Confidentiality: An Overview

Every therapist knows that confidentiality is a necessary part of therapy. Clients need to be assured that what they talk about in our offices will stay in our offices, unless they give their clear, specific, written consent to us to release information to other specifically designated people. It can even be said that without a client’s expectation of confidentiality, therapy is less likely to even occur. Yet for an issue that lies at the very heart of therapy, therapists and clients alike have an imperfect and often inaccurate understanding of what constitutes confidentiality and its limits and obligations. A 1986 study, for example, by Miller and Thelen found that 69 percent of clients believed that everything they shared with a therapist would be strictly confidential. And 79 percent thought that everything they shared with a therapist should be confidential. Both these statements display a lack of knowledge on the part of clients about the legal and ethical obligations of confidentiality. Their erroneous assumptions also imply a failure on the part of therapists to adhere to a fundamental precept of confidentiality: our obligation to clearly explain, at the onset of therapy, about confidentiality.

There are several key concepts that underlie confidentiality which therapists need to know about and adhere to. First, there’s the issue of informed consent. It is the therapist’s obligation to educate clients ahead of time about the limits and protections of confidentiality. This is so key that failure to do so may result in legal and professional sanctions. Therapists who wait until a situation arises to inform clients that confidentiality is not absolute have waited too long; if a client has not been informed, at the beginning of therapy, that everything he or she says does not fall under absolute confidentiality, and a situation comes up in which the therapist needs to divulge information, merely informing the client at that time–even if the therapist obtains written consent to divulge–will not sufficiently protect the therapist from a client’s legal complaints. Although informed consent should be considered an ongoing process, it’s especially important to address it at the beginning of therapy. Informing clients at the beginning of therapy about confidentiality is not just a matter of legal protection. Miller and Thelen’s 1986 survey of therapy clients found that many clients wanted to be informed at the beginning of therapy about the limits and privileges of confidentiality. It’s important to note that most clients will not ask about such things. In addition, the APA Code of Ethics (2010) specifically states in Standard 4.01, Maintaining Confidentiality, “Psychologists have a primary obligation and take reasonable precautions to protect confidential information….” Standard 4.02, Discussing the Limits of Confidentiality goes on to state that psychologists are guided to discuss all reasonably expected limits to confidentiality from the outset of the professional relationship and to then update this on an ongoing basis over the course of the professional relationship as circumstances change. Similarly, Section 1.07 of the National Association of Social Workers Code of Ethics states that discussions of confidentiality “should occur as soon as possible in the social worker/client relationship and as needed throughout the course of the relationship.”

It is important to understand the distinctions between confidentiality and privilege. Basically, confidentiality is an ethical term, usually spelled out and governed by professional organizations’ codes of ethics. Privilege is a legal term. Therapists need to understand the protections and limits of both.

Limits to confidentiality: Although many clients believe that everything they say in therapy is confidential, there are, of course, several exceptions to confidentiality. Many of these exceptions concern mandated reporting around such issues as suspected child abuse and neglect, suspected danger to oneself or to others, and abuse or exploitation of the elderly or other people dependent upon someone. It is important to know the specific laws around mandated reporting in your state, as they often vary. Here are some of the more common mandatory reporting conditions:

• suspected or known abuse or neglect of a minor
• suspected or known abuse, neglect, self-neglect, or exploitation or a vulnerable adult
• responding to a threat to do imminent lethal harm to an identified victim
• a client’s statement indicating the possibly of doing imminent lethal harm to oneself
• a lawful court order which requires the release of confidential information
• when clients waive their confidentiality privilege by disclosing the existence of the professional relationship in a legal venue
• complying with managed care or insurance requirements for a treatment plan or utilization review (if such a provision is specified in the client’s contract with their insurer)
• responding to a complaint against the therapist made to a licensure board, ethics committee, or in a court of law
• sharing requested information with the parent or guardian of a minor who is in treatment with the therapist

Confidentiality with Minors. When clients are minors, because they are not legally authorized to consent to their own treatment, the parent or guardian holds the privilege of confidentiality. This means that the parent or guardian also has legal access to all treatment information. Thus, it is important to not promise minor clients that everything they say will stay in the office. Navigating this, especially with adolescent clients, requires clinical sensitivity and skill. Confidentiality expert and psychologist Jeffrey Barnett points out that therapists should discuss confidentiality issues with both the client and parent, acknowledging the parent’s legal rights in this situation to both the parent and child, and acknowledge to both that the adolescent’s need for privacy is an important component of effective therapy. The consent agreement should include a provision that the therapist will disclose to the parent any information indicating that the minor is at imminent risk of harm to self or others that can not be adequately addressed in treatment. “Imminent harm” needs to be clearly defined; parents may have a quite different idea of what constitutes imminent harm than the therapist does. (Often, disagreements such as this may become a focus of treatment). Barnett suggests spelling out, for example, that “the therapist will not inform parents or guardian of a 17 year old minor’s intention to smoke a cigarette or drink a beer, but would do so if a 13 year old minor disclosed the intention of intravenous drug use and unprotected sex with an adult.” After such a discussion, he says, the parent may consent to modify their legal rights through a written informed consent agreement. As with all informed consent agreements, the terms should be spelled out as specifically as possible. (See Consent Agreements).

