Yes. We are held to a high standard of confidentiality and privacy through HIPAA and our ethical codes. There are some exceptions to confidentiality/privacy, including maintaining safety, suspected abuse, legal proceedings, and to obtain payment, including from insurance companies.
It is important to remember that most insurance companies require a diagnosis for treatment. Also, by using your insurance company, you consent to some disclosures. Usually, these are limited to diagnosis and basic treatment information; however insurance companies do have a right to audit files, including progress notes and treatment plans.