I am a therapist, at least in America you should know that your therapy records are not fully confidential and are subject to subpoena. They are confidential in the way that if a cop asks for them I will tell them to fuck off, or if a random person does the same thing applies.

But you should be fully aware that psychiatric and medical records do not have the same rights that you would have with a lawyer or a clergy member during confessional. If I see you, my records are eventually subpoenaed, and I refuse to release them I can be held in contempt and potentially jailed. I can also be compelled to testify but this is extremely uncommon, basically unheard of.

This is absolute bullshit and a good therapist should do two things: they should make this clear to you and they should document in a way that skirts the line between “enough to pass an insurance audit” and “as vague as humanly possible”. There are many ways to go about this.

Additionally if records are subpoenaed I can push back against the subpoena. However, this can be difficult and very expensive. In my experience subpoenas will essentially request everything. “Records including patient notes, assessments, treatment plans, billing information, medical imaging, etc etc etc for the entire duration of treatment”. Stuff that doesn’t even make sense for my scope of practice. This makes sense for them; might as well grab everything you can and avoid potentially missing some juicy detail.

Pushing back is tough though. In some instances I don’t have to; the client is aware of the subpoena and is fine with me releasing records. In instances where I can’t I need to retain counsel. My malpractice insurance provides counsel for this but they tend to provide super cheap lawyers from lawyer mills who are just making sure I’m not fucking up anything that would get myself sued. If I tell them I want to push back and avoid releasing they generally heavily discourage this and if really pressed will flat out refuse.

My only option at this point is to fire them and retain counsel at my own expense. Lawyers are goddamn thieves so this can easily cost 2-5,000 assuming it doesn’t end up in some huge battle where I need to retain counsel for weeks. Like many outpatient therapists I’m self employed so I have to just eat that cost (I think technically I can bill the client for it but that’s kind of fucked up so I’ve never looked into it). If they’re not independent like me and work for a larger agency they don’t have to eat the cost but they also usually don’t have the option to do this; most agencies are run by capitalistic cowards who will bend at the knee to avoid conflict and do not have any interest in principles or ethics

On the electronic medical record(EMR) front documentation management systems are fairly secure, or at least as secure as healthcare management systems can be. Psychiatric management systems are a double edged sword; we tend to have smaller boutique solutions tailored to meet our needs. Hospital networks and large medical agencies will generally have something by Epic or Oracle health.

These companies don’t bother with software packages for small practices like mine though, which make up the bulk of outpatient psychological care in America. They want the huge medical networks that will pay contracts of 150k/month. That makes them huge targets though. My software solution is niche and mostly unknown so hackers targeting it is far less likely. On the other hand the resources involved in securing it are far less.

A growing concern with all software solutions is integration of LLM nonsense to streamline writing progress notes. Generally they want us billing as much as possible so this is being pushed hard to raise utilization rates. Some software guarantees the models are sanitized and that once deployed data fed into the model isn’t used for refinement or reinforcement learning but not all guarantee this. This is concerning from a privacy standpoint. Some more intrusive versions record and process the audio of the entire session and spit out a progress note, which is real gross

As for a cellphone being present, I don’t know how to get around that. Normally I would say I don’t think there’s much risk from a cellphone simply being present in the office but I stopped bringing mine in because i noticed the voice assistant would be accidentally invoked at times. I bring it in now because I have a cellphone that no longer runs a voice assistant. This is gonna be a tall order though. Everyone in the world has a phone on them all the time and they very rarely degoogle or disable siri

I don’t tell you this to discourage you from therapy. I tell you this to encourage you to make an educated decision when you select a practitioner. If confidentiality and privacy are meaningful issues to you (and they should be) when you do your consult or first visit ask about how the therapist handles subpoenas, ask about how they handle documentation knowing subpoenas are a risk, ask if they use AI summarization tools.