NOTE: The legal information below is from Appendix III in
the 2013 Oxford University Press book by Mary Alice Fisher, Ph.D.,
The Ethics of Conditional Confidentiality:
A Practice Model for Mental Health Professionals.
The version below is in html format, but
Oxford has provided Appendix III in pdf format
as an official “Online Appendix” on this website.
Both versions supply links to numerous laws, as examples of
specific types of laws that can affect confidentiality.
This is not a substitute for learning the legal details that apply in your own state.
When the discussion mentions a “Chapter,” this refers to a chapter in the published book. When a “Step” is mentioned, this refers to a specific section of the Ethical Practice Model that was the basis for the book. This website also contains an annotated version of that Model to indicate how state laws and federal HIPAA regulations can be integrated into the ethical requirements.
EXAMPLES OF LAWS AFFECTING CONFIDENTIALITY
I. LAWS PROTECTING CONFIDENTIALITY
A. Laws Prohibiting Voluntary Disclosure of Information Without Patient Consent
(Confidentiality Mandates & Non-Disclosure Laws)
As defined here, these laws impose a duty not to disclose, and/or they apply a penalty for disclosing without the patient’s consent. Sometimes these confidentiality or non-disclosure provisions can be hard to find, because they may consist of a single clause in a very long law. They may also be widely scattered within the state or federal legal codes, since they can appear in general statutes, in laws governing specific mental health professions, in licensing board regulations, and in state agency regulations. Finally, the relevant laws in this category include legal mandates to maintain confidentiality, laws that protect confidentiality only in certain circumstances, and laws and regulations that impose legal penalties for disclosing information without the patient’s consent.
1. STATE:
(a) Statutes: State non-disclosure statutes are sometimes written broadly and their protections may apply not only to mental health professionals but to all health care providers. (For example, Virginia’s brief statutory non-disclosure provision below is located within a very extensive 7000-word Health Records Privacy Statute that applies to all health care providers in all settings.) In contrast, the provisions of some non-disclosure statutes are limited to a specific population or setting. (For example the Florida statute below applies only in state agencies and institutions.)
| Florida § 394.4615 “A clinical record is confidential . . . Unless waived by express and informed consent, . . . the confidential status of the clinical record shall not be lost by either authorized or unauthorized disclosure to any person, organization, or agency.”Virginia § 32.1-127.1:03 “A. There is hereby recognized an individual’s right of privacy in the content of his health records. . . and, except when permitted or required by this section or by other provisions of state law, no health care entity, or other person working in a health care setting, may disclose an individual’s health records.” |
Also in this category are confidentiality statutes which do not explicitly forbid disclosure, but which protect confidentiality by legally permitting therapists not to disclose information in certain circumstances. (For example, the Ohio statute below allows therapists to protect the confidentiality of minors over age 14, rather than informing parents about their treatment.)
| Ohio: § 5122.04 “(A) Upon the request of a minor fourteen years of age or older, a mental health professional may provide outpatient mental health services, excluding the use of medication, without the consent or knowledge of the minor’s parent or guardian.” |
This category would also include legal requirements about protecting patient confidentiality through insuring the security of records during storage, retention, or destruction.
| Virginia: § 32.1-127.1:01 Record Storage A. Medical records . . . may be stored by computerized or other electronic process or microfilm, or other photographic, mechanical, or chemical process; however, the stored record shall identify the location of any documents or information that could not be so technologically stored. If the technological storage process creates an unalterable record, the nursing facility, hospital or other licensed health care provider shall not be required to maintain paper copies of medical records that have been stored by computerized or other electronic process, microfilm, or other photographic, mechanical, or chemical process. Upon completing such technological storage, paper copies of medical records may be destroyed in a manner that preserves the patient’s confidentiality. However, any documents or information that could not be so technologically stored shall be preserved. Wisconsin: § 134.97 Disposal of records containing personal information. |
Finally, also in this category are laws that impose legal penalties for failing to protect confidentiality. These can be in the form of statutes (as in the Florida statutory examples below) or in regulations (as in the Florida Board regulations in the next section).
