Confidentiality for Mental Health Professionals: A Primer

By: Jeffrey E. Barnett, Psy.D., ABPP

 

Confidentiality is a foundational issue for mental health professionals. Without it, many individuals likely would not seek the professional services we offer. In fact, for psychotherapists, very often in the first three or four minutes of the initial meeting we may learn things about a client that no other person in his or her life knows. These may be secrets loved ones don’t know, underlying fears that have never been shared with another person, or reported behaviors that could result in the loss of one’s career, friends, or family if they were made public. But, to not share these issues with a mental health professional could result in the individual not receiving needed help to hopefully ameliorate and resolve these issues and concerns. The promise of a confidential professional relationship helps many individuals to receive the professional help they need.

It is this promise of confidentiality that is often of such great importance to those who seek out mental health treatment. In one landmark study on potential clients’ expectations regarding confidentiality Miller and Thelen (1986) found that 69% of all those surveyed believed that everything shared with a psychologist is completely confidential. That is, the majority of those surveyed believed that absolute confidentiality exists in the professional relationship with a psychologist. Further, 74% believed that everything shared in psychotherapy with a psychologist should be completely confidential. These authors also found that most individuals would want to know the limits to confidentiality prior to sharing personal information and that many believed that they would not share personal information if they knew in advance that it would not be kept in confidence.

The above study and others like it highlight the importance of the informed consent process for educating clients about confidentiality and its limits. The doctrine of informed consent stresses the importance of sharing with clients in advance or receiving services all information relevant to their decision to participate in the professional service. As highlighted by Miller and Thelen (1986) and many others, confidentiality and its limits are definitely such issues that prospective clients want to be informed about from the outset of the professional relationship. Further, the Ethical Principle of Psychologists and Code of Conduct (APA, 2002) states quite clearly in Standard 4.01, Maintaining Confidentiality, “Psychologists have a primary obligation and take reasonable precautions to protect confidential information…” (p. 1066). In Standard 4.02, Discussing the Limits of Confidentiality, psychologists are guided to discuss all reasonably expected limits to confidentiality from the outset of the professional relationship and to then update this on an ongoing basis over the course of the professional relationship as circumstances change.

There are a range of factors that may impact the preservation of confidentiality of information shared by clients. These may be either threats to privacy and limits to confidentiality. Threats to privacy typically include how confidential information is handled. Inappropriate disclosures in this area typically may be avoided by the use of good clinical practice, attention to the ethics code of one’s profession, and through the use of appropriate risk management strategies. Limits to confidentiality, or exceptions to confidentiality, are typically mandated by laws in one’s jurisdiction. These are not optional and must be complied with in order to not violate one’s licensure law and other relevant laws. These mandatory exceptions to confidentiality must be addressed through the informed consent process.

Threats to privacy may include:

• inadequate soundproofing and setup of one’s office.
• secretarial or support staff disclosing confidential information in front of other individuals.
• support staff not securing confidential materials.
• failure to adequately train staff and subordinates to appropriately protect confidential information and failure to adequately supervise them.
• discussing confidential information in a public setting where one may be overheard.
• using various media and technologies to communicate confidential material.
• mishandling out-of-office contacts with clients.
• failure to utilize adequate safeguards in the storage of confidential records.
• failure to utilize appropriate techniques when destroying out of date or obsolete records.
• sharing clinical information when utilizing a collection agency.
• sharing confidential information without appropriate authorization.
• releasing confidential information with appropriate authorization but going beyond the authorized limits of the release.
• interruptions in the mental health professional’s ability to provide services and manage the client’s confidential information.

Limits (or exceptions) to confidentiality may include:

• mandatory reporting requirements for suspected or reported abuse or neglect of a minor.
• mandatory reporting requirements for suspected or reported abuse, neglect, self-neglect, or exploitation or a vulnerable adult.
• responding to a threat to do imminent lethal harm to an identified victim.
• responding to a client’s statement to do imminent lethal harm to oneself.
• responding to a lawful court order that requires the release of confidential information.
• when a client waives her or his privilege by disclosing the existence of the professional relationship in a court or law or during a deposition.
• to comply with managed care or insurance requirements for a treatment plan or utilization review as specified in the client’s contract with their insurer.
• to respond to a complaint against the professional whether with a licensure board, ethics committee, or in a court of law.
• to share requested information with the parent or guardian of a minor who is in treatment with the professional.
• with the client’s specific written consent.

Threats to Privacy

There is much that mental health professionals may do to protect the privacy of their clients. It is important the inadvertent breeches of confidentiality be avoided. While no one is perfect and no one can anticipate and prevent all risks to privacy, the use of thoughtful and timely office practices that are sensitive to these issues is of great importance. Mental health professionals will typically be judged by their colleagues and by the legal system based on prevailing professional standards; that is, what would reasonably be expected of a prudent mental health professional in a similar situation and setting?

