Does Confidentiality Exist?

 

Confidentiality has long been considered a corner stone of the psychotherapeutic relationship. Without its guarantee, how could psychotherapists establish the atmosphere of trust necessary for the sharing of private, personal, and intimate information? Patients often share thoughts, ideas, fantasies, and fears that could be embarrassing or even damaging if not held in the strictest confidence. Without the promise of confidentiality, many patients might be reluctant to share information necessary to receive the full benefit of treatment. Even worse, some might not enter into much needed treatment at all.

The Ethical Principles of Psychologists and Code of Conduct (APA, 2010) instructs psychologists to “respect the rights of individuals to privacy, confidentiality, self-determination, and autonomy, mindful that legal and other obligations may lead to inconsistency and conflict with the exercise of these rights” (Principle E: Respect for People’s Rights and Dignity, p. 3). Relevant state and federal laws and legal precedents all provide guidance and impact on confidentiality as well. As stated by Cohen and Mariano (1982), “States… have enacted statutes that have extended the right of the individual to refuse to disclose certain information. This privilege “has been extended to those persons with whom the individual shares a special relationship, e.g., attorney, physician, psychologist,…” (p. 260).

A related issue of equal importance is that of privilege, the right to refuse sharing information from one of these specially defined relationships in a legal proceeding. Under normal circumstances the individual who is the holder of privilege has the right to assert that privilege and not have information shared in confidence disclosed in court. However, several exceptions to this right exist which make it less than absolute.

Privacy is a much more basic and global concept whose roots are found in the constitution of the United States. As stated by Shah (1969), “the concept of privacy recognized the freedom of the individual to pick and choose for himself the time, circumstances, and particularly the extent to which he wishes to share with or withhold from others his attitudes, beliefs, behavior, and opinions” (p. 57). The implications of the right to privacy and its impact on privilege and confidentiality are clear. Privacy is the underlying tenet of privilege and confidentiality. As it has eroded, so have they. This tripartite of ethical and legal concepts has direct bearing on the practice of psychotherapy.

Great variability exists in how clinicians inform patients about confidentiality. In one study (Baird & Rupert, 1987), only one-half of psychologists mentioned or alluded to specific limits of confidentiality from the outset of the psychotherapy relationship. The other half often said nothing at all or indicated that everything said during treatment is confidential.

Many assume that confidentiality in the context of “privileged” relationships is absolute. One study of consumers of mental health services (Miller & Thelen, 1985) found that 69% of those surveyed believed that all information shared in psychotherapy was confidential. Additionally, 97% expressed the desire to be informed of the limits of confidentiality prior to entering into psychotherapy. This would prove especially helpful since confidentiality in psychotherapy is not as absolute as many assume. It is only relative, with many exceptions, thus highlighting the importance of a timely and thorough informed consent process that ensures clients have realistic expectations about what is confidential and what may not be (Barnett, Behnke, Rosenthal, Koocher, 2007).,

One well known exception to absolute confidentiality in the psychotherapy relationship is the duty to warn and protect an identified victim if a specific threat to harm that individual is made in the context of a psychotherapy or treatment relationship. In the original ruling on this issue (Tarasoff v. Regents of University of California, 1976) the judge ruled “protective privilege ends where public peril begins.” In Maryland, statutes provide for taking reasonable steps to avoid harm of a third party, including warning the intended victim (Annotated Code of Maryland, 1991). Thus, while licensed health care providers are not always required to breech confidentiality, when harm to others is threatened, at times no other reasonable alternative exists and such an action must occur. It is essential that clinicians be knowledgeable of relevant state laws that address this issue. Each jurisdiction’s law may be slightly different. Some jurisdictions have a duty to warn law (contact the intended victim), others a duty to protect law (contact the police and inform them of the threat), some jurisdictions require both, and some also offer the option of addressing the threat through a documented treatment plan that is implemented.

Other exceptions to confidentiality regulated by statutes include the requirement for licensed health care providers to report suspected cases of child abuse and neglect, and in some states, elder abuse. Typically, the consent of the individual providing such information is not needed before making the required report. Maryland law also allows for discussing treatment information with other health care providers to coordinate treatment services and pursue involuntary commitment proceedings. Once again, clinicians will be well served by being informed of the details of these laws in their jurisdiction. These laws provide definitions of abuse and neglect and include specific requirements for when to file a report. For example, many jurisdictions require these reports when a clinician has a reasonable suspicion of the presence of abuse (physical or sexual) or neglect of a minor. Additionally, in some jurisdictions the reports are only to be made when the patient or client is presently a minor. In other jurisdictions the patient or client who reports the abuse or neglect may presently be an adult as long as the reported abuse or neglect occurred when she or he was a minor. Thus, being knowledgeable of the specifics of one’s relevant laws and fully addressing these potential limits to confidentiality in the informed consent process are essential for ethical, legal, and competent practice.