| Florida: § 490.009 Discipline – Psychologists; and § 491.009 Discipline – Counselors, Clinical Social Workers, Other Therapists “(1)The following acts constitute grounds for denial of a license or disciplinary action . . . (u) Failing to maintain in confidence a communication made by a patient or client. . .” |
(b) Regulations: State non-disclosure regulations ordinarily apply only to specific providers, or in specific settings. For example, licensing board regulations apply only to licensees of a specific board (see first Ohio example, below); and state agency regulations apply only to providers in specific state agencies or institutions (see second Ohio example, below).
| Ohio – Counselor, Therapist, and Marriage & Family Board – Standards of Ethical Practice & Professional Conduct OAC 4757-5 -02 D (1) Confidential information shall only be revealed to others when the clients or other persons legally authorized to give consent on behalf of the clients, have given their informed consent, except in those circumstances in which failure to do so would violate other laws or result in clear and present danger to the client or others. Unless specifically contraindicated by such situations, clients shall be informed and written consent shall be obtained before the confidential information is revealed.Ohio – Requirements and Procedures for Mental Health Services by Agencies OAC 5122-29-03 Behavioral Health Counseling and Therapy Service “(4) It is the responsibility of the agency to assure contractually that any entity or individuals involved in the transmission of the information guarantee that the confidentiality of the information is protected.” |
State licensing board regulations can impose penalties for disclosures made in contradiction to the state’s laws and regulations protecting confidentiality. (See Florida examples below.)
| Florida – Licensing Board Regulations – Penalties for Breach of Confidentiality 64b19-17.002 (Board regulation for Psychologists) – (1) The Board shall impose one or more penalties if an applicant or a licensee for “failure to maintain confidence.” [Penalty for first offense is a reprimand and a fine from $1000 up to #5000; penalty for second offence ranges from reprimand to revocation of license, and a fine from $5000 up to $10,000; and penalty for third offence is revocation and $10,000 fine.] 64b4-5 – 5.001 (Board regulation for Counselors, Clinical Social Workers, and Other Therapists) – (1) The Board shall impose one or more penalties if “an applicant, licensee, registered intern, provisional licensee, or certificate holder whom it regulates” fails to . . . (v) maintain in confidence any communication made by a patient or client in the context of services, except by written permission or in the face of clear and immediate probability of bodily harm to the patient or client or to others. . . ” [Penalty for first offence is a $1000 fine and reprimand or probabion; penalty for second offence is a $1000 fine and probation or revocation of license.] |
In some states, licensing boards have incorporated a profession’s entire Ethics Code into the board’s code of conduct, thereby giving to that profession’s Ethical Standards about confidentiality the weight of legal regulations. (See Oregon Board of Psychology regulation, below.) In other cases, a licensing board may create its own Code of Ethics (See below the Oregon regulation of the Board of Licensed Professional Counselors and therapists; and the Pennsylvania Board of Psychology statute.)
| Oregon Board of Psychology Examiners: 858-010-0075 “The Board adopts for the code of professional conduct of psychologists in Oregon the American Psychological Association’s “Ethical Principles of Psychologists and Code of Conduct” effective June 1, 2002.”Oregon Board of Licensed Professional Counselors and Therapists 833-100-0011 through 833-100-0071 – Code of EthicsPennsylvania Board of Psychology: § 41.61 – Code of Ethics |
Case Law: State Supreme Court decisions apply only in the state in which they were decided, although they sometimes have an impact elsewhere by being cited as examples in other states’ cases. Examples of state cases that created or expanded confidentiality protections within a specific state include those such as the Virginia case summarized in the box below.