Inadequate Soundproofing

Each mental health professional has the obligation to ensure that meetings with clients are not overheard by others. Efforts to address this risk to privacy must keep in mind that many distraught clients may express themselves much more loudly than in typical conversation. To assess soundproofing needs one should have a colleague or staff member listen outside your office door and in the waiting area to see if they can hear you when you simulate how loudly clients may speak, yell, or cry. Then, one can add needed soundproofing. This can be done by placing insulation inside of walls and above suspended ceilings. Further, a solid door with a rubber strip at the bottom can be helpful as well. If these steps are either not possible or not fully helpful, the use of music in the waiting area and hallway or the use of white noise machines in these areas can be very effective.

Office Setup and Practices

The physical layout and setup of one’s office can have a significant impact on the protection of confidential information. For example, many offices will have support staff placed behind a glass barrier that can slide open to interact with clients in the waiting room. But, it can be closed when speaking on the phone and discussing confidential information. Records should be stored out of sight of individuals in the waiting room and confidential materials should not be left in areas where unauthorized individuals may have access to them. For example, in one colleague’s office the weekly appointment book was left open on the receptionist’s desk which is in the waiting area in plain view of any who might like to look at it. Another colleague kept all his charts for the day standing on a rack on his credenza. Each client’s name was visible to all those who entered his office. While these threats to privacy are significant it is hoped that it can be seen that preventing them is easily accomplished by use of thoughtful office practices.

The Role of Administrative and Support Staff

Each mental health professional is responsible for the ethical conduct of their employees and subordinates. Each new employee must be trained about ethical obligations to include the active preservation of each client’s privacy. A written confidentiality agreement should be utilized and signed by each staff member. Its content should be reviewed periodically and updated as needed over time. Each staff member’s active efforts to protect and preserve each client’s confidentiality should be addressed in their regular performance reviews to help ensure this issue is given appropriate importance and that efforts to protect each client’s privacy continue over time.

It should never be assumed that support staff are well versed in the ethics of our profession or that the share the same sensitivity or commitment to the maintenance of each client’s privacy. Staff must be trained not to discuss confidential information in the waiting area, in public places, or with unauthorized individuals such as their family members or friends. They must be instructed to never release confidential information, even the fact that a particular individual is receiving professional services at your practice, without appropriate authorization. For example, an individual may call your office and speak to the receptionist identifying herself as a particular child’s principal and requesting that certain information be provided for an important school meeting to benefit that child. With good intentions and a desire to be of assistance to one of your clients the receptionist may inappropriately breech confidentiality, thereby violating both ethics and law as well as potentially jeopardizing your ongoing work with this individual, and opening you up to potential liability. Thus, providing ongoing ethics training to staff, establishing specific staff policies and procedures for reasonably anticipated situations that might impact confidentiality, and providing staff with adequate oversight and supervision are each of great importance.

Consultations

All mental health professionals will consult with colleagues periodically in order to provide their clients with the best possible services. In fact, the use of consultation is a recommended strategy when faced with challenging or high risk clinical situations. But, just how the consultations are conducted may have an impact on clients’ privacy. First, unless otherwise authorized in state law, it is recommended that each client’s consent is obtained prior to discussing them with other individuals. Then, it is also recommended that identifying information be disguised or omitted unless clinically relevant to the needed consultation. The consultation should only occur in a private or protected setting and, for example, not in a public place such as a cafeteria or other public setting where one may be overheard. Finally, the colleague should be reminded that this is a confidential consultation and that all information shared as part of the consultation should be treated as such. No other disclosures of confidential information should be shared in public settings and information about clients should not be shared with one’s family or friends, regardless of the reason.

Use of Technology

It is widely accepted practice to use a range of technologies in our practices. Examples include the use of computers, cell phones and landline telephones, voicemail and telephone answering machines, fax machines, photocopiers, and others. Each may assist us to provide timely and effective services, increase our efficiency, and enable us to be more responsive to clients’ needs and requests. But, if not utilized appropriately they may each be significant threats to confidentiality.

Telephones are regularly used to conduct the business of one’s practice. They are used for scheduling and changing appointment times, responding to clients in between sessions, for conducting consultations, for utilization review, and for a wide range of other clinically relevant and appropriate matters. But, if not handled appropriately the use of the telephone brings with is many potential risks to privacy.

Many clients have multiple phone numbers. They may have a home phone, a work phone, and a cell phone. It is important to clarify during one’s initial contact with clients and prospective clients at which phone number they want to be contacted. To leave a message at a client’s home when family members have intentionally not been informed about the client’s treatment could have significant repercussions. For example, a client may be considering ending her marriage to an abuse spouse and is working on this in psychotherapy. The psychotherapy may need to reschedule an appointment and might quite innocently leave a message to that effect on the client’s home voicemail. Not knowing who may have access to that voicemail may result in the spouse overhearing about the ongoing psychotherapy, something that could result in a confrontation of the client by the spouse and perhaps undermine the psychotherapy.

