Efforts to Protect our Clients’ Privacy: How Much is Enough?

By: Jeffrey E. Barnett, Psy.D., ABPP

 

Psychologists all know of the importance of protecting each client’s privacy. In fact, the promise of confidentiality of information shared in the professional relationship is one of the key factors that allows clients to participate in treatment. If not for the promise of confidentiality many individuals likely would not avail themselves of needed mental health treatment. It is also widely known that there are several specific limits to confidentiality of which we are required to inform clients from the outset of the professional relationship as is stated in the Code of Ethics and Professional Conduct (Code of Ethics) (COMAR 10.36.05, .08 Confidentiality and Client Records). Examples include the duty to report suspected abuse or neglect of minors, similar vulnerable adult reporting requirements, and the duty to warn, protect, or treat in cases where there is a threat of imminent harm to an identified third party, among others. Whereas these mandatory exceptions to absolute confidentiality must be accepted as a part of how we provide services, what about other possible breaches of confidentiality or threats to clients’ privacy? What are they, how should they be addressed, and just how far do we need to go to protect each client’s privacy from these risks?

In their text on positive and aspirational ethics, Knapp and VandeCreek (2006) highlight the need for each of us to create and maintain a culture of safety in our offices. This involves the physical set up of our offices, and office and business practices, to include training and supervision of staff, how clients are scheduled, the use of technology, how we contact and correspond with clients, consultation with colleagues, communication with referral sources, and out-of-office contacts.

Aspirational ethics is based on the goal of endeavoring to do all we can to meet the ideals of our profession and to provide the highest quality services possible, rather than just trying to meet minimal standards and expectations. The Code of Ethics specifies minimal standards that must be met, such as the requirement to “Maintain confidentiality regarding information obtained from a client in the course of the psychologist’s work,” and “Safeguard information obtained in clinical and consulting relationships or evaluative data…” (.08, Confidentiality and Client Records). Each clinician has considerable latitude in just how to apply these standards and to ensure that they are met. Most will likely agree that clients’ records should not be left on a desk in the waiting room where others can see clients’ names, and, if left alone, could even look at the contents of these records. But, just how many psychologists take adequate precautions to ensure that this cannot happen? Most will agree that our staff should never have conversations with or about clients over the telephone in the presence of others. Again, how many practitioners actually train their staff about the need to treat all client-related information as confidential, and how many actually have their office set up so that staff members’ work and communications are not overheard or viewed by those in the waiting room? (See also Barnett (1992) for further examples.)

In the profession of psychology we often hear of the need to make a reasonable good faith effort and to engage in prevailing professional practices. But, just how much is enough for thoughtful psychologists who actively work to minimize threats to their clients’ privacy? Most would agree that all clients’ records should be secured in a locked file cabinet. Should the file cabinet also be in a room that is locked and access to both keys be restricted? Should we have motion sensors and lasers protecting these records? (okay, that is clearly going too far!) Although reasonable professionals may disagree on the specifics, it is hoped that there will be wide agreement on minimal standards for protecting clients’ privacy, and that psychologists will truly aspire to doing their best in this important area of practice. Below are some specific recommendations that should be of use to psychologists interested in doing more than just meeting minimal standards.

Office Set-up
Suggestions include sounds proofing, the use of white noise machines, and not having staff work directly in front of clients in the waiting room. Test sound proofing by sitting in a quiet waiting room while others speak loudly in your office or in the staff work area. Those in the waiting room should not have access to client records, appointment books, overheard telephone conversations, and other similar confidential material.

Staff Training and Supervision
Do not assume that staff members know our ethics code or are sensitive to confidentiality issues. Train staff, document the training, supervise them closely, and update their training as needed. Develop written office policies that protect client confidentiality and ensure that staff follow them. Be sure to address each of the areas detailed below.

Use of Technology
Be aware of the risks of use of computers, fax machines, telephones, copiers, cell phones, and Email. Be sure all computers are password protected and that appropriate firewall and virus protection are used and regularly updated. Never leave a computer unattended with a document open. Use fax cover sheets that emphasize the confidential nature of the materials sent, be sure of who is receiving the fax, and be sure the number is input correctly before sending. Before using a cell phone or Email to discuss any confidential information, verify that clients fully understand the potential limits to confidentiality that exist in using these media. Some cell phone frequencies may be picked up on AM radios or nursery monitors; Email should be considered as private as a post card, not a letter; anyone with advanced computer skills (i.e., the average eighth grade computer geek) can access Email through their server.

Scheduling and Other Client Contacts
Before calling clients and perhaps leaving messages at home and at work, first confirm your clients’ preferences for where they want to be contacted, if they want messages left for them, and just how you should identify yourself. While many clients will not care, some will and for them a breach of confidentiality to the wrong individual might be devastating. Similarly, find out in advance how clients prefer to be greeted (or not!) if you should happen to see them in public settings. Many psychologists have creative stationery that is useful for marketing their practice; envelopes used for correspondence with clients are best if they don’t disclose the fact that they are from a mental health practitioner. Simply having one’s last name and address may be better then creative logos and listings of practice names such as XYZ Mental Health Center.

Authorized Releases of Information
Before sharing information about a client with a third party, be sure you have first obtained your client’s consent. This is recommended even for consultations with colleagues and when providing feedback to referral sources. While these may technically be allowed under Maryland law (see Title 4-305, Disclosures without authorization of person in interest) it is always best to first obtain a client’s authorization and as Pope (1990) recommends, never share information beyond the extent of what the client has authorized. Further, when responding to requests for information over the telephone, be sure to verify the caller’s identity, even if authorization has already been received.

Out of Office Experiences
Busy and hard working psychologists may at times bring work home to complete after work hours. Clinical notes may be written, tests scored and results interpreted, and reports dictated. Although such practices are not inherently unethical, they do pose significant threats to the maintenance of confidentiality. All work materials should be carried to and from home in a locked briefcase kept in the trunk of one’s vehicle (especially important when just running a quick errand on the way home). Work on materials at home should not be done where others may observe the materials or overhear the dictation. When taking breaks and when the work is completed it is best that the work materials be stored in a locked cabinet or closet that others cannot access. Be sure to carefully restrict access to those keys. If using home computers for confidential work, it is vital that access to the computer be restricted with password protection and that the recommended virus and firewall protection be in place.

While differences of opinion will exist regarding just how careful psychologists must be in their efforts to preserve clients’ privacy, it is hoped that an aspirational approach will be used that emphasizes doing all we reasonably can to protect and preserve each client’s privacy. Thoughtful attention to the issues raised and recommendations made will certainly be of benefit to all involved.

References

Barnett, J.E. (1992). Confidentiality: Limits or limitations? The Maryland Psychologist, 38 (1), 10-12.

Code of Maryland and Annotated Regulations. (2003). Title 10, Subtitle 36, Chapter .05, Code of Ethics and Professional Conduct.

Knapp, S.J., & VandeCreek, L.D. (2006). Practical ethics for psychologists: A positive approach. Washington, DC: American Psychological Association.

Pope, K.S. (1990). A practitioner’s guide to confidentiality and privilege: 20 legal, ethical, and clinical pitfalls. The Independent Practitioner, 10, 44.