In some states minors over age 16 and “mature” or “emancipated” minors (usually those who are married or in the military) have the same rights as adults to consent to treatment. They may consent to their own treatment and they can decide who may have access to their treatment information. Some states have provisions for young children to consent to treatment: if they are mature enough to consent; if not having access to mental health services may put them in increased danger of abuse; or other reasons.

Consent Agreements. Basically, with the exception of minors and some other cases in which the client is incapable of providing consent, therapists must not share client’s information with anyone without the client’s written consent. For minors, the therapist must obtain the consent of the parent or guardian. Consent agreements must be as specific as possible and include the following components:

• name of person or agency to whom information will be released
• purpose of releasing the information
• type of information
• date for which agreement is in effect, including an end date
• right of patient to revoke agreement
• signature of patient and therapist

It is important to keep in mind and honor the specific terms of the agreement and to not go beyond it. For example, if the agreement authorizes the forwarding of the results of an evaluation to a minor client’s school, it does NOT authorize sharing additional information with the school’s representatives if they contact the therapist with additional questions. Likewise, sharing additional information, such as family dynamics or a parent’s mental health issues may exceed the authorization provided and thus violate confidentiality.

When treating couples, families, and groups, each participant’s privacy must be protected, and the informed consent must clearly articulate the expectations of all individuals involved. Each group member must agree not to share confidential information outside the group treatment setting. The therapist is not legally responsible if individual group members violate the confidentiality agreement, as long as the therapist can document that he has made a good faith effort to preserve confidentiality. The legal doctrine that if something is not written down, it does not exist is valid here; it is essential to have group members sign an understanding of confidentiality rules. The therapist must also stress to group members the importance of respecting and protecting each participant’s confidentiality and make this a clear prerequisite for treatment.

One individual may not authorize the release of confidential information for another individual. In couples counseling, for example, both individuals must provide written authorization to release the treatment record.

How to share information. If disclosure of the client’s identity is not necessary, therapists must take reasonable steps to protect each patient’s anonymity. This holds true even even when consulting with colleagues. Such conversations should take place in private settings. Therapists must not discuss clients with family, friends, and others. There have been examples when friends of clients have heard therapists discussing the client with friends in public settings. Therapists who find themselves discussing clients informally should view this as not only a serious violation of confidentiality and privacy, but perhaps as an indication of burn-out or poor boundaries, and they should seek consultation, therapy or other peer support.

When releasing information to third party payers, therapists should share only the minimum amount of information needed to meet utilization review requirements. This is also a good rule to follow when releasing subpoenaed information.

Subpoenas and Court Orders. When clients become involved in legal proceedings–for example, in lawsuits, divorce and custody proceedings, or criminal cases–therapist records may be requested. It is best to avoid the temptation to be an advocate, and in such cases, you should always seek qualified legal advice before responding to any requests. Often, your malpractice insurance company may advise you. There is a natural tendency to panic when notified by legal authorities and to want to turn over all requested clinical records. Do not panic, and seek advice first–and not from the party requesting the records. Simply turning over the requested records may be the worst thing you can do in these situations.

It is important to understand the distinction between subpoenas and court orders. A subpoena is a document from an attorney that is typically registered with the clerk of the court. Despite appearing to be a legal order, it is actually a request, although some attorneys will hope that you perceive it as an order. When receiving a subpoena, contact the client to see whether the client wishes to waive his privilege and allow you to release the requested records. If so, and you obtain that waiver in writing, you can do so, again, making sure that you comply only with what is requested. If your client does not wish to waive his privilege, you must not release the records and must maintain the client’s confidentiality. This does not mean that you can merely ignore the subpoena. You must respond, stating that the client has exercised his or her right to privilege and that you are unable to release the records. This is usually the best time to consult your own attorney, either through your professional association, malpractice insurance company, or by hiring an attorney directly.

