Cybersecurity leaders threat-model everything, including themselves. When a CISO or security architect starts to wonder whether the 2 a.m. pages, the board briefings, and the breach that never quite ends have become more than stress, the next question is rarely "Should I see someone?" It is "What record will that create, and who will be able to read it?"
That question has a cost. CEREVITY's 2026 report, "Why Executives Wait 21 Months for Therapy," reviewed 307 executives who sought therapy through the CEREVITY network, and found a median of 21 months between first recognizing significant strain and a first session. Uncertainty about where a record ends up was one of the reasons people gave. In my experience, security people feel that one more than most, partly because they know what a background check can see about therapy is only one piece of the trail.
I spent about 20 years in healthcare IT, including running IT operations for a national mental health company. Here is the data a typical therapy visit actually generates, which parts carry real risk, and how to choose care with a smaller footprint.
The inventory: what one insurance-billed visit creates
1. A scheduling and intake record – Name, contact details, date and time, often an intake questionnaire. It lives in the clinician's scheduling system and electronic health record (EHR), and frequently in a separate patient portal or telehealth platform.
2. The clinical record – Progress notes, diagnosis, medications, and session dates sit in the EHR. HIPAA gives extra protection to "psychotherapy notes," the clinician's separate private notes, which generally need your specific authorization to release. Routine progress notes and the diagnosis are not in that protected category.
3. The claim – To be paid by insurance, the clinician submits a diagnosis code (ICD-10), a procedure code for the type and length of session (CPT), the date, and the provider. Claims usually pass through a clearinghouse on their way to the payer. The 2024 Change Healthcare ransomware attack is the reminder here: Change Healthcare later estimated that about 190 million people were affected.
4. The explanation of benefits – The payer sends an explanation of benefits (EOB) to the plan subscriber. If that is your spouse or a parent, they see the provider and the date.
5. Pharmacy claims – Any prescription moves through a pharmacy benefit manager and becomes part of your prescription history, which life and disability underwriters commonly ask permission to review when you apply for individual coverage.
6. The app and web layer – Booking pages, portals, and telehealth apps can carry the same analytics and advertising code as any other website. In March 2023, the U.S. Federal Trade Commission announced a proposed order against BetterHelp, saying it shared consumers' email addresses, IP addresses, and health questionnaire information with Facebook, Snapchat, Criteo, and Pinterest for advertising, with $7.8 million returned to consumers. Downstream, a 2023 Duke University study by Joanne Kim contacted 37 data brokers and found 11 willing and able to sell data about Americans' mental health conditions.
Realistic risks versus imagined ones
The imagined risk is usually the employer reading your therapy notes. In a group health plan, HIPAA bars the plan from handing your identifiable health information to your employer for employment decisions, and an employer-sponsored EAP should report only aggregate numbers. Your manager is not getting your diagnosis.
The realistic risks are less dramatic and more likely. A breach at a vendor or clearinghouse. Tracking code on a portal. A family member opening an EOB. A "utilization report" for a team of six that makes it easy to guess who used the benefit. If you work for a health system, a colleague with access to the same EHR. And a permanent diagnosis code in your claims history, because insurance does not pay without one.
None of that is a reason to avoid care. It is a reason to treat care like any other system you would review before trusting it with sensitive data.
A checklist for choosing care, for yourself or your team
For yourself
1. Ask how the visit will be paid. Private-pay or out-of-network care paid directly does not send a claim to your plan, so items 3 and 4 above never happen. It does not mean no record: the clinician still keeps one, as they are required to.
2. Ask where the record lives. Which EHR, who has administrative access, and how long records are kept and destroyed, since state law sets minimum retention periods.
3. Look at the booking page and portal yourself. Open the browser's developer tools and watch the network tab. If an advertising pixel fires on the intake form, you have your answer.
4. Ask what the clinician will release without your authorization. The answer should be narrow and specific, limited to legal requirements such as imminent safety risks.
For a team benefit
1. Require aggregate-only reporting, with small counts suppressed below a threshold you set in the contract.
2. Keep benefit use out of your own identity provider. Verify eligibility once and let the vendor hold the identity; single sign-on logs showing who opened a mental health portal are a record you created.
3. Ask for the vendor's list of subprocessors, their tracking and analytics policy, and their breach notification terms, exactly as you would for any other vendor handling sensitive data.
4. Make sure no one in your own wellbeing or HR function can see individual-level use. Segregation of duties belongs here as much as in finance.
The bigger exposure is waiting
Security teams are trained to accept residual risk when the control costs less than the loss it prevents. Apply the same logic here. The data trail from therapy can be made small and well understood. The trail left by 21 months of untreated strain is harder to scope: slower judgment in an incident, a key person who burns out mid-program, a leader who quietly leaves the field. Choose care you can trust, then use it before the strain chooses the timing for you.
[RELATED: See SecureWorld's coverage of mental health among the cybersecurity profession.]