Some clients will want to be contacted at their home phone number to keep their psychotherapy confidential from work colleagues. Others will want all calls to be to their work number to keep confidential matters from family. Still others will prefer to be contacted on their cell phone. Again, it is important to clarify this from the outset. It is also important to clarify if a client’s voicemail or answering machine are private and confidential or if they may be accessed by others. When they may be accessed by others extreme care should be taken in formulating the messages one leaves. In these situations messages should be intentionally vague and should not identify you as a mental health professional. For example, it is recommended that one not leave the following message: “Hi. This is Dr. Barnett calling. I need to reschedule our next psychotherapy session to later in the day on Thursday. Please give me a call here at the clinic. Thanks.” Rather, it would be best for the message to be: “Hi. This is Jeff Barnett calling. Please give me a call about our appointment.” Similarly, when leaving a message with a secretary at a client’s office or with a family member at a client’s home, one should be similarly vague. For example, in addition to just using one’s fist and last name and not identifying yourself by profession, if a secretary asks what your call is in reference to it may be best to just say that you are returning her call.

Cell phones are a great convenience. They enable mental health professionals be available to clients when out of the office and for clients to contact us at their convenience. But, they do bring risks with them. Some cell phone frequencies may be intercepted by some AM radios and nursery monitors (Barnett, 1994). Thus, this potential risk should be shared with clients and unless they agree during the informed consent process, confidential information should not be discussed via cell phones. But, due to their ubiquitous nature their use may be unavoidable. Therefore, clients should be apprised of their possible risks in advance.

Photocopying machines are of great value in running one’s practice. But, they are imperfect as are the individuals using them. We may often have a copy of a confidential document that comes out too dark or too light and thus needs to be discarded. Simply crumpling it up and tossing it in a trashcan would be inappropriate and places confidentiality at potential risk. All such materials should be shredded prior to them being discarded. Further, this is another example of an issue to address in the ethical training of staff members that impacts one’s office practices.

Fax machines similarly are of great value for sharing needed clinical documents, reports, and records in a timely manner. Rather than wait for needed documents to be received through the mail, a fax can send a needed evaluation report or treatment summary almost instantaneously. But again, several risks to confidentiality exist in the use of this valuable technology. First, as always, confidential information should only be sent to third parties with appropriate consent from the client and only the information authorized should be sent. Second, a cover sheet should be utilized with all faxes that highlights the confidential nature of the materials that accompany it. It should notify the recipient that if the fax is received in error that the sender should be notified at the telephone number provided and the faxed documents should either be shredded or returned. Next, it is important to be sure that the correct number is inputted when dialing the intended recipient’s fax number. It is best to always visually review the fax number to be sure it was input correctly prior to pushing the ‘send’ button. Finally, it is important to confirm by telephone who will have access to the fax when it is received. For example, is an evaluation report being sent to the teachers’ workroom at a local school? Is the fax going to a central area where unauthorized individuals will have access to it? Will the intended recipient even be there to receive the fax transmission? A telephone call before sending the fax can help clarify all this and help ensure that the intended recipient is present when the transmission is being received.

The use of computers is of great value to many mental health professions. They may be used for administering and scoring tests, for doing documentation, for submitting bills, and for communicating with clients in between sessions. It is of vital importance that all confidential materials placed on a computer be password protected and that all computers have virus and firewall protection (Barnett & Scheetz, 2003). Doing so will help minimize the risk of unauthorized access to the confidential material as well as their unauthorized release. All confidential material should be backed up on computer disk or external device and these should be stored securely. When leaving one’s computer while working on confidential materials it is important to not just walk away expecting the screen saver to maintain privacy. Anyone may simply bump into the computer and the confidential material would be there for them to read. Again, everything should be password protected and passwords should contain multiple letter and number combinations that can not easily be guessed by others. For example, simply using your pet’s name or the date of your anniversary are not considered effective passwords.

It may be very useful to be able to utilize computers to keep in contact with clients in between appointments. However, both mental health professional and client must understand in advance that there are great risks that come with this practice. It is said that an email communication is similar to sending a postcard rather than a letter in a sealed envelope (Barnett, 2000). Anyone with moderately sophisticated computer skills can have easy access to all emails send from or to a given computer. Once an email is sent or deleted from one’s computer it does not disappear. Rather, it is stored in a server where it may be accessed anytime in the future. Thus, these are issues of great importance to address fully with clients as part of the informed consent agreement. Yet, for those who accept these risks computers may be utilized very effectively such as for scheduling and changing appointments rather than ‘playing phone tag’.

