Therapy Confidentiality in Colorado: What Stays Private, What Does Not

In crisis or thinking about suicide? Call or text 988 now (in Colorado it reaches the 988 Colorado Mental Health Line). If you are in immediate danger, call 911.

Why privacy is worth understanding first

Therapy depends on being able to talk openly, and that is hard if you are not sure who will hear it. Some people hold back in early sessions because of that worry. Knowing the rules can make it easier to speak freely.

The short version is on the practice's FAQ page: therapy is confidential, with a few exceptions required by law. This guide explains what those exceptions are, where they come from and what they mean for you.

The Colorado rule: private unless an exception applies

C.R.S. 12-245-220 says a licensed, registered or certified mental health professional may not disclose, without your consent, anything you tell them or any advice they give you in therapy. The same duty covers their employees and associates, clerical or professional. In group therapy run under a licensed professional's supervision, the other group members may not share what they learn about you without your consent.

Colorado also requires your therapist to tell you in writing, at the first contact, that what you share is legally confidential except as this law allows. The disclosure statement guide covers that form. The law lists these exceptions, where a therapist may share information:

• You, or your heirs, file a lawsuit or complaint against the therapist about your care.
• The state board, a hospital's governing board, or a professional review committee you signed a release for reviews the therapist's work.
• A client of any age makes an articulable and significant threat against another person or themself, or acts in a way that creates one. The law limits that disclosure to appropriate school staff, law enforcement and the person threatened.
• Another law requires the disclosure, such as child abuse reporting or the duty to warn.
• Different rules can apply in criminal and juvenile delinquency cases.

Duty to warn and child abuse reporting

Duty to warn. Under C.R.S. 13-21-117, if a client tells a mental health provider about a serious threat of imminent physical violence against a specific person, or people tied to a specific place or group, the provider must make reasonable and timely efforts to notify those people. The provider must also notify law enforcement or take other appropriate action, such as hospitalization.

Child abuse and neglect. C.R.S. 19-3-304 names psychologists, social workers, licensed professional counselors, marriage and family therapists, unlicensed psychotherapists and candidates among the people required to report. When they have reasonable cause to know or suspect that a child has been abused or neglected, they must report it to the county department, local law enforcement or the state child abuse hotline. Since September 1, 2025, the report is due as soon as reasonably possible and no later than 24 hours later.

The 2025 changes also say a reporter may not make a report because of a family's or child's race, ethnicity, socioeconomic status or disability, and that concerns based only on things like housing, income or clothing, or on disability, do not trigger the duty. If an adult client describes abuse from their own childhood, the duty generally does not apply unless the therapist has reason to suspect the person who did it is harming a child now or holds a position of trust with children.

HIPAA, psychotherapy notes and your records

HIPAA, the federal health privacy law, applies to most health care providers that do certain business electronically, such as billing insurance. The U.S. Department of Health and Human Services (HHS) says it generally treats mental health information like other health information, with one big exception: psychotherapy notes.

Psychotherapy notes are a therapist's own notes analyzing what was said in a session, kept separate from the rest of your record. They do not include medication details, session times, the type and frequency of treatment, test results, or summaries of your diagnosis, symptoms, treatment plan and progress. HHS says a provider usually needs your authorization to share psychotherapy notes, even with another provider, except where another law requires it, such as abuse reporting or a duty to warn.

You have a right under HIPAA to see and get a copy of most of your record, but psychotherapy notes are excluded from that right. Colorado's rule in C.R.S. 12-245-220 applies to every Colorado mental health licensee, registrant and certificate holder, whether or not HIPAA covers them.

Technology adds one more rule. Since August 12, 2026, Colorado therapists need your written consent, after telling you in writing what it is for, before using artificial intelligence to record or transcribe a session (C.R.S. 12-245-224.5).

Insurance, family members and teens

Insurance. HIPAA lets providers use and share health information to get paid, and requires covered providers to limit what they share to the minimum needed for the purpose. Mountainside does not bill insurance directly; it gives clients superbills they can choose to submit for possible out-of-network reimbursement, so what reaches your insurer depends on what you send.

Family and friends. HHS says covered providers may share information with family or friends involved in your care unless you object. Colorado's rule requires your consent for disclosure, so therapists usually ask you first who they may talk with.

Teens and parents. HHS says parents are generally the personal representatives of their minor children, and that state law sets when a minor can consent to care and what is shared with parents. In some circumstances, Colorado lets a mental health professional provide outpatient psychotherapy to a teen 12 or older without a parent's consent (C.R.S. 12-245-203.5). The guide on supporting a teen in therapy explains that law, and how to talk to your teen about therapy covers explaining privacy to a teen.

One more note: Mountainside's privacy policy covers its website, such as contact forms and cookies, and says it applies only to online activity. Your clinical records are covered by the laws on this page. If you see a therapist by video, the telehealth guide covers privacy at home.

Putting it to use, and when this is not enough

At your first session, it is reasonable to ask your therapist to walk through which exceptions could apply to you and how they would handle them. Therapists usually welcome that question. If you are a parent and teen starting together, hear the ground rules in the same room.

If you are thinking about suicide, the privacy rules should not keep you from getting help. Therapists usually respond to suicidal thoughts by working with you on safety, and you can call or text 988 at any time.

Frequently asked questions