Let’s talk about Talkspace: An Intersection of AI and HIPAA
For physicians and other healthcare providers, AI is no longer a distant innovation. It is already reshaping how patients seek care, how records are created, and how sensitive health information is stored and shared. While these technologies can offer convenience and clinical efficiencies, they also carry privacy risks that are easy to underestimate.
Whether and to what extent these platforms comply with HIPAA privacy requirements can be a moving target. While you surely keep these considerations in mind in everyday communications with colleagues, family, and friends, you may not think that information shared with private online accounts will be stored, saved, and potentially discoverable in litigation.
Recently, a nurse practitioner, Jennifer Kamrass, APRN, sued her employer for pregnancy discrimination after she was terminated while nearly nine months pregnant. During the course of her employment, she had used Talkspace, a benefit provided through her insurance, to discuss her worries about work, supporting her family, and finding another nursing job so close to giving birth.[1] As part of their defense strategy, the employer’s lawyers subpoenaed the nurse practitioner’s Talkspace records, including her messages with her therapist. Unbeknownst to Ms. Kamrass, Talkspace had recorded and stored her texts, video and audio messages with her therapist. The parties to the lawsuit have publicly disagreed about whether the details of Ms. Kamrass’s therapy sessions were produced in response to the subpoena or whether she produced them.
What is Talkspace?
Talkspace is an online therapy and counseling platform. The usage of online counseling platforms has risen within recent years, and such platforms are now covered by many major health insurance plans. The site provides access to a licensed therapist; therapy sessions over video, voice, or live chat; unlimited messaging with a therapist; along with other services.[2]
However, Talkspace has collected user data from previous counseling sessions to craft an AI therapy bot, which allows for 24/7 chat capabilities regarding mental health issues. Talkspace boasts that it keeps conversations with its AI chatbot private and secure, compliant with AI regulatory requirements and are protected by data encryption; however, these protections still may not meet the privacy protection requirements mandated by HIPAA.
Talkspace also utilizes AI to assist in therapy services by creating personalized “podcasts” for its users, based upon the users’ sessions with their providers. The site also utilizes AI to create notes and summaries of sessions for providers’ review, which are often far more detailed than the notes or records a human therapist would take regarding a patient. The recording and storage of this personalized information creates serious privacy concerns for users and providers. For example, if the platform can utilize user information and data for advertising purposes or to fuel a chatbot, it is not clear whether the information (which might otherwise be covered by a more traditional legal privilege between a therapist and a patient) is truly protected as users expect.
Implications for Providers
Ms. Kamrass’s story has concerning implications for all individuals and providers. Talkspace bills itself as “online therapy.” Generally, we associate communications with therapists to be confidential, yet Ms. Karmass’s entire therapy transcripts were saved and produced. Talkspace touts itself as HIPAA compliant, yet the data stored by the app is only anonymized, rather than de-identified, as required by HIPAA. Data professionals are now learning that data that is anonymized may be easily re-identified.
HIPAA (the Health Insurance Portability and Accountability Act of 1996), prohibits the unauthorized disclosure of protected health information. The act defines “protected health information” as individually identifiable health information: (1) transmitted by electronic media, (2) maintained in electronic media; or (3) transmitted or maintained in any other form or medium. This includes medical records, medical bills, oral protected health information, among other forms of protected health information. In order to be HIPAA compliant, protected health information must be de-identified before its dissemination. This means that the documents must be stripped of anything that may identify a particular patient, such as names, addresses, discharge dates, phone numbers, names of relatives, etc.
As in the case of Ms. Kamrass, any information shared with an online platform, whether personally or professionally, may be disseminated. As such, all users should be mindful about what they are disclosing to these platforms, and providers in particular should abstain from sharing protected health information of their patients with these platforms.
Talkspace is not the only AI platform with cause for concern. There are other mental health platforms, such as Headway, Grow Therapy, and Klarify, which is an AI service that touts services for mental health providers. Even standard platforms, such as Claude, ChatGPT, Gemini, and CoPilot, are being used for tasks within the workplace. Now, AI platforms specifically made for healthcare use are starting to be launched. Information may be shared through talk therapy, as in the case of Ms. Kamrass, through conversations with chatbots, or by uploading or sharing documents. Without thorough and proper vetting, it is important to abstain from sharing protected health information with these platforms.
Should you choose to implement AI in your personal or professional life, be sure to review the terms and conditions of the platforms of your choosing. Even if a platform asserts itself as being HIPAA compliant, it is best to check with your practice’s leadership group or technology committee to learn more about your workplace’s AI and technology guidelines prior to use
[1] A. Gilbertson, Woman’s Talkspace Therapy App Sessions Exposed in Court, https://www.proofnews.org/womans-talkspace-therapy-app-sessions-exposed-in-court/
[2] Talkspace, Home, https://www.talkspace.com/.
Sarah R. Angelucci is an insurance and civil litigation attorney with Sturgill, Turner, Barker & Moloney, PLLC. She can be reached at sangelucci@sturgillturner.com or 859.255.8581. This article is intended as a summary of state and/or federal law and does not constitute legal advice.
This article originally appeared in the Lexington Medical Society July 2026 Newsletter.