Out of Office Contacts

Whether one works in a small town or a large city, it is possible to cross paths with clients outside the office. This can be as simple as walking past a client in a local store or as complex as attending the first meeting of a committee one has joined and finding one’s client there as well. It is best to address such issues from the outset during the informed consent process. For incidental contacts, such as the first scenario above, it is best to have previously found out the client’s preferences. Some clients might be insulted if their psychotherapist ignored them in a public place. Others could feel that their privacy was violated if the client was with others and did not want the fact that they knew this mental health professional known to others. Frequently, it is best to let clients know in advance that you will defer to them in these situations. If they say hello first you certainly will respond, following their lead. But, if they choose not to greet you you will be respectful and not risk violating their privacy. In other situations such as the second scenario above the challenges are more complex. They may include both privacy and multiple relationship issues. If for example, you are not comfortable serving on a committee with one of your clients it is best that the issue be addressed at the next scheduled appointment. Nothing should be said or disclosed at the committee meeting that would indicate that you are this individual’s psychotherapist. Protecting you client’s privacy, even about the existence of the professional relationship, if of great importance.

Record Storage and Disposal

Each mental health professional must follow their applicable state laws regarding record retention. Each jurisdiction may have different requirements for the length of time records must be retained but each requires that records be maintained. In Maryland, for example, all licensed health professionals are required to document all professional services that they provide. Further, they must maintain these records for five years from the date of last professional contact. For minors, the records must be maintained for this time period or the age of 21, whichever is later (COMAR, 2002).

All confidential records should be stored securely. Typically this will mean that records are not left laying out for others to read them in our absence and that they are kept in a locked file cabinet that is in a locked area that does not provide access to unauthorized individuals. Keys should be kept securely and out of sight. While certainly more can be done to prevent the unauthorized access to confidential records, the prevailing professional practice standard is applied. Thus, there is no requirement to use extreme and costly measures to protect records such as the use of expensive alarm systems, steel doors, chains and padlocks around file cabinets, and the like (Barnett, 2007). But, carelessly leaving file cabinets unlocked, leaving client records laying on a desk waiting for them to be filed, and not securing keys may each be easily avoided but very costly threats to the protection of confidential information. Further, as has been mentioned with unneeded photocopies, when records are destroyed in accordance with relevant state law, they must be shredded or incinerated. Simply placing them in a sealed trash bag and leaving them for trash pickup represents and unneeded risk and falls well below accepted professional standards.

Use of Collection Agencies

Mental health professionals may be authorized to use the services of a collection agency if their attempts to collect fees owed by a client are unsuccessful. Professional ethics codes and relevant state laws typically authorize this. For example, The Ethical Principles of Psychologists and Code of Conduct (APA, 2002) states that:

If the recipient of services does not pay for services as agreed, and if psychologists intend to use collection agencies or legal measures to collect the fees, psychologists first inform the person that such measures will be taken and provide that person an opportunity to make prompt payment. (p. 1068)

It is important to address this possibility during the informed consent process at the outset of the professional relationship. Then, if a client does not pay their bill for services rendered it is important to attempt to collect the payment through direct contact with the client. If this fails, and a reasonable payment plan can not be agreed upon, the client must then be informed once again of the possibility of the use of a collection agency and be given the opportunity to avoid this occurrence. If the client still refuses to pay the outstanding bill mental health professionals may then utilize the services of a collection agency (or other legal means such as small claims court) to collect the debt. But, the only information that may be shared with the collection agency is the client’s name, the dates of service, and the fees owed. No clinical information such as type of service provided (e.g., individual psychotherapy, psychological testing, etc.) or diagnosis may be shared. In effect, only the minimum information needed to have the debt collected may be shared.

Sharing Confidential Information – Unauthorized

In addition to the inadvertent and inappropriate breeches of confidentiality already reviewed, several other situations exist with warrant discussion. When providing professional services to more than one individual additional threats to privacy exist. Thus, when treating couples, families, and groups special steps must be taken to protect and preserve each participant’s privacy. In each of these situations the informed consent process must clearly articulate the expectations of all individuals involved. Thus, for groups it is important to ensure that each group member agrees not to share confidential information with others outside of the group treatment setting. While the mental health professional can not guarantee what group members will do or not do in between sessions, they can still make their reasonable good faith effort to stress to group members the importance of respecting and protecting each participant’s confidentiality. Mental health professionals can stress that this is a requirement for ongoing participation in treatment. Further, it is essential that mental health professionals demonstrate the importance protecting each group member’s privacy by setting a positive example through their own actions.

Sharing Confidential Information – Authorized

With regard to releasing confidential information with a client’s consent it is important to not that one individual may not waive privilege (legally authorize the release of confidential information) for another. Thus, in couples counseling both individuals must provide written authorization to release the treatment record. One partner may not authorize the release of the other partner’s confidential material in the treatment record. This should always be clarified up front in the informed consent process with all couples and families. When providing group psychotherapy the situation is more easily addressed since one should keep a separate treatment record for each group member. However, when working with couples and families it may not be feasible to use this practice.