| Virginia: Fairfax Hospital vs. Patricia Curtis This decision awarded $100,000 to a patient whose hospital records were released without her consent in the context of a court case. The basis of that decision was that no judge had determined that these records were admissible as evidence in the case.Some consider this a wake-up reminder to Virginia therapists that they have no legal basis (and therefore perhaps no ethical basis?) for disclosing information in response to a “discovery” subpoena for patient records without ensuring that someone files a “motion to quash” the subpoena in order to protect the record. (See discussion.) This brings a judge into the process and results in a determination – either a court order protecting the information from being used as evidence, or a court order requiring it to be disclosed. (See discussion in this book regarding the importance of distinguishing between a subpoena and a court order in Part II, Step 4.) |
2. FEDERAL:
(a) Statutes: Most of the Federal statutory protections of confidentiality apply only in substance abuse cases, providing extra confidentiality safeguards for patients receiving services in federally funded facilities. (For example, see 42 U.S.C. § 290dd-2.)
(b) Regulations: some Federal regulations elaborate upon those protections for patients in federally funded substance abuse facilities. (For example, see 42 C.F.R. Part 2.)
By far the most prominent federal regulations affecting confidentiality and privacy are the HIPAA regulations . Created under the Health Insurance Privacy & Portability Act, they apply not only to mental health care providers, but to providers of all health care services who electronically transmit identifiable patient information. These regulations are discussed briefly in Part I of this book; their provisions are summarized in more detail in Appendix VIII; and links to their text and interpretations are available on the website of the Center for Ethical Practice (2010). These regulations are extensive, which is why therapists and/or their staff often obtain specialized HIPAA training.
Other federal regulations affecting confidentiality include those which apply only in educational settings. These include FERPA and IDEA, both of which protect the confidentiality of student information, including mental health information.
B. Laws Creating Therapist-Patient Privilege In Court Cases
“Privilege” is a sub-category of confidentiality. It is a legal concept that applies only in legal contexts. It protects the right to maintain the confidentiality of information about oneself within the context of a court case or legal hearing. State and federal laws can grant “privilege status” to certain relationships (e.g., husband-wife; attorney-client; priest-penitent; doctor-patient) meaning that the information communicated within that relationship is protected from being used as evidence in court. States vary in the extent to which information from the therapist-patient relationship is “privileged.”
1. STATE:
(b) Statutes: Some privileged communications statutes are very protective of patient confidentiality. Thirteen (13) states have privilege statutes that are explicitly modeled after attorney-client privilege, which is very protective unless there are extensive exceptions to that privilege within the statute or elsewhere. (See statutes for Alabama, Arizona, Arkansas, Georgia, Idaho, Kansas, Montana, New Hampshire, New Jersey, New York, Pennsylvania, Tennessee, Washington. Also see relevant sections of each of these privilege statutes listed by state on the Center for Ethical Practice website.)
Sometimes the concepts of confidentiality (i.e., duty not to disclose) and privileged communications (i.e., protection from subpoenas or other legal disclosure demands in court cases) will be combined in the same statute, which can be conceptually confusing. (See Alabama and Florida statutes, below.)
| Alabama § 34-26-2 Confidential Communications: . . . The confidential relations and communications between licensed psychologists, licensed psychiatrists, or licensed psychological technicians and their clients are placed upon the same basis as those provided by law between attorney and client, and nothing in this chapter shall be construed to require any such privileged communication to be disclosed. [emphasis added]
Florida § 490.0137 Confidentiality and Privileged Communications – Communication between any person licensed under this chapter and her or his patient or client shall be confidential. This privilege may be waived under the following conditions: . . .[emphasis added] |
Sometimes privileged communications statutes explicitly protect certain types of records. For example, one section of the Ohio privileged communications statute protects a therapist’s “psychotherapy notes” from being used as evidence in a court case. (See below.)
Ohio § 2317.02 B)(1)(e)(iii). Privileged communications. “Division (B)(1)(e)(i) of this section does not require a mental health professional to disclose “psychotherapy notes” as defined by the HIPAA regulations.” |
Sometimes a privilege statute explicitly gives a therapist the legal right to claim the privilege in the patient’s behalf. (See Florida privileged communications statute below.) Although this right is not explicitly granted in most states, judges do often allow therapists to act in a patient’s behalf to contest an attorney’s subpoena or to file a motion asking the judge to quash it, especially if the patient does not want the information disclosed but has no attorney, or if the patient’s attorney does not file a motion to quash.