Many jurisdictions have laws that require licensed health care providers to disclose medical records in response to a subpoena when the patient has initiated a legal claim in which the patient’s mental health, emotional functioning, or mental health treatment forms the basis for the issues of the claim. Licensed health care providers are also required to respond to lawful court orders for treatment records. Further, they may have to respond to a subpoena for treatment records from a licensing board for the purpose of an investigation regarding “Licensure, certification, or discipline of a health professional; or the improper practice of a health profession” (e.g., Maryland law: Title 4-306, p. 18).

The most frequent reason for releasing confidential information is at the patient’s request. However, this should only be done with the patient’s (or legal representative’s) written consent to do so. Further, as recommended by Stromberg et al (1988), it is important that the consumer understand the specifics and scope of the information to be disclosed, with whom it will be shared, and the general purpose(s) for which it will be provided (p. 391). Further, Pope (1990) strongly recommends that only the information required be released and only information germane to the request being made be shared (p. 40). Additional information beyond the scope of the patient’s specific consent should not be disclosed. Patients may request that confidential treatment or assessment information or reports be released for a wide range of reasons. When responding to these requests it is important to help the patient understand the possible consequences of the release of the information.

Psychology’s ethics code instructs us to discuss the limits of confidentiality at the outset of the psychotherapy relationship (Standard 4.02, p. 7), to take reasonable precautions to safeguard the confidentiality of information shared in the psychotherapy relationship (Standard 4.01, p. 7), to minimize intrusions on patients’ privacy (Standard 4.04, p. 7), and to maintain records in a manner which safeguards each patient’s confidentiality and right to privacy (Standard 6.02, p. 9).

In addition to situations when mental health professionals are required to release confidential information there are numerous situations where the mental health professional may inadvertently release confidential information. Extreme care should be taken to reduce the likelihood of these situations arising. One important issue concerns the role of administrative and support staff. Each clinician is responsible for the training and oversight of their subordinates. Office staff should be trained in the importance of protecting confidentiality; their sensitivity to these issues should not be assumed. Further, ongoing training and oversight with periodic verbal and written feedback to staff members is recommended. It is also suggested that each staff member be provided with a set of office policies that include how confidential information is handled and that the staff member sign this agreement. Examples of important issues to be addressed include speaking on the telephone about one patient in front of other patients, sharing information about one patient with other patients, failure to store patient records in a secure location, and discussing patients with unauthorized individuals outside of the office (e.g., friends and family).

As is implied above, the issue of record storage and disposition is essential as well for protecting each patient’s confidentiality. Records should not be left in unsecured locations and should be stored in locked file cabinets with access to them restricted to those with a legitimate need to access them. When records are destroyed in compliance with one’s relevant laws it must be done in a manner that preserves confidentiality. Shredding and incineration are the most widely accepted methods for the destruction of confidential records. They should never be thrown out in the garbage or disposed of in some other nonsecure manner.

While mental health professionals will often consult with colleagues and participate in clinical supervision for the purposes of providing the highest quality of clinical services, these activities should be engaged in only with each patient’s informed consent. Patients have the right to know what information will be shared with others and for what purpose. While clinical consultation and supervision are appropriate exceptions to confidentiality, it is important to ensure that consultants and supervisors agree to maintain each patient’s privacy and to never re-release confidential information.

Should a clinician wish to use a patient’s confidential information for teaching purposes or for some other dissemination to others, the APA Ethics Code’s Standard 4.07, Use of Confidential Information for Didactic or Other Purposes, must be followed. It specifies that in “writings, lectures, or other public media, confidential, personally identifiable information concerning their clients/patients, students, research participants, organizational clients, or other recipients of their services that they obtained during the course of their work” (p. 7) we must either disguise all identifying information about the patient or have the patient’s written permission to use their confidential information in this manner.