Clinical work with minors (individuals not legally authorized to consent to their own treatment due to their age) it is important to understand that the parent(s) or guardian is the holder of privilege. Thus, under typical circumstances the parent(s) or guardian may have access to all treatment information. When treatment is being provided to a six-year old for example, this may not be a clinical challenge. But, when the client is an adolescent, and one who is typically brought to treatment by the parent(s) or guardian, this legal right may prove clinically problematic. How many adolescents will be willing to participate in psychotherapy and share personal and private information with a mental health professional knowing that anything and everything they share may be subsequently disclosed to their parent(s) or guardian?

In such situations, it is best to discuss this with client and parent, acknowledge the parent’s legal rights in this situation, and acknowledge the reality of the adolescent’s needs for privacy if treatment is going to be possible. Then, the parent(s) or guardian may modify their legal rights through the written informed consent agreement so that their adolescent child may be able to receive needed mental health treatment. An agreement will need to be struck that specifies that the mental health professional will disclose to the parent(s) or guardian any information shared that indicates the minor to be at imminent risk of harm to self or others that can not be adequately addressed in treatment. Specific examples will need to be provided to ensure each participant’s acceptance of this arrangement to ensure a clear understanding of the expectation of the psychologist (Barnett, Behnke, Rosenthal, & Koocher, 2007). For example, it is important for all involved to know in advance that the mental health professional will not inform parents or guardian of a 17 year old minor’s intention to smoke a cigarette or drink a beer, but would do so if a 13 year old minor disclosed the intention of intravenous drug use and unprotected sex with an adult. Since so much depends on the trust of the mental health professional to appropriately address such issues in treatment and to include the parent)s) or guardian only when necessary, such an open discussion with representative examples given is a necessary component of the informed consent process.

A final issue regarding the release of confidential information with a client’s authorization involves only doing so with written authorization and only to the extent authorized (Pope, 1991). For example, if one is authorized to forward the results of an evaluation to a minor client’s school there may not be authorization to share additional information with the school’s representatives should they contact you with additional questions. Sharing additional information, such as information you have about family dynamics or a parent’s mental health issues, may exceed the authorization provided and thus violate confidentiality.

Interruption of Professional Services

While one may not wish to consider this possibility, each mental health professional may at some time be unable to continue in practice. This may be due to the result of a health problem, becoming disabled or otherwise incapacitated, or as the result of one’s death. Should one of these events occur it may not be clear what will happen to each client’s treatment records. If arrangements are not made in advance to effectively address such a situation a client may find office support staff contacting them, accessing their treatment record, and perhaps even inappropriately disposing of it. To prevent such circumstances from occurring it is important for each mental health professional to have in place a written agreement with another licensed mental health professional who will be immediately contacted should you be unable to continue in practice. This written agreement, a professional will, specifies your client list, their contact information, where their records are stored, and how to access the records. Once contacted, this other mental health professional can take over custody of clients’ records and be sure that each client is referred to an appropriate mental health professional for all needed ongoing treatment. Failure to have such an arrangement in place can result in chaos, confusion and trauma for clients, and possibly the inappropriate management of their confidential treatment records and information. It is best to have a professional will in place and to share of its existence with each client from the outset of treatment. Guidance on developing a professional will can be found in Pope and Vasquez (2005).

Exceptions to Confidentiality

A wide range of mandatory exceptions to the notion of absolute confidentiality exist and are typically codified into state law. It is important that each be fully discussed at the outset of the professional relationship as part of the informed consent process and updated over time as is relevant and appropriate.

Reporting Child Abuse and Neglect

Every state has a law that requires all licensed health professionals, among others, to report all suspected, observed, and reported abuse and neglect of a minor that one becomes aware of in our professional role. It is of great importance that each mental health professional be well acquainted with the provisions of their state’s law since there are some differences in these requirements from state to state. This will be especially relevant for those mental health professionals licensed and providing professional services in multiple jurisdictions. One key issue in the law to be very familiar with is the specific definition of abuse and neglect. This may vary and attention to the specific definitions provided will help ensure that inappropriate breeches of confidentiality do not occur.

Minors are considered as vulnerable individuals under the law. They typically rely on their parent(s) or guardian for their care and well being and thus are vulnerable to exploitation and harm. The State has therefore created a statutory obligation for all licensed health professionals to report such abuse or neglect because of the likelihood that we will have greater access to this information than the average person. While our obligation to protect each client’s privacy is of vital importance, the protection of vulnerable individuals from harm is seen as a greater obligation. Yet, the breech of confidentiality is not absolute or unrestricted. The mental health professional is required to report all suspected abuse and neglect to the appropriate agency in their jurisdiction, not to make a general disclosure to the public, for example. Most laws specify the requirement to make a verbal report to the appropriate agency by telephone immediately upon learning of the abuse or neglect. Some jurisdictions further require that this verbal report be followed up with a written report to the same agency within 24 or 48 hours.