Florida § 90.503 Psychotherapist-Patient Privilege – Therapist May Claim. “(2) A patient has a privilege to refuse to disclose, and to prevent any other person from disclosing, confidential communications or records made for the purpose of diagnosis or treatment of the patient’s mental or emotional condition, including alcoholism and other drug addiction, between the patient and the psychotherapist, or persons who are participating in the diagnosis or treatment under the direction of the psychotherapist. This privilege includes any diagnosis made, and advice given, by the psychotherapist in the course of that relationship. “(3)The privilege may be claimed by . . . ?(d) The psychotherapist, but only on behalf of the patient. The authority of a psychotherapist to claim the privilege is presumed in the absence of evidence to the contrary.”? |
2. FEDERAL:
(a) Statutes & Regulations:
Patients who receive substance abuse treatment in federally funded facilities are given special protection from having their records routinely available as evidence in a court case. These additional protections arise both by federal statute ( 42 U.S.C. § 290dd-2 ) and by federal regulation ( 42 C.F.R. Part 2)..
(b) Case Law: Numerous U.S. Supreme Court cases have touched on issues of patient privacy and confidentiality, but the most prominent recent decision affecting mental health patients was Jaffee v. Redmond in 1996. This decision, which strengthened and broadened the protections of therapist-patient privilege in federal court cases, reached the Supreme Court only because a Social Worker refused to disclose patient information. (See Beyer (2000).)
II. LAWS LIMITING CONFIDENTIALITY
These Laws Require Therapists to Disclose Confidential Information Without Patient Consent;
Allow Others to Obtain Access to Information Without Patient Consent;
or Allow Others to Re-Disclose Information They Have Received from Therapists.
Prospective Patients Must Be Informed About These Limits of Confidentiality
During the Initial Informed Consent Interview.
(See discussion in Part II, Step 2, of the book named above.)
A. LAWS REQUIRING THERAPISTS TO INITIATE DISCLOSURE
These laws arise at the state level and vary a great deal, not only state by state, but by profession and by setting within each state. The boxes below contain examples of these types of laws, but therapists are responsible for knowing the confidentiality limitations that apply in their own state and setting.
1. MANDATED REPORTING REQUIREMENTS
All states have laws and/or regulations mandating the reporting of suspected child abuse or neglect; and most states also mandate the reporting of suspected abuse or neglect of elderly and/or vulnerable and/or incapacitated adults. These laws can be found in the state civil code or criminal code, or both (see Utah example, below). All such laws include mental health care providers in the list of mandated reporters and include definitions of the persons/conditions which must be reported. The wording of the reporting mandate varies; however, therapists are never required to investigate first, but instead are required to report if they have “reason to suspect” or “reasonable cause to suspect” the abuse/neglect.
Reporting statutes often impose penalties for failure to report (see Kansas and Utah, below). Some indicate that reporting must be done “promptly” or “immediately” (see Kansas, below); others impose a specific time frame within which the report must be made; and some require both an oral report and a written report (see Massachusetts, below). In some states, reporting of child abuse is not legally required if the information on which the report is based is privileged (see Oregon, below).
