xTherapy: Mental Health Data Protection

The Problem

Mental health and substance abuse treatment records have the strongest legal protections (42 CFR Part 2) but the weakest technical protections. A single EHR breach exposes the most stigmatized health data.

42 CFR Part 2 requires explicit patient consent for every disclosure of substance abuse treatment records. But EHR systems store these records alongside general health data, creating inadvertent disclosure risks during care coordination.

Psychotherapy notes deserve even stronger protection — they contain the most intimate details of a patient’s life. Under HIPAA, psychotherapy notes have special status but are rarely technically segregated.

The Old Way

The PRIVATE.ME Solution

xTherapy XorIDA-splits mental health records so they are technically isolated from general health data. xRedact strips identifying information for research use. Consent is HMAC-chained and DID-signed.

Psychotherapy notes and substance abuse records are XorIDA-split across independent custodians. Access requires patient consent via xLock push-auth plus threshold reconstruction. General EHR access never reaches these records.

Research access uses xRedact to strip identifying information before sharing. Consent records are HMAC-chained so every disclosure is tamper-evidently logged for 42 CFR Part 2 compliance.

The New Way

How It Works

xTherapy layers XorIDA split-storage on top of EHR systems with xRedact de-identification and HMAC-chained consent management.

Use Cases

Integration

import { MindVault } from '@private.me/xtherapy';

const vault = await MindVault.create({
  patientDid: patientDid,
  custodians: [providerA, providerB, backupNode],
  threshold: { k: 2, n: 3 }
});
await vault.store(therapyNote, { consent: consentToken });

Security Properties

Verifiable Data Protection

Every operation in this ACI produces a verifiable audit trail via xProve. HMAC-chained integrity proofs let auditors confirm that data was split, stored, and reconstructed correctly — without accessing the data itself.

Ready to deploy xTherapy?

Talk to Ren, our AI sales engineer, or book a live demo with our team.

Ship Proofs, Not Source

xTherapy generates cryptographic proofs of correct execution without exposing proprietary algorithms. Verify integrity using zero-knowledge proofs — no source code required.

Use Cases