Some states require such reports of abuse and neglect be made regardless of the client’s current age and regardless of when the alleged abuse occurred. Thus, in some jurisdictions a mental health professional must make a report of alleged abuse of your 47 year old client when she was seven years of age. In other states the mental health professional is only required to make a report to the appropriate agency when the client is presently a minor. Thus, a lack of familiarity with one’s relevant statutes could easily result is an inappropriate violation of a client’s confidentiality. At the same time, failure to make mandatory reports of suspected abuse or neglect violates the legal rights of the client and may be placing her/him or others at unnecessary risk.

A helpful website has been developed by attorney, Susan Smith. This website, Mandatory Reporting of Child Abuse and Neglect, provides links to the relevant laws for each state along with useful definitions, links to each state’s reporting agency, and other relevant discussions. Accessing this site and becoming familiar with its content is recommended for all mental health professionals.

Reporting Elder Abuse

Most states also have similar mandatory reporting requirements either for the elderly or for the more general group of ‘vulnerable adults’. Similar to minors as described above, vulnerable adults are those adults who are dependent on others for their care and well being. This may include the elderly as well as others such as developmentally delayed adults, regardless of their age. These mandatory reporting requirements are codified into state law and again apply to all licensed health professionals in addition to selected others (typically police and other public safety officials). These laws may be broader than just a requirement to report suspected, observed, or reported abuse (sexual or physical) and neglect. They may additionally include exploitation and self-neglect. Thus a mental health professional may conduct a home visit of a client who is laying in bed in her feces, who hasn’t been bathed, and whose disability checks are being cashed by a family member and used for that family member’s leisure time activities and not for the client’s medication. Such a situation would need to be reported to the appropriate agency to ensure it is investigated and hopefully so that appropriate intervention occurs. And, as always, such potential exceptions to the promise of absolute confidentiality must be fully addressed in the informed consent process from the outset of the professional relationship.

Threats to Harm Others

Mental health professionals should be well acquainted with the legal ruling in the case Tarasoff v. Regents of the University of California (1976). This case resulted in an obligation for mental health professionals to exercise reasonable care to protect third-parties from foreseeable harm. This obligation has been codified into law in most jurisdictions and typically mandates that mental health professionals take all reasonable steps to protect an identified third-party from imminent lethal harm. While confidentiality has been discussed as a vital component of every the relationship every mental health professional has with clients, the ruling of this case and subsequent laws mandate an obligation for mental health professionals to take reasonable actions to prevent harm from occurring to others.

It is important to carefully study the relevant laws in one’s state. Some states define harm in terms of lethal intent. Others do not. The exact wording will be important to attend to so that the mental health professional does not inappropriately breech confidentiality. These obligations also do not pertain to reporting past criminal activity or past violent behavior, but attempt to strike a balance between the goal of protecting a client’s confidentiality and protecting others from foreseeable harm.

Numerous legal rulings have subsequently refined the original Tarasoff ruling and a thorough understanding of one’s applicable state law is essential. In several states the wording of such laws provides for the clinician to exercise their clinical judgment to ensure that harm does not occur. In these states, there is a duty to warn, protect, or treat. In essence, if treatment may be utilized to prevent the intended harm from occurring then the mental health professional does not need to breech confidentiality by contacting the police (protect) and the intended victim (warn). Thus, the obligation to protect may be discharged through a variety of means and the use of treatment, when relevant and possible, is a viable option for protecting the identified third party from harm without needing to breech confidentiality. However, if treatment efforts are not possible, or if used they cease to be effective, then the warning and protecting actions described above must be used. As always, this potential limit to confidentiality should be fully addressed during the initial informed consent agreement and updated and reviewed over the course of the professional relationship.

Threats of Self-Harm

Most states do not require the mandatory breech of confidentiality in situations where a client reports a threat to harm oneself, whether it be lethal or not. Mental health clinicians frequently think in terms of mandatory reporting requirements for threatened harm to self or others. But, the two should not necessarily be grouped together. Unless one’s state law specifies this, breeching confidentiality for threats of self-harm may violate state law. At the same time, prudent clinical practice might necessitate just such an action. Thus, regardless of the wording of one’s state laws on this matter, it is vital that all mental health professionals include a viable threat of self-harm as one of the limits to confidentiality that exist in the professional relationship. While this doesn’t mean that one must breech confidentiality in these situations, it is important to have to option to be able to if needed. For example, many clients may be effectively treated as outpatients with the active involvement, participation, and support of family members and/or friends. Further, being able to share information freely with family members and friends in these situations may be essential to provide effective treatment. Of course, clients can be hospitalized involuntarily in these situations, but that would be much more costly, potentially traumatic, and possibly less productive and helpful in the long run.

Subpoenas and Court Orders

Clients may at times be involved in legal proceedings. This may occur, for example, when a client is party to a law suit, if suing for custody of their children, or the like. In these situations it may be very tempting to immediately turn over all requested clinical records in order to avoid further legal difficulties. But, simply turning over the requested records may be the worst thing to do in these situations.

