In my previous article, I explored why mental health platforms are falling short in supporting their providers, leaving therapists feeling under-compensated, overworked, and undervalued.
However, recent events have highlighted another major concern: these platforms aren’t just failing providers—they’re also putting patients at risk by failing to protect their most sensitive data.
A Disturbing Trend in Data Breaches
Just last week, a security breach involving Confidant Health, a mental health app, exposed over 1.7 million therapy logs of American patients.
Both Daily Mail and Wired reported that therapy session notes, patient diagnoses, and medication details were left exposed online due to poor security practices.
The breach, caused by a misconfigured Google Cloud database, remained publicly accessible until cybersecurity researchers discovered and reported it.
While the leak itself is alarming, it underscores an even bigger issue: mental health platforms are prioritizing growth and scalability over the privacy and security of their users. 
Why This Matters for Providers
For therapists working on these platforms, this isn’t just about data—it’s about trust.
As providers, therapists build relationships based on confidentiality and empathy. When platforms fail to secure patient data, they directly undermine this trust.
Therapists are left to deal with the emotional fallout, often without clear answers or reassurances from the platforms they work for.
This breach is a stark reminder that platforms need to do more than just compensate providers fairly—they must also protect the integrity of the care they deliver.
When patient data is exposed, the consequences can be devastating, both for the individuals affected and for the mental health professionals who serve them.
The Disconnect: Growth vs. Care
We’ve already seen how platforms are failing providers by prioritizing growth over well-being.
High caseloads, low pay, and minimal input from mental health professionals are common complaints.
Now, we’re seeing the same failure to prioritize the security of patient data.
It’s clear that in their rush to scale, many platforms have overlooked the critical importance of patient privacy.
In the case of Confidant Health, the breach occurred because of something as simple as a misconfigured cloud database—a preventable error that led to the exposure of deeply personal information .
The result? Patients are left vulnerable, and the therapists who care for them are left to pick up the pieces.
What Needs to Change
Platforms must reassess their priorities. Here’s what they need to focus on to regain the trust of both providers and patients:
- Data Security as a Non-Negotiable Priority: Mental health platforms need to prioritize robust security measures.
Storing sensitive patient data demands encryption, secure servers, and regular audits to ensure compliance with privacy laws like HIPAA.
This isn’t just about following regulations—it’s about protecting the trust that patients place in their therapists and the platform. - Transparency with Providers and Patients: When a breach occurs, platforms need to be fully transparent with both providers and users.
Promptly communicating the scope of the breach, the steps taken to secure the data, and the measures implemented to prevent future incidents is critical to rebuilding trust. - Investing in Provider Support: As I’ve previously discussed, platforms are already failing to support their providers.
Offering fair compensation is just one step. Mental health professionals need more say in how these platforms operate, particularly when it comes to safeguarding the well-being of their clients. - Provider-Patient Advocacy: Platforms should involve providers in decision-making roles, especially when it comes to security and privacy practices.
Therapists, as the front-line professionals, are in the best position to advocate for their patients’ confidentiality and to suggest solutions that uphold the ethical standards of the profession.
Equity: A Step Towards Accountability
As mentioned in my previous blog, creating an equity pool for providers can be a step towards aligning incentives and making providers true stakeholders in these platforms.
This approach would not only help ensure fair compensation, but also give therapists a stronger voice in the policies and decisions that directly impact their clients, including matters of security and privacy.
When providers have a stake in the platform’s success, they are more likely to push for changes that benefit both patients and themselves.
Offering equity can help balance the power dynamic, giving therapists more control over the standards of care they deliver, including the protection of patient data.
The recent Confidant Health breach serves as a wake-up call for the entire mental health industry.
Platforms need to prioritize more than just rapid growth—they need to protect the very people they serve, both providers and patients.
This includes implementing stronger security measures, offering transparent communication, and involving providers in the decision-making process.
Mental health platforms have a responsibility to their providers and their patients.
Without meaningful changes in how these platforms operate, both groups will continue to feel the effects of a system that prioritizes profit over care.