| Kansas – § 38-2223 Child Abuse/Neglect Reporting Report Required: “When [any mental health professional] has reason to suspect that a child has been harmed as a result of physical, mental or emotional abuse or neglect or sexual abuse, the person shall report the matter promptly. . . Willful and knowing failure to make a report required by this section is a class B misdemeanor. It is not a defense that another mandatory reporter made a report. . . Intentionally preventing or interfering with the making of a report required by this section is a class B misdemeanor.”Massachusetts – XVII-119-51A Child Abuse/Neglect – Time Frame for Written Report Section 51A. “(a) A mandated reporter who, in his professional capacity, has reasonable cause to believe that a child is suffering physical or emotional injury resulting from: (i) abuse inflicted upon him which causes harm or substantial risk of harm to the child’s health or welfare, including sexual abuse; (ii) neglect, including malnutrition; or (iii) physical dependence upon an addictive drug at birth, shall immediately communicate with the department orally and, within 48 hours, shall file a written report with the department detailing the suspected abuse or neglect.”Oregon – § 419B.010 Child Abuse Report Not Required if Communication Is Privileged. (1) Any public or private official having reasonable cause to believe that any child with whom the official comes in contact has suffered abuse or that any person with whom the official comes in contact has abused a child shall immediately report or cause a report to be made . . . except that a psychiatrist, [or] psychologist . . . is not required to report such information communicated by a person if the communication is privileged.” Utah – Adult Abuse/Neglect Reporting [same wording in both civil and criminal codes]
§ 62A-3-305 (Civil Code) and § 76-5-111.1 (Criminal Code) – “Any person who has reason to believe that any vulnerable adult has been the subject of abuse, neglect, or exploitation shall immediately notify Adult Protective Services intake or the nearest law enforcement agency. . . . Any person who willfully fails to report suspected abuse, neglect, or exploitation of a vulnerable adult is guilty of a class B misdemeanor.” |
Many states also have laws requiring therapists to report misconduct by other providers. Sometimes such reports are required about any health care provider (see Florida, below); sometimes reports are legally required only about another mental health care provider; and sometimes reports are legally required only about someone licensed by the reporting therapist’s own board (see Indiana and Louisiana, below). Some states provide penalties for failure to report (see Louisiana, below). Most states require reports even if it requires breaching confidentiality; but others require a report only with the client’s written permission (see Indiana, below).
| Florida – § 456.063(3) Reporting of Allegations of Provider Sexual Misconduct (1) . . . Sexual misconduct in the practice of a health care profession is prohibited. (3)Licensed health care practitioners shall report allegations of sexual misconduct to the department, regardless of the practice setting in which the alleged sexual misconduct occurred.Indiana – 868 IAC 1.1-11-2 – Reporting Provider Violations – Board of Psychology “(e) When a psychologist has reason to believe there has been a violation by another psychologist of the statutes or rules of the board, the psychologist shall file a complaint with the consumer protection division of the office of the attorney general of Indiana. Information regarding such a violation obtained in the context of a professional relationship with a client is to be reported only with the written permission of the client.”Louisiana § 2717 (A)(8)Board of Social Work Disciplinary Actions – Penalty for Failure to Report “A. The board shall have the power to deny, revoke, or suspend any license, certificate, or registration issued by the board or applied for in accordance with this Chapter, or otherwise discipline a social worker for: . . .(8) Failure to report to the board knowledge of a violation or infraction of the social work practice act, rules and regulations promulgated by the board or ethical standards, or both. |
Finally, as a result of recent violence on college campuses, some states have initiated mandated reporting requirements regarding at-risk students, requiring therapists in state college counseling centers to notify a college-based threat-assessment team and/or the student’s parents. (See Virginia statute, below and in Section B, further below.)
| Virginia – § 23-9.2:3 State College Counselors Notify Parents of Student at Risk: “C. Notwithstanding any other provision of state law, the board of visitors or other governing body of every public institution of higher education in Virginia shall establish policies and procedures requiring the notification of the parent of a dependent student when such student receives mental health treatment at the institution’s student health or counseling center . . . Such notification shall only be required if it is determined that there exists a substantial likelihood that, as a result of mental illness the student will, in the near future, (i) cause serious physical harm to himself or others as evidenced by recent behavior or any other relevant information or (ii) suffer serious harm due to his lack of capacity to protect himself from harm or to provide for his basic human needs. . . [exceptions]” |
2. “DUTY TO PROTECT” LAWS
State case law ordinarily applies only in the state in which the case was decided, but the California Tarasoff case created major ripples across the country – subsequently all states enacted laws requiring therapists to initiate action if their patients threaten direct harm to another person. Unlike a true “duty to warn” requirement, most states impose a “duty to protect” — which can often be accomplished in ways other than by a breach of confidentiality to warn the intended victim. As noted in Part II, Step 1, however, research indicates that up to 75% of psychologists are misinformed about what the laws of their state require, with 90% of those nevertheless being confident that they are right — which can create unnecessary disclosures, placing patients at risk.