It is first important to point out the distinction between a subpoena and a court order. A subpoena is a document from an attorney that is typically registered with the clerk of the court. It is a legal document but it actually is a request, despite being presented as a legal requirement and demand by attorneys. The first step when receiving a subpoena is to contact the client and see if the client wishes to waive privilege and have you release the records in question. If so, you may do so. If not, you may not release the records in question but must maintain the client’s confidentiality. At the same time, you may not simply ignore the subpoena. It is important to respond to the subpoena, stating that the client has exercised his or her right to privilege and that you are unable to release the records. At this point in time it is usually best to obtain consultation from an attorney. Mental health professionals may consult attorneys through their professional associations, through their malpractice carrier, or by hiring an attorney directly.

A court order comes from a judge and must be responded to regardless of the client’s desires. At the same time, the mental health professional should follow the steps outlined above. Additionally, should a client still refuse to waive privilege an attorney can file a motion for an in-chambers review by the judge to see just what in the record is relevant to the case. In that situation a judge may only authorize the release of selected relevant information from the clinical record, and not the entire treatment record. But, if the judge orders the release of the records and/or the mental health professional’s testimony, even if the client refuses to give permission, the mental health professional must comply with the judge’s order or face contempt of court charges.

When a Client Waives Privilege

It is important to point out that anything shared in a legal proceeding is public record. Thus, any information any individual discloses during a deposition or in court as part of a legal proceeding becomes public record. Therefore, doing so with regard to the existence of one’s mental health treatment is considered waiving privilege. Thus, if a client shares any information about the existence of, or content from, their mental health treatment they have waived all privilege and can not regulate what information is shared in court and what information remains confidential. It is therefore very important that clients are informed of this prior to waiving privilege in this way. Otherwise, they may inadvertently breech their own confidentiality.

At the same time, individuals have historically been granted the legal right to privilege in state courts. Thus, they have the right to decide if they want to waive privilege and if they want to keep private the existence of their mental health treatment. Prior to 1996 this right to privilege in a legal forum did not extend to Federal courts. Then, in the case of Jaffe v. Redmond an individual’s right to privilege in the Federal courts was granted by the U.S. Supreme Court. The ruling granted psychotherapist-client privilege in the Federal courts. Prior to this case that privilege did not exist.

Managed Care and Insurance

When individuals purchase health insurance they must sign a contract with their insurer. When doing so, most individuals typically do not fully realize all that they are agreeing to. One stipulation of these contracts that is typically included is the authorization to conduct utilization review in the insurer’s efforts to manage the benefits of each policy and to ensure that they are not misused. Mental health professionals who provide clinical services to clients who utilize their insurance benefits will need to educate themselves about each client’s policy. Those mental health professionals who are in-network participating providers for an insurer will have signed a contract of their own with the insurance company that also authorizes utilization review. At times it may authorize a review of the entire treatment record. Typically, state laws regulate this and only information sufficient for determining the medical necessity of treatment must be disclosed to the insurer. But, knowledge of one’s specific state laws and the requirements of insurance contracts are important to ensure that clients’ rights are protected and that information is not released inappropriately or beyond the extent of the authorization provided. Since mental health professionals can not control what happens to clinical information once it is released to the insurer, it is important to only disclose the minimum information needed for the stated utilization review purpose. Further, it is best to inform clients in advance of the risks to their privacy that exist when utilizing their insurance benefits. Some clients will then choose to not utilize their benefits and pay out-of-pocket for the professional services. But, since many clients can not afford the luxury of this option the other recommendations made above are of great importance.

Responding to Complaints

If a client files an ethics or licensure board complaint, or a malpractice suit, against a mental health professional, the mental health professional has the legal right to defend him or herself. In doing so, confidential information from the treatment record will be shared in the legal forum. This is unavoidable. To file an ethics complaint or licensure board complaint and have it investigated clients will be required by the ethics committee or licensure board to sign an authorization so that the mental health clinical may release the entire treatment record as well as any other information necessary to respond fully to the allegations. In the case of a lawsuit, clients will likely be advised by their attorneys that they will be waiving privilege by disclosing in the legal setting the existence of the professional relationship with the mental health professional. However, to be sure that clients understand this mental health professionals may include this as an additional potential limit to confidentiality that exists.

Treatment of Minors

As has been highlighted earlier, when providing clinical services to minors the parent(s) or guardian have the legal right to all information shared in the professional relationship. It is therefore very important to address these issues from the outset so that the minor client’s trust is not violated and treatment efforts undermined. Further, mental health professionals need to be knowledgeable of all relevant state laws. In some states, for example, while only a custodial parent may consent to their minor child’s mental health treatment, a non-custodial parent has the same rights as the custodial parent to access treatment information and records. Knowledge of such laws is vital for engaging in a thorough informed consent process. Failure to do so could result in an agreement that doesn’t include mention of this additional possible exception to confidentiality. If the non-custodial parent then asserts her or his right to the treatment information and records the mental health professional is left with few options. Of course, one may attempt to explain the clinical dynamics of the situation to the non-custodial parent and hope s/he will understand and agree to accept what the mental health professional decides is appropriate to share with the non-custodial parent. But, this can not be guaranteed and prudent mental health professionals will wish to address such issues from the outset of the professional relationship.