On a most basic level, how clinicians structure their office has implications for protecting patients’ confidentiality. Examples include the use of sound proofing to ensure that conversations taking place in treatment rooms are not overheard by others in the hallway, in the waiting room, or in other treatment rooms. Additionally, white noise machines or music played softly in the waiting room are helpful for further reducing the chance that treatment sessions may be overheard by others. Additionally, office staff should be separated from the patients’ waiting room so that conversations about confidential patient information are not overheard by others in the waiting room. Typically, a sliding glass partition is useful so that those entering the office or who are waiting for an appointment can see and access staff if needed, but the partition can be slid closed when confidential material must be discussed such as when staff make telephone calls to other clients.

A final basic issue for preventing inadvertent breaches of confidentiality is for all mental health clinicians to only discuss confidential client information in a secure location. Patients should not be discussed in locations where others may overhear them. For example, speaking about patients with a colleague when riding an elevator would be inappropriate. All confidential information should be protected and discussed in private.

At times, mental health professionals will provide evaluation or treatment services at the request of a third-party. Examples include court-ordered treatment and evaluations and employer-ordered evaluations such as fitness for duty evaluations for police officers or treatment that is mandated to continue in one’s job or to maintain one’s license. In such situations it is essential that all obligations and responsibilities be clarified from the outset in the informed consent agreement. In fact, as Fisher (2009) informs us, an important issue to clarify in these situations is just what obligations one owes to each party involved. Rather than focus on the technicality of ‘who is the client?’, it is instead important to reach agreements with all parties involved, from the outset, that address each party’s expectations with regard to confidentiality. Thus, the ‘client’ being evaluated or treated will need to know if all treatment or assessment results will be shared directly with the court or employer and what if any confidentiality rights the ‘client’ in fact has. In many of these situations the actual client is the party making the referral and not the person being evaluated or treated. As always, clarifying each party’s expectations up front and having a written agreement with each party that specifies just what is confidential and just what is shared, and with whom, is essential.

Mental health professionals will also need to be cautious in protecting confidentiality when it comes to the various technologies used in clinical practice. For example, the use of fax machines and computers can create unanticipated risks to confidential information. Those using fax machines should double check all fax numbers input prior to hitting the send button. Further, a coversheet that identifies the material as confidential should be used. Finally, it is important to first verify where a receiving fax machine is located and who will have access to it prior to sending confidential materials. For example, a receiving fax machine located in the main office of a school may present risks to confidentiality. Contacting the recipient by telephone first and ensuring that that person is present at the fax machine when the documents are being sent is a good practice.

Computers and the Internet are now widely used by mental health professionals. While they may greatly enhance the productivity, efficiency, and even the accessibility of clinicians, they bring with them risks as well. The popular literature abounds with cases of intrusions into data bases that hold sensitive patient health care information. It is recommended that all computers that be password protected and that those connected to the Internet have virus and firewall protections to guard against intrusions that may allow unauthorized access to confidential information (Barnett & Scheetz, 2003). When using e-mail as a means of communication with patients, it is important to ensure that they understand the risks to confidentiality that come with use of this medium. E-mail may be used for administrative purposes such as for scheduling and changing appointments or for clinical purposes such as for the provision of counseling services. To preserve each patient’s privacy and maintain the confidentiality of their personal information it is recommended that encryption software be utilized by both clinician and patient. These programs help minimize the risks of unauthorized disclosures of confidential information over the Internet. . “Without encryption, Email is no more sensitive than a postcard” (Sussman, 1995). Another report describes the internet like “a vault with a screen door on the back” (Quittner, 1995). One report documents that a program which is designed to find security gaps in computer systems and make them harder to crack is distributed free on the internet by its creator (Associated Press, 1995). With it, online vandals could access, scramble, delete, or print out a hospital’s medical records.

Additional difficulties exist in institutional policies on how medical records are maintained. One survey found that in a large hospital the average medical record is seen by seventy-seven people. Often people not involved in a patient’s care or with a valid “need to know” have access to treatment records. The media regularly reports on cases where persons not directly involved in a patient’s treatment have access to what the patient assumed was confidential information in a medical record. All clinicians working in group or agency settings should ensure the existence of a clear policy that specifies procedures for accessing confidential records. This policy should include a statement about how the right to access is determined (such as being directly involved in an individual’s treatment) and it should be closely monitored and strictly enforced.

