Telehealth is now standard in mental health practice. Therapists conduct sessions via Zoom, Doxy.me, SimplePractice, and VSee. Each platform captures the therapist's screen when screen sharing is used for worksheets, assessments, or psychoeducation materials. And each capture risks exposing patient information that HIPAA requires therapists to protect.
The Specific Risks for Therapists
Electronic health records. Epic, SimplePractice, TherapyNotes, and other EHRs display patient names, dates of birth, diagnoses, and medication lists in persistent headers and sidebars. A screen share of a worksheet can accidentally include the EHR interface behind it.
Calendar notifications. "Session with [Patient Name] — 3pm" appears as a banner during a session with a different patient. The first patient's name is now visible to the second patient.
Email previews. Insurance denials, pharmacy communications, or colleague consultations appear in Outlook or Gmail notifications with patient-identifying information.
Browser tabs. "Depression Screening — [Patient Name] — Google Docs" is visible in the tab bar when switching to a shared worksheet.
Notes applications. Therapists often keep process notes or supervision questions open during sessions. These are protected under HIPAA and must not be visible to the patient.
HIPAA Requirements Relevant to Screen Sharing
The Minimum Necessary Standard requires covered entities to limit PHI access to the minimum necessary to accomplish the intended purpose. Sharing your entire desktop with a patient exceeds the minimum necessary because it exposes all open applications, not just the intended material.
The Administrative Safeguards require workforce training and access management. If a therapist accidentally exposes patient data during a screen share, the practice must document the incident, assess harm, and potentially notify the patient and HHS.
We wrote about the broader GDPR and regulatory risks of screen capture here.
The NoCapture Setup for Therapists
Step 1: Identify all PHI surfaces
- EHR (SimplePractice, TherapyNotes, Epic, Cerner)
- Calendar (Outlook, Google Calendar with patient names)
- Email (all client communications)
- Notes app (process notes, supervision questions)
- Browser tabs (patient portals, research, documentation)
- Messaging (colleague consultation about cases)
- Billing and insurance portals
Step 2: Build a "Session" routine
Cloak all of the above. Mask titles. Suppress notifications. Save it as a routine that you trigger before every telehealth session.
Step 3: Live preview before sharing
Open the worksheet or material you intend to share. Open live preview. Confirm that no EHR sidebar, calendar notification, or browser tab is visible. This takes 5 seconds and creates a defensible record of due diligence.
Step 4: Focus Mode
Enable Focus Mode so the Session routine auto-applies when Doxy.me, Zoom, or SimplePractice begins screen sharing. This removes the risk of forgetting to activate protection before a session.
Platform-Specific Notes
Doxy.me: Uses browser-based screen sharing. NoCapture cloaks browser tabs and native apps from the capture stream regardless of whether the platform is browser-based or native.
SimplePractice Telehealth: Built on Zoom. Same capture APIs apply. NoCapture works identically.
VSee: Native application with screen sharing. NoCapture excludes designated windows from VSee's capture path.
The Limitation
NoCapture stops software capture. It does not stop a patient from recording the session with their phone. It does not prevent the therapist from intentionally sharing a window that contains PHI. It is a technical control, not a replacement for clinical judgment.
For the highest-risk sessions, consider whether screen sharing is necessary at all. Sending materials through the platform's secure document sharing may be safer than broadcasting them.
NoCapture provides OS-level window cloaking, title masking, and notification shielding for Windows. Free for two windows. Because "being careful" isn't a strategy.
