Confidentiality and its limits

The four layers

People often say “HIPAA” when they mean confidentiality in general. HIPAA is only the bottom layer. On top of it sit your state’s laws, your profession’s code and the policies of the place you work. Most days they agree. When they don’t, the rule of thumb is to follow whichever protects the client’s privacy most, unless a law requires you to disclose.

Two HIPAA details trip up new clinicians. First, HIPAA permits sharing between providers for treatment without a signed authorization, but many states and most agencies expect written consent for mental health information anyway. Second, “psychotherapy notes” has a narrow meaning: notes you keep separately from the record. Your progress notes, diagnosis and treatment plan are part of the record, and clients generally have a right to see them. More on that in documentation and notes.

Can I share this? Eight situations

Choose a situation to see the usual answer and what to do in the moment. The specifics depend on your state and your site, and as a trainee your first step in every one is your supervisor.

Mandated reporting

Every state requires therapists to report suspected child abuse or neglect. The standard is reasonable suspicion, not proof: you report what you have seen or been told, and child protective services investigates. In most states the duty is personal: telling your supervisor doesn’t satisfy it, though they should know and help. Reports made in good faith are protected from liability.

Most states also require reports of suspected abuse, neglect or exploitation of older adults or adults with disabilities, to adult protective services. Who counts, and who must report, varies. Financial exploitation, neglect and self-neglect can all qualify, not only physical harm.

Child abuse

Every state

Therapists are mandated reporters everywhere. Deadlines and the agency you call vary by state.

Elder or dependent adult

Most states

Reports go to adult protective services. Ages, definitions and who must report vary by state.

Past crimes

Generally not

A client’s past crime is usually confidential unless it involves ongoing abuse of a child or vulnerable adult, or a current threat.

How you report matters too. When you can do it safely, tell the client or family that you are making a report and why. It’s often less damaging to the relationship than they find out another way. Then document the facts, the words used, the time and who you spoke to.

Duty to warn and protect

In 1976, the California Supreme Court decided Tarasoff v. Regents of the University of California. A client had told his university psychologist he intended to kill a young woman, Tatiana Tarasoff; no one warned her, and he killed her. The court held that a therapist who determines, or should determine, that a client poses a serious danger of violence to another person must use reasonable care to protect that person. Its line is widely quoted in law and ethics courses: “The protective privilege ends where the public peril begins.”

States then went their own ways. Some wrote a mandatory duty into statute, some made disclosure permissive, a few rejected the duty, and the conditions differ (an explicit threat, an identifiable victim, the means to act). The National Conference of State Legislatures keeps the chart most often cited. As of its brief dated March 2022:

Mandatory

27 states

You must act when the conditions are met, for example by warning the person and notifying police, or by starting hospitalization.

Permissive

16 states

You may disclose to protect someone without breaching confidentiality, but the law doesn’t require it.

Both or mixed

3 states

Arizona, Delaware and Illinois have different rules in different statutes, often for different professions.

No duty

3 states

Maine, North Carolina and North Dakota. Georgia has no statutory duty but a narrower duty to protect through case law. Your ethics code still applies.

The labels hide a lot. California’s statute, for instance, is written as a limit on liability: a therapist is protected if, after a client communicates a serious threat of physical violence against a reasonably identifiable victim, the therapist makes reasonable efforts to warn the victim and notify law enforcement. New York’s duty (Mental Hygiene Law 9.46) is to report to state government rather than to warn the person. So read your own state’s statute, not just the label, and check the NCSL chart and your state’s board for any change since.

Whatever your state says, the clinical work is the same: take the threat seriously, ask about intent, plan and access to weapons, call your supervisor while the client is still with you if you can, and document what you assessed, who you consulted and what you did. HIPAA allows disclosure to someone able to prevent a serious and imminent threat, so federal privacy law is not what stops you. The next step, risk and crisis, covers the assessment itself.

Privilege, subpoenas and court

Privilege is the client’s right to keep what they told you out of legal proceedings. In 1996, in Jaffee v. Redmond, the US Supreme Court recognized a psychotherapist-patient privilege in federal courts, and applied it to a licensed clinical social worker. Every state has its own privilege law too, with exceptions, for example when a client puts their own mental health at issue in a lawsuit.

When a subpoena arrives, the usual sequence is:

1. Don’t ignore it, and don’t send anything yet.
2. Tell your supervisor and call your liability insurer’s risk management line.
3. Contact the client: do they want to authorize release, or object?
4. With no authorization, assert the privilege on the client’s behalf and wait for a court order.
5. If ordered, release only what the order covers, and document each step.

Minors, couples and families

With a minor, the parents usually hold the right to consent and to see records, but many states let minors consent to their own outpatient therapy above a certain age or in certain circumstances, and some limit what parents can see. In California, minors 12 and older can consent to outpatient mental health treatment in some circumstances. Other states set different ages and conditions, or none. Look up your state’s rule before your first minor client, and agree with the teen and parents at the start on what you will and won’t share.

With couples and families, decide your policy on secrets before you need it. Many relational therapists use a “no secrets” policy (what one partner tells you alone may come up in joint sessions); others hold individual confidences. Either can be ethical. What isn’t ethical is leaving clients to guess. Put it in your informed consent.

Myths worth dropping