Screen Privacy for Therapists: Protecting Session Notes and Client Records in 2026

It's 4:55pm. Your 5pm session is in the waiting room. You're finishing a progress note from the previous client when the door opens and your next client walks in three minutes early because the receptionist let them through. Your screen is still showing the previous client's name, their primary diagnosis, and a line of session notes. They saw it. They won't say anything. But you know.

This kind of exposure happens in therapy practices every week. Session notes, treatment plans, billing codes, intake forms are all on your screen all day. Here's a guide to keeping it private.

What's on a therapist's screen

Almost everything you do is regulated PHI:

• Session notes with direct quotes, presenting issues, clinical observations
• Treatment plans with diagnoses and goals
• Patient intake forms with full histories, medications, abuse history
• Billing codes that themselves reveal diagnoses (F33.1 means recurrent major depression; F43.10 is PTSD)
• Telehealth platform tabs with patient names in window titles
• Email or secure messaging with patients between sessions
• Insurance authorizations detailing covered diagnoses and session counts
• Consultation notes with colleagues mentioning patients by name

A waiting-room glance at a session note can tell a stranger more about your client than the client has told their own family.

Where shoulder surfing happens for therapists

The places aren't dramatic, which is why they're easy to underestimate.

Your office desk facing the door, with the screen visible to anyone walking in. The shared admin area where you sign progress notes between sessions. The waiting room TV that's actually a touchscreen showing the day's calendar with patient initials. The home office where your partner walks through to grab coffee. The café where you do supervision notes on a Friday afternoon. The car between your part-time positions when you finish a note in the parking lot and a colleague walks past.

The most common therapist screen leak isn't a hacker. It's the next client walking in three minutes early.

Group practices are particularly tricky. Shared rooms, hot-desking, and patients who pass each other in narrow hallways all create exposure points that solo practitioners don't face.

The unique risks for therapists

The regulatory and ethical surface is steep:

• HIPAA Privacy Rule requires reasonable safeguards against incidental disclosure. Screen exposure to a non-authorized person in your waiting room is exactly the scenario the rule covers.
• HIPAA Security Rule requires technical safeguards. Screen locks, encryption, and access controls are explicitly called out.
• State licensing board rules: every state has confidentiality requirements that go beyond HIPAA in some areas. Violations can mean license suspension.
• APA Ethics Code 4.01-4.07 governs confidentiality in detail. Inadvertent disclosure to another patient can be a reportable violation.
• State mandatory breach reporting: many states require notification of clients and the state when PHI is exposed, even briefly.

The clinical risk is just as real. A patient who sees another patient's name on your screen may lose trust in your ability to keep theirs private. That ruptures the therapeutic relationship and can drive them out of care.

Practical methods that work

What therapists in HIPAA-aware practices actually do:

1. Position your monitor away from the door. The most-trafficked sightline should never include your screen. Rearrange the desk if needed.
2. Auto-lock at 1 minute of inactivity. Five minutes is too long when a client walks in early.
3. Privacy filter on the laptop if you carry one between offices or do supervision in cafés.
4. Close every patient's chart before opening the next. Don't leave previous-session notes visible while you set up for the next client.
5. No patient names in window titles. Most EHRs (SimplePractice, TherapyNotes) have a setting to anonymize titles. Turn it on.
6. Separate user account on shared home computers, never the one your family uses. With FileVault on macOS or BitLocker on Windows.

For more options, see privacy filters vs software.

Where camera-based detection fits in

Privacy filters and auto-lock help, but the highest-risk moment in a therapist's day, the next client walking in while the previous note is still open, isn't fully solved by either. Camera-based detection uses your webcam to notice when someone is in the room with you and shows a small live preview in the corner of your screen. You see the door open in the corner before you look up.

It's not a substitute for closing charts and locking screens. It's the warning system for the seconds in between.

It runs locally. The video stream never leaves your machine, which matters for HIPAA technical safeguards.

FAQ for therapists

Does a privacy filter satisfy HIPAA?

It contributes to "reasonable safeguards" under the Privacy Rule but doesn't satisfy it alone. You also need access controls, audit logging, breach response procedures, and training. Think of the filter as one layer.

What about telehealth when the camera is in use?

You can run camera-based detection alongside most telehealth platforms because they share the camera feed at the OS level. Check your platform's documentation; some lock the camera exclusively, in which case detection pauses during the session, which is usually fine because the door is closed anyway.

Are scratch paper notes safer than the screen?

Paper has its own problems (must be shredded, not searchable, more easily lost), but for short between-session jotting, it can reduce screen exposure. Just make sure paper goes into a locked drawer before the next session starts.

We built Peeker for exactly the moments between sessions when a screen is open and a door might open with it. It quietly shows the corner of the room in the corner of your screen. For the broader topic, see how to prevent shoulder surfing at work.