depending on where the user lives, other laws can matter. State consumer-health-data and medical-information laws may apply even when HIPAA doesn't. This is particularly relevant in states with comprehensive or specialized health-data privacy regimes.

6. Give each platform a consistent score

A practical comparison could use a 0–2 scale:

• 2 = strong/clear protection
• 1 = ambiguous or mixed
• 0 = weak/unfavorable

Score each service on:

1. HIPAA applicability clearly explained
2. BAA availability where relevant
3. No targeted advertising using health information
4. Minimal third-party tracking
5. No sale/share of sensitive health data
6. Clear retention limits
7. Meaningful deletion rights
8. Encryption/security information
9. Transparent breach practices
10. Clear AI/data-training policy
11. Limited third-party disclosures
12. Favorable regulatory/enforcement history

Then compare the total score and the individual red flags, rather than relying on a single “HIPAA compliant” yes/no label.

A useful bottom line

For a person choosing among popular therapy platforms, I'd prioritize them roughly in this order:

1. What data does it collect? → 2. Who receives it? → 3. Is it used for advertising/AI? → 4. Can I delete it? → 5. What security protections exist? → 6. Does HIPAA actually apply?

That's more informative than treating HIPAA as a universal privacy certification. HHS itself makes clear that HIPAA's applicability depends on the entity and relationship involved.

If you're comparing specific platforms such as BetterHelp, Talkspace, Headspace, Calm, Wysa, and Teladoc, I can also make a current side-by-side comparison of their HIPAA status, data collection, advertising/tracking, deletion policies, AI practices, and regulatory history.

Comparing HIPAA compliance and data privacy practices across mental health apps and teletherapy platforms requires looking past marketing claims . Many direct-to-consumer apps operate in a regulatory gray area where federal health privacy laws do not apply, meaning standard app store ratings or download counts tell you very little about safety.

A step-by-step approach can help users and clinicians systematically evaluate and compare these platforms:

1. Determine HIPAA Applicability (Covered Entity vs. Consumer Wellness)
   • Verify whether the platform is legally bound by HIPAA. HIPAA generally only applies if the platform acts as a "covered entity" (like a healthcare provider) or signs a Business Associate Agreement (BAA) to protect Protected Health Information (PHI).
   • Standalone mood trackers, AI chatbots, and meditation apps often classify themselves as general wellness tools, meaning they fall outside HIPAA and are legally permitted to share or monetize non-clinical data.
2. Consult Independent Expert Evaluation Databases
   • Review pre-assessed ratings from trusted digital health evaluators rather than relying solely on the company’s website.
   • Utilize resources like the Mozilla Foundation’s *Privacy Not Included guide or research tools referencing the American Psychiatric Association (APA) App Evaluation Model . These frameworks explicitly score data sharing, encryption standards, and user control policies.
3. Interrogate the Privacy Policy for Data Sharing and Tracking
   • Read the app’s privacy policy to see if it shares de-identified or behavioral data with third-party tracking networks (e.g., Meta/Facebook Pixel, Google Analytics). High-profile Federal Trade Commission (FTC) enforcement actions against platforms like BetterHelp and GoodRx highlight that many apps historically transmitted health-related interactions to advertisers despite general privacy assurances.
   • Look for explicit commitments stating that the platform never sells data or uses health/mood inputs for targeted advertising profiles.
4. Audit Technical Safeguards and Encryption
   • Check if the platform utilizes end-to-end encryption (E2EE) or zero-knowledge encryption for messaging, journal entries, and video sessions, meaning even the company cannot read your personal inputs.
   • Assess account creation security: Does the platform mandate strong password requirements or multi-factor authentication (MFA), or does it force/encourage login integration via social media accounts (like Google or Facebook sign-in), which widens the data-sharing footprint?
5. Examine Data Deletion and Retention Policies
   • Determine whether the platform allows you to completely delete your account and all associated personal data permanently, or if they retain logs indefinitely under the guise of "analytics" or "service improvement".
   • Check if they offer true anonymity options (such as using a pseudonym or non-identifiable login) for basic tracking or community features.

Would you like help evaluating a specific app or teletherapy platform , or do you need recommendations on how to check mobile device permission settings for privacy?