Most states legally impose a “duty to protect” requirement only if the patient poses a threat to others; but a very few states legally impose on therapists a duty to protect a patient from harm to self. (See examples below quoted from statutes in Nebraska and New Jersey.) As described in a later section of this Appendix, however, many states explicitly allow disclosure in circumstances of danger to self, but do not require such disclosure.
| Nebraska: § 38-2137 “The duty to warn of or to take reasonable precautions to provide protection from violent behavior shall arise only under the limited circumstances specified in subsection (1) of this section” [i.e., “when the patient has communicated to the mental health practitioner a serious threat of physical violence against himself, herself, or a reasonably identifiable victim or victims.” . . .”The duty shall be discharged by the mental health practitioner if reasonable efforts are made to communicate the threat to the victim or victims and to a law enforcement agency.” [emphasis added]New Jersey: § 2A:62A-16 – Duty to Warn and Protect “b. A duty to warn and protect is incurred when the following conditions exist: (1) The patient has communicated to that practitioner a threat of imminent, serious physical violence against a readily identifiable individual or against himself and the circumstances are such that a reasonable professional in the practitioner’s area of expertise would believe the patient intended to carry out the threat; or (2) The circumstances are such that a reasonable professional in the practitioner’s area of expertise would believe the patient intended to carry out an act of imminent, serious physical violence against a readily identifiable individual or against himself. |
B. LAWS ALLOWING OTHERS ACCESS TO PATIENT INFORMATION
and/or
LAWS ALLOWING OTHERS TO RE-DISCLOSE INFORMATION
Laws of this type take many forms, and they can be difficult to discover within the state code. The first Virginia statute below reflects the presence of “threat assessment teams” at state colleges and universities; these were created following recent episodes of campus violence in that state and elsewhere. This statute gives the threat assessment team legal access to certain mental health records, but it does not authorize re-disclosure of that information.
The second set Virginia examples below apply to the CASA (Child Abuse Special Advocate) program, which is present in several states. These statutes capture both of the confidentiality limitations above — one allows access to therapy information and records, the other provides for its re-disclosure. Virginia is one of the states in which CASA lay volunteers can be given access to the child’s therapy records in an abuse case, and can subsequently provide testimony in which they re-disclose that information. (See discussion in Part II, Step 4.)
| Virginia – State College Threat Assessment Team § 23-9.2:10 – Access Allowed, but Not Re-Disclosure “A. Each public college or university shall have in place policies and procedures for the prevention of violence on campus, including assessment and intervention with individuals whose behavior poses a threat to the safety of the campus community. . . . E. . . . Upon a preliminary determination that an individual poses a threat of violence to self or others, or exhibits significantly disruptive behavior or need for assistance, a threat assessment team may obtain . . . health records . . .No member of a threat assessment team shall re-disclose any . . . health information obtained pursuant to this section or otherwise use any record of an individual beyond the purpose for which such disclosure was made to the threat assessment team.”Virginia – CASA Volunteers § 9.1-156 – Access to Therapy Records – “A. Upon presentation by the advocate of the order of his appointment and upon specific court order, any state or local agency, department, authority, or institution, and any hospital, school, physician, or other health or mental health care provider shall permit the advocate to inspect and copy, without the consent of the child or his parents, any records relating to the child involved in the case. Upon the advocate presenting to the mental health provider the order of the advocate’s appointment and, upon specific court order, in lieu of the advocate inspecting and copying any related records of the child involved, the mental health care provider shall be available within seventy-two hours to conduct for the advocate a review and an interpretation of the child’s treatment records which are specifically related to the investigation” § 9.1-153 – Re-Disclosure Allowed in Testimony A. Services in each local court-appointed special advocate program shall be provided by volunteer court-appointed special advocates, hereinafter referred to as advocates. The advocate’s duties shall include: (1.) Investigating the case to which he is assigned to provide independent factual information to the court. (2.) Submitting to the court of a written report of his investigation . . . B. . . . The advocate may testify if called as a witness. . . |
C. LEGAL EXCEPTIONS TO THERAPIST-PATIENT PRIVILEGE
Sometimes these exceptions to privilege are listed within the privilege statute itself; sometimes they appear as a separate free-standing statute or within the Rules of Evidence.
Certain exceptions to privilege exist in almost every state: Communications between therapist and patient are usually not privileged if (1) the patient brings his/her own mental health into issue in the court case (see Florida, below); (2) the case involves child (or sometimes elder adult) abuse or neglect (see Ohio, below); (3) the court case involves an involuntary commitment proceeding (see Maryland, below); or if the testimony is pursuant to a court-ordered psychological evaluation or examination of the patient (see California, below).
Many states, however, have additional exceptions to privilege. Examples of these can include cases where the patient brings a complaint against the therapist or threatens to commit a crime or harmful act (see Oregon, below); or when the patient brings a personal injury claim (see Louisiana, below).
The broadest and least predictable exception to privilege is the “judicial discretion” exception, which applies only in Virginia and North Carolina (see Virginia example, below). It is broad because any judge may determine that any communication between a patient and his/her therapist is admissible as evidence. It is unpredictable because there is no way for patient or therapist to know in advance what determination a judge will make in any particular case, so attorneys are more likely to issue subpoenas in attempts to obtain that evidence, leaving patients and their therapists needing to try to quash them, case by case.
|
EXAMPLES OF EXCEPTIONS TO PRIVILEGE California – Exception to Privilege if Therapist Conducted Court-Ordered Examination/Evaluation Florida – Exception to Privilege if Patient’s Mental State At Issue Louisiana – Exception to Privilege in Personal Injury Claims Maryland – Exception to Privilege in Involuntary Commitment Cases Oregon – Exception to Privilege if Client Brings Complaint Against Therapist or |
III. LAWS ALLOWING DISCLOSURE
NOTE:
These laws allow (but do not require) therapists to disclose information without patient consent.
These laws do not create any real ethical-legal conflict, because
they do not legally require therapists to disclose anything.
Therapists must therefore inform prospective patients in advance
if they intend to voluntarily disclose in such circumstances.
(In book named above, See Figure 1.3, “Ethical Doors to Disclosure” and
Chapt er 5: “Step 2: “Telling Patients the Truth About Confidentiality’s Limits.”)
1. STATE:
The relevant state laws vary. Examples below are of laws that create legally-permitted exceptions to confidentiality, thereby permitting disclosure. They may be found among the listed exceptions to confidentiality within a non-disclosure law (such as in the first Florida statute below) or they may be in the form of a stand-alone statute (as in the second Florida statute below).
The Virginia example below includes some of the broadest exceptions to confidentiality. It is also an example of legally-allowed exceptions to confidentiality that are “hidden” within a non-disclosure law, the “Health Records Privacy Act.” Like the HIPAA regulations below it, this Virginia statute legally allows disclosure without patient consent for a very broad range of purposes. As with HIPAA, it is important for therapists to remember that, ethically speaking, there is a big difference between such “legally allowed” disclosures and a disclosure that is truly “legally required.”
| Florida – If Patient Presents Danger to Self, to Others, or to Society (Psychology) § 490-0147 Confidentiality and privileged communications.— “Any communication between any person licensed under this chapter and her or his patient or client shall be confidential. This privilege may be waived under the following conditions: . . . (3)When there is a clear and immediate probability of physical harm to the patient or client, to other individuals, or to society and the person licensed under this chapter communicates the information only to the potential victim, appropriