What Your Insurer and Employer See When You File a Mental Health Claim

When you file a mental health claim, your insurer sees what it needs to pay the claim: who provided the service, the date, the service code and a diagnosis code. Your employer, in most cases, does not see your individual claims at all. Under the HIPAA Privacy Rule, a group health plan may share enrollment information and summary claims data stripped of individual identifiers other than five-digit ZIP code with the employer that sponsors it, and anything more detailed only for plan administration, under a written promise that the employer will not use it for any employment-related action or decision. The people most likely to learn about a claim are often closer to home: the policyholder who receives the plan's explanation of benefits (EOB) mail.

This article explains who sees what, how psychotherapy notes are treated differently, and the specific requests you can make to keep claim information private. It is general information, not tax or legal advice.

Who sees what: a summary

What your insurer sees on a mental health claim

A claim, or the superbill you submit for out-of-network reimbursement, usually lists the clinician's name and identifiers, the date of each visit, the place of service, procedure codes describing the type of visit, the fee, and at least one diagnosis code. Diagnosis codes come from ICD-10, the code set that applies to all parties covered by HIPAA. The diagnosis on a claim tells the insurer why the service was medically necessary; it is not a narrative of what you discussed.

Insurers use and disclose this information for payment and health care operations, which HIPAA permits. Payment covers activities such as determining coverage and reimbursement, and health care operations include things like quality review, audits, fraud detection and underwriting functions. For most of these uses, a covered entity must make reasonable efforts to use, disclose and request only the minimum information needed for the purpose.

Occasionally an insurer asks the clinician for more, such as treatment records, to review whether ongoing care is medically necessary. If that happens, ask your clinician what is being sent. Ordinary records requested for review are different from psychotherapy notes, which have stronger protection.

For how superbills are put together and submitted, see superbills and out-of-network claims.

What your employer can and cannot see

The employer as plan sponsor

HIPAA treats your group health plan as a covered entity, and sets rules for what the plan can pass to the employer that sponsors it. The plan, and the insurer or HMO offered through it, may give the plan sponsor enrollment and disenrollment information. If the sponsor asks, the plan may also give "summary health information," which summarizes claims history, claims expenses or types of claims experience and is stripped of all individual identifiers other than five-digit ZIP code, so the sponsor can obtain premium bids or change the plan.

For anything beyond that, the plan may disclose protected health information to the sponsor for plan administration functions only after the sponsor certifies that the plan documents have been amended to restrict its use, including a promise not to use or disclose the information for employment-related actions or decisions, or in connection with any other benefit plan. This matters most for self-funded plans, where the employer pays claims itself and some of its staff may help administer the plan; those staff are bound by the plan documents' restrictions.

The employer as your employer

Outside the health plan, HIPAA mostly regulates what providers and plans disclose, not what an employer may ask. Your employer can ask you for a doctor's note or other health information when it needs it for sick leave, workers' compensation, wellness programs or health insurance. But if your employer asks your health care provider directly, the provider cannot give the information without your authorization unless other laws require it. The Privacy Rule also does not protect your employment records, even if they contain health information, so anything you hand to HR becomes part of those records.

Practical takeaway: share the minimum on leave and accommodation paperwork. The guides to FMLA leave for mental health and workplace accommodations explain what those forms usually require. If you used an employee assistance program, EAPs vs private psychiatry covers what EAPs report.

Psychotherapy notes: the most protected category

HIPAA defines psychotherapy notes narrowly. They are notes a mental health professional records documenting or analyzing the contents of conversation during a private counseling session or a group, joint or family session, kept separate from the rest of your medical record. They exclude medication prescription and monitoring, session start and stop times, the types and frequency of treatment, clinical test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress.

A covered entity must get your authorization to use or disclose psychotherapy notes, with narrow exceptions such as the originating clinician's own treatment use, defending itself in a legal action you bring, oversight of the clinician who wrote them, averting a serious and imminent threat, or when required by law. A health plan may not condition payment, enrollment or eligibility for benefits on your signing an authorization, with limited exceptions that do not cover psychotherapy notes. In plain terms, your insurer cannot require your therapist's process notes in order to pay your claims.

Two caveats. First, not every clinician keeps separate psychotherapy notes; many keep only the regular record. Second, the regular record, including diagnosis, treatment plan and progress summaries, does not get psychotherapy-note protection. The article on requesting your mental health records explains your access rights, which also differ for psychotherapy notes.

EOBs and the policyholder: the most common privacy gap

If you are covered as a spouse, partner or adult child on someone else's plan, the plan's explanation of benefits and other claim mail may go to the policyholder by default. An EOB can show the clinician's name, the date and the service. For many people this is the most likely route by which someone learns about their mental health care.

Your federal right to confidential communications

Under HIPAA, a health plan must accommodate reasonable requests to receive communications by alternative means or at an alternative location if you clearly state that disclosure of all or part of the information could endanger you. The plan may require the request in writing, may require it to contain that statement, and may ask you to specify the alternative address or contact method and how any payment will be handled. A health plan may not question your statement of endangerment. Health care providers must accommodate reasonable requests for confidential communications without requiring you to explain why.

New York's rule

New York's Department of Financial Services states that New York Insurance Law requires an insurer to accommodate a reasonable request by a person covered by a policy to receive claim-related communications by alternative means or at alternative locations, if the person clearly states that disclosure could endanger them. Unless you consent, the insurer may not then disclose to the policyholder the nature of the services or the name or address of the provider. Insurers must have written procedures for making and revoking these requests, and DFS has drafted a sample confidential communication request form that an insurer may require. Like other New York insurance rules, it reaches plans regulated by the state. Self-funded employer plans can be exempt from the Insurance Law, but the federal HIPAA confidential communications rule above still applies to group health plans.