A court order, on the other hand, is issued by a judge and must be responded to regardless of whether the client waives his privilege. Nevertheless, you should still follow the same steps above. If your client refuses to waive privilege, your attorney can file a motion for an in-chambers review by the judge. The judge may insist upon the order being fulfilled, vacate it, or limit the amount of information requested. The judge may authorize only the release of selected relevant information from the clinical record, and not the entire treatment record. But if the judge orders the release of the records and/or your testimony, even if the client refuses to give permission, you must comply with the judge’s order or face contempt of court charges.

Unintentional Release of Information. There are numerous ways in which therapists may unintentionally release information. Therapists may be held legally responsible for these. It is the responsibility of the therapist to anticipate these circumstances. Barnett lists several examples of unintentional releases of information:

• Inadequate soundproofing and setup of the office. Nothing a client says in a therapist’s office must be overheard by others outside the office. Adequate soundproofing measures must take into account overwrought clients who may occasionally shout. Soundproofing measures may include insulation inside walls and above suspended ceilings, a solid office door with a rubber strip at the bottom, and music or white noise in the waiting area and hallway. It is advisable to test the soundproofing with a colleague. The physical layout and setup of offices are also important in preserving confidentiality. Sliding glass barriers should be considered to separate support staff from clients in the waiting room when support staff is on the phone or disclosing information. Records should be stored out of sight of individuals in the waiting room. Confidential materials should not be left in areas where unauthorized individuals may have access to them. These may include such things as appointment books. Barnett recalls seeing an office in which patients’ charts for the day were visible on a rack on his credenza. Although each chart was closed, the patients’ names were visible to anyone who entered the therapist’s office.
• Failure to adequately train staff and subordinates to appropriately protect confidential information and failure to adequately supervise them. Mental health professionals are legally and ethically responsible for the ethical conduct of their employees and subordinates. Each new employee must be trained about their obligation to preserve clients’ privacy. In case of legal action, it may be necessary to produce records showing that staff has been adequately trained, and so a written confidentiality agreement should be signed by each staff member. It is advisable to periodically review and retrain staff. It is important to remember that non-mental health professionals will not automatically be aware of or sensitive to issues of confidentiality. Training should include admonitions to refrain from discussing confidential information in the waiting area, in public places, or with unauthorized individuals such as clients’ family members, friends, or with other staff members. They must be instructed to never release confidential information without appropriate authorization, and that this includes even an acknowledgment that an individual is receiving professional services in your office. Training should cover specific, concrete examples. For example, if a child’s school counselor calls and requests certain information for an important school meeting to benefit that child, staff should be reminded that no information, even a verification that the child is receiving services, can be released without appropriate signed authorization from the client or parent.
• Using various media and technologies to communicate confidential material. Computers, cell phones, voicemail, answering machines, fax machines, photocopiers, and other equipment have become standard parts of practice. Without proper precautions, each may be a significant threat to confidentiality.
• Telephones, voice mail and answering machines. Because many clients have multiple phone numbers, it is important to clarify as part of intake which phone number(s) clients wish to be contacted on. Some clients will want to be contacted only at their home phone, while others may want to be contacted only at work. Others will prefer only their cell phone. Leaving a message which can be retrieved or overheard by people other than the client is a breach of confidentiality. It is not just the content of the message which may be a breach, but in some cases a client has not informed a family member or significant other that s/he is in therapy. Therefore, it is important to clarify if a client’s voicemail or answering machine is private and confidential or if they may be accessed by others. Even if a client gives permission for the therapist to leave messages, therapists must exercise extreme care in phrasing their messages. Messages should be intentionally vague, with as little information and words as possible and should not identify you as a mental health professional. Barnett recommends that one NOT leave a message such as: “Hi. This is Dr. Barnett calling. I need to reschedule our next psychotherapy session to later in the day on Thursday. Please give me a call here at the clinic.” Instead, he recommends something like: “Hi. This is Jeff Barnett calling. Please give me a call about our appointment.” When leaving a message with someone else, and they ask for more details, it is best to just request the client return your call.
• Cell phones. Cell phones carry no expectation of privacy. They can be intercepted by some AM radios and other cell phones. Clients should be informed of this during the informed consent process.
• Photocopying machines. It is good practice to have a paper shredder beside the photo copier machine. Simply crumpling up a document and tossing it in a wastepaper basket is a violation of confidentiality. And as anyone who has ever used a photocopier knows, leaving a copy of a document face down on the glass and forgetting about it happens all too often.