Further problems exist within the insurance industry. Policy holders often sign release forms that are vague and with no limited scope of disclosure. Numerous cases exist of insurers demanding copies of all patient records, including all session notes, in order for the patient to receive continued coverage. Once the information is forwarded it is unclear who has access to this data, how it is stored, and how it will be used (see Courtney, 1995). It has even been reported that individuals have been denied life insurance because records revealed they were taking Prozac for depression (Jarvis, 1993).

Many insurers require health care providers to sign agreements which allow the insurer full access to all patient care records should they be requested. This can be done at any time without any evident objective reason. The impact on one’s ability to provide treatment services is serious. Knowing of this open status to their records could significantly hamper patients’ openness in treatment and thus the likely benefit achieved.

The practices of insurance companies and managed care organizations create further intrusions into confidentiality and privacy. Cases are documented where psychotherapists have received the complete medical and psychological records of patients who were not and subsequently did not become patients of those providers (Jarvis, 1993). This author has received several authorizations to provide treatment for patients who were not and did not become his patients. These authorizations contained a variety of sensitive information.

Numerous examples exist in the media, the professional literature, statutes, and case law which highlight both the ethical dilemmas health care providers are confronted with and the many limits to confidentiality, privacy, and privilege which exist. While our ability to impact on these intrusions is limited, certain steps must be taken. Recommendations include:

• Exercise caution in documentation. Don’t treat documentation as your private record. Write knowing that the patient and others may have access to it later.
• Inform patients of likely limits to confidentiality at outset at outset of the relationship. Then they can decide what they do or do not wish to share.
• Be very cautious about the storage of patient information and be sure staff and subordinates are trained and act responsibly regarding the maintenance of confidentiality as well.
• Have written office policies that address how confidential information is to be treated. Actively ensure that these policies are followed by all staff and subordinates.
• When conducting utilization review, be sure of who you are speaking to, share only the information necessary to complete the review, and exercise caution in using cellular phones, faxes, and Email (see Barnett, 1994).
• When involved in any way in legal proceedings with patients, consult an attorney immediately. Be sure to seek legal advice before responding to subpoenas and court orders as well.
• Become involved in your State Psychological Association and in grass roots efforts to protect and strengthen laws which impact on privacy and confidentiality. Become politically involved. Contact your legislators and let your views be known.

References

American Psychological Association (2010). Ethical principles of psychologists and code of conduct. Retrieved from: www.apa.org/ethics.

Annotated Code of Maryland (1991). Health General Article, Title 4, Subtitle 3, 4-301 – 4-309.

Baird, K. A., & Rupert, P. A. (1987). Clinical management of confidentiality: A survey of psychologists in seven states. Professional Psychology: Research and Practice, 18, 347-352.

Barnett, J. E. (1994). Technological advances and ethics: Causes for concern and recommendations. The Maryland Psychologist, 39, 9- 10.

Barnett, J. E., & Scheetz, K. (2003). Technological advances and telehealth: Ethics, law, and the practice of psychology. Psychotherapy: Theory/Research/Practice/Training, 40, 86-93.

Barnett, J. E., Wise, E. H., Johnson-Greene, D., & Buckey, S. F. (2007). Informed consent: Too much of a good thing? Or not enough? Professional Psychology: Research and Practice, 38, 179-186.

Cohen, R. J., & Mariano, W. E. (1982). Legal guidebook in mental health. New York: Free Press.

Courtney, D. (October, 1995). Should confidentiality be a luxury? The Iowa Psychologist, 4-6.

Fisher, M. A. (2009). Replacing ‘who is the client?’ with a different ethical question. Professional Psychology: Research and Practice, 40 (1), 1-7.

Jarvis, J. M. (October 6, 1993). Making therapists tell all. The Baltimore Sun, p. A11.

Miller, D. J., & Thelen, M. H. (1986). Knowledge and beliefs about confidentiality in psychotherapy. Professional Psychology: Research and practice, 17, 15-19.

Pope, K. S. (1990). A practitioner’s guide to confidentiality and privilege: 20 legal, ethical, and clinical pitfalls. The Independent Practitioner, 10, 40-44.

Schwartz, J. (November 15, 1995). Medical records privacy bill gets airing at Senate hearing. The Washington Post, p. A2.

Shah, S. A. (1969). Privileged communications, confidentiality, and privacy: Privileged communications. Professional Psychology, 1, 56-59.

Tarasoff v. Regents of University of California, 17 Cal.3d 425, 131 Cal.Rptr. 14, P.wd 334 (1976).

 
Top of Page