How to make the request

1. Call member services and ask for the plan's confidential communications request form.
2. State in writing that disclosure of all or part of your claim information could endanger you, and give the alternative address, email, portal account or phone number you want used.
3. Ask that EOBs for your claims be sent only to that contact, and whether you can set up your own online member account.
4. Keep a copy of the request and the date the plan confirmed it, then check the next EOB to make sure it went where you asked.

Paying out of pocket to keep a claim off your plan

HIPAA gives you one more option. A health care provider must agree to your request not to disclose information to your health plan about a service you, or someone other than the plan on your behalf, have paid for in full, when the disclosure would be for payment or health care operations and is not otherwise required by law. In practice, if you pay a clinician in full and do not submit a claim, and you ask the clinician not to send that information to your plan, the clinician must honor the request.

The trade-off is cost: no claim means no reimbursement, and the expense does not count toward your deductible. Some people use this for an initial evaluation and file claims later, or keep certain services private while claiming others. If you will pay yourself, the Good Faith Estimate rules apply, and a health savings or flexible spending account may still be used; see using an HSA or FSA for psychiatry.

Common worries, answered plainly

What this article does not cover: life, disability and long-term care insurance applications, which can ask about your mental health history directly and have their own rules. If you are applying for one, answer truthfully and ask the insurer how it uses the information.

A privacy checklist before you file

Most privacy surprises come from not knowing how a plan handles mail and online accounts. Before you submit the first mental health claim, work through this list:

• Find out who the policyholder is and where the plan sends EOBs: paper mail, email, or an online account that the policyholder can open.
• If you are a dependent on the plan, ask whether you can have your own member login, and file a confidential communications request if you need one.
• Ask your clinician which diagnosis and service codes will appear on the superbill or claim, so nothing on the EOB is unexpected.
• Decide whether there are any visits you prefer to pay for in full and keep off the plan, and tell the clinician in writing.
• Keep copies of what you submit and of every EOB, which you will need if you have to appeal a decision. The article on appealing a denied mental health claim explains that process.
• Read your clinician's notice of privacy practices; it explains how that practice uses and discloses health information.

Parents of minors should know that HIPAA generally treats a parent as the child's personal representative, with some exceptions, and that state rules on minors' consent to certain care can change who controls the information. Ask the clinician how they handle a teen's records and insurance claims before care starts.

How Dr. Lewis's practice handles claims

Dr. Lewis's practice is out of network with all insurance plans, and payment is due at the time of service. It provides a superbill (an itemized statement) in the patient portal after each session, which you can submit to your insurer for possible out-of-network reimbursement; for BCBS, Aetna or Cigna plans, it can facilitate submitting the out-of-network claim for you. If there is a visit you want to keep off your plan, say so to the team before any claim is filed. The practice's HIPAA Notice of Privacy Practices describes how it uses and discloses health information, and the insurance and payment page explains reimbursement. More on paperwork and costs is in the choosing psychiatric care guide.

Frequently asked questions

Will my diagnosis show up on my employer's reports?

Not with your name on it. Summary health information given to an employer is stripped of identifiers other than five-digit ZIP code. More detailed information can go to the employer only for plan administration, under a certification that it will not be used for employment decisions.

Can I ask my psychiatrist to leave the diagnosis off my superbill?

A claim normally includes a diagnosis code, which the insurer uses to decide whether the service is covered, so a superbill without one is unlikely to be reimbursed. If you do not want a diagnosis sent to your plan, the alternative is to pay in full and not submit a claim.

Can my insurer deny a claim because I refuse to release my therapy notes?

A health plan may not condition payment or eligibility on your authorizing release of psychotherapy notes. It can ask for other parts of the record, such as treatment plans and progress summaries, to review medical necessity.

I am on my parent's plan. Will they see my therapy claims?

They may see EOBs by default if the plan sends them to the policyholder. Ask the plan for confidential communications, in writing, stating that disclosure could endanger you, and give your own address or online account.

Does a self-funded employer plan mean my employer sees my claims?

It does not give your employer free access. Before the plan shares identifiable information with the employer for plan administration, the employer must certify that it will not use it for employment-related actions or decisions, and staff who administer the plan are bound by those plan document restrictions.

Sources

1. Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services, Office for Civil Rights, 2025. hhs.gov
2. Employers and Health Information in the Workplace. U.S. Department of Health and Human Services, 2020. hhs.gov
3. 45 CFR 164.504 Uses and disclosures: Organizational requirements. Electronic Code of Federal Regulations, 2026. ecfr.gov
4. 45 CFR 164.522 Rights to request privacy protection for protected health information. Electronic Code of Federal Regulations, 2026. ecfr.gov
5. 45 CFR 164.508 Uses and disclosures for which an authorization is required. Electronic Code of Federal Regulations, 2026. ecfr.gov
6. Confidentiality for Victims of Domestic Violence. New York State Department of Financial Services, 2026. dfs.ny.gov
7. ICD-10. Centers for Medicare & Medicaid Services, 2026. cms.gov
8. Insurance Circular Letter No. 23 (2009): Thirty-Six Month State Continuation Benefit Required by Chapter 236 of the Laws of 2009. New York State Department of Financial Services, 2009. dfs.ny.gov

Educational information, not medical, tax or legal advice. Decisions about diagnosis, medication and treatment belong with a clinician who knows your history.