A related issue to be knowledgeable of concerns the protection of minor clients’ treatment information in divorce proceedings. In those situations where the parents can not work together and reach agreement about what is best for their child, courts at times will appoint a court-appointed guardian, known as a guardian ad litem. In these situations the court empowers the guardian ad litem to be the holder of privilege for the minor client. This individual then makes decisions regarding the minor client’s participation in evaluations and treatment as well as for the release of any confidential material in the context of the legal matter at hand.

With the Client’s Consent

A final, if not obvious, exception to confidentiality is when the client authorizes the mental health professional to release specific information. It is best if this is done in writing to ensure that there are no misunderstandings. Further, the signed release form should specify just what information the mental health professional is to release, to whom, and the time period during which the authorization is valid. As has been reviewed previously, it is important not to go beyond the limits provided in the authorization. Only the information specified should be shared. When unsure, an open discussion with the client is recommended. Further, not all clients will be able to anticipate and understand the implications of all authorized releases. If the mental health professional believes that a given release of confidential information my impact the client adversely or may have unintended consequences, it is the mental health professional’s responsibility to discuss this openly with the client prior to releasing the information.

Summary

Confidentiality is a vital component of all professional relationships between mental health professionals and their clients. Protecting and preserving confidentiality are essential obligations for all mental health professionals. At the same time, there are a wide range of threats to confidentiality and mandatory exceptions to confidentiality that exist. Mental health professionals must take appropriate steps to prevent all inadvertent disclosures of confidential information. All threats to clients’ privacy should be reasonably anticipated so that all preventable breeches do not occur. Further, the informed consent agreement has been highlighted as an important aspect of the forming of the professional relationship that shares with clients all reasonably anticipated limits to confidentiality. Armed with this information clients are able to make better and more reasoned decisions about what information they wish to share with their mental health professional. For their part, mental health professionals will need to strive to strike a balance between protecting each client’s privacy while taking necessary steps to prevent harm from occurring to others. Both society and individual clients place their trust in mental health professionals. It is the mental health professional’s duty and obligation to not violate this trust. The recommendations made in this contribution should be useful for meeting these varied and sometimes challenging obligations. Finally, it should be kept in mind as Slovenko (1975) points out, that “trust – not absolute confidentiality – is the cornerstone of psychotherapy” (as cited in Buckner & Firestone, 2000, p. 222). While we can not guarantee absolute confidentiality, there is much we can each do to protect and preserve each client’s confidentiality, and trust, in our roles as mental health professionals.

References

American Psychological Association. (2002). Ethical principles of psychologists and code of conduct. American Psychologist, 57, 1060-1073.

Barnett, J.E. (1994). Technological advances and ethics: Causes for concern and recommendations. The Maryland Psychologist, 39 (6), 9-10.

Barnett, J.E. (2000). Email communications with patients: Ethics issues to consider. The Maryland Psychologist, 45 (3), 15.

Barnett, J.E. (2007). Efforts to protect our clients’ privacy: How much is enough? The Maryland Psychologist, 52(3), 30-31.

Barnett, J.E., Behnke, S., Rosenthal, S.L, & Koocher, G.P. (2007). In case of ethical dilemma break glass: Commentary on ethical decision making in practice. Professional Psychology: Research and Practice, 38, 7-12.

Barnett, J.E., & Scheetz, K. (2003). Technological advances and telehealth: Ethics, law, and the practice of psychology. Psychotherapy: Theory/Research/Practice/Training, 40, 86-93.

Buckner, F., & Firestone, M. (2000). Where the public peril begins: 25 years after Tarasoff. The Journal of Legal Medicine, 21, 187-222.

Code of Maryland and Annotated Regulations. (2002). Medical records act. Title 4-301 through 4-307.

Jaffee v. Redmond. 518 U.S. 1 (1996).

Miller, D.J., Thelen, M.H. (1986). Knowledge and beliefs about confidentiality in psychotherapy. Professional Psychology: Research and Practice, 17, 15-19.

Pope, K.S. (1991). Informed consent: Clinical and legal considerations. The Independent Practitioner, 11 (1), 36-41.

Pope, K.S., & Vasquez, M.J.T. (2005). How to survive & thrive as a therapist: Information, ideas, & resources for psychologists in practice. Washington, DC:American Psychological Association.

Smith, S.K. (Accessed November 25, 2007). Mandatory reporting of child abuse and neglect. Available at http://www.smith-lawfirm.com/mandatory_reporting.htm.

Tarasoff v. Regents of the University of California. 551 P.2d 334 (Cal. (1976).