• Fax machines. Confidential information should be faxed to third parties only with consent from the client. All faxes should include a cover sheet which stipulates that the material is confidential. Cover sheets should include a notification that if the fax is received in error, the sender should be immediately notified and that the faxed documents should either be shredded or returned. Accidentally dialing an incorrect number constitutes a breach of confidentiality: always review the fax number to ensure it is correct prior to sending the fax. It is important to confirm by telephone who will have access to the fax when it is received. Merely sending a fax to a right number, where anyone may retrieve it or where it may lie in view of people other than the intended recipient violates confidentiality.
• Computers. All confidential materials on a computer must be password protected and all computers must have virus and firewall protection (Barnett & Scheetz, 2003). All confidential material should be backed up on computer disk or external device and these should be stored securely. It’s not a legal defense to say that your computer crashed and that you lost data. Do not walk away from your computer while working on confidential material; a screen saver is not protection. Your passwords should contain multiple letter and number combinations that cannot easily be guessed by others. Email is NOT confidential; it is akin to sending confidential information on a postcard. (Barnett, 2000). Anyone with moderately sophisticated computer skills can have easy access to all emails sent from or to a given computer, and every email passes through, and is stored on, servers between your computer and the computer you are sending to. Deleted emails are also accessible to anyone with a minimum of computer skills.
• Failure to utilize appropriate techniques when storing or destroying out of date records. Different jurisdictions have different requirements for the length of time records must be retained. Generally, records must be kept for at least five years, but it is often longer. For minors, records must sometimes be maintained until the age of 21, or for the time period specified for adults’ records. At a minimum, all confidential records should be stored securely, usually in a locked file cabinet in a locked area. Never leave file cabinets unlocked or records lying on a desk awaiting filing. Obsolete records must be shredded or incinerated.
• Failure to safeguard clinical information when utilizing a collection agency. Although there is a clinical debate over whether therapists should use collection agencies, professional ethics codes and state laws typically allow it when attempts to collect fees from a client are unsuccessful. It is advisable to address the possibility of collection agencies during the initial informed consent process. If attempts to collect directly from the client fail, and a reasonable payment plan cannot be agreed upon, the client must then be informed once again of the possibility of the use of a collection agency. The therapist may then utilize a collection agency or other legal means. However, the only information that may be shared with the collection agency is the client’s name, the dates of service, and the fees owed. No clinical information such as CPT codes, indications of the type of service or diagnosis should be shared.
• Out of office contacts. It is always possible to cross paths with clients outside the office—in the locker room at the health club, on the street, in church or synagogue, at community meetings. Rather than wait for this to occur, it’s best to plan for such unexpected meetings during the informed consent process at the onset of therapy. Without advanced planning, some clients might feel insulted when their therapist ignores them in a public place. Others might feel that their privacy is violated if their therapist does acknowledge them. Barnett suggests letting clients know in advance that you will follow their lead in such situations. If they say hello first you will say hello back. But if they choose to ignore you, you will not risk violating their privacy. That procedure covers chance meetings. But what about more complex situations, such as finding yourself serving on a committee with one of your clients. In such cases, Barnett advises saying nothing during the encounter and discussing what to do at the next therapy appointment.
• Interruption of services. What if you suddenly become seriously ill and cannot continue practicing? What if you die? What happens to your clients’ records in those cases? Although we don’t like to plan for these things, we have a professional obligation to do so. Each mental health professional should have in place a written agreement with another licensed mental health professional who will be immediately contacted if you cannot continue practicing. This written agreement, akin to a professional will, specifies your client list, their contact information, where their records are stored, and how to access the records. Once this other mental health professional is notified, s/he can take custody of clients’ records and ensure that each client is referred for ongoing treatment. Clients should know of this arrangement from the onset of treatment, as part of the informed consent. More information on a professional will can be found in Pope and Vasquez (2005).

Barnett, J.E. (2000). Email communications with patients: Ethics issues to consider. The Maryland Psychologist, 45 (3), 15.

Barnett, J.E. (2007). Efforts to protect our clients’ privacy: How much is enough? The Maryland Psychologist, 52(3), 30-31.

Barnett, J.E., Behnke, S., Rosenthal, S.L, & Koocher, G.P. (2007). In case of ethical dilemma break glass: Commentary on ethical decision making in practice. Professional Psychology: Research and Practice, 38, 7-12.

Barnett, J.E., & Scheetz, K. (2003). Technological advances and telehealth: Ethics, law, and the practice of psychology. Psychotherapy: Theory/Research/Practice/Training, 40, 86-93.

Miller, D.J., Thelen, M.H. (1986). Knowledge and beliefs about confidentiality in psychotherapy. Professional Psychology: Research and Practice, 17, 15-19.

Pope, K.S., & Vasquez, M.J.T. (2005). How to survive & thrive as a therapist: Information, ideas, & resources for psychologists in practice. Washington, DC: American Psychological Association

 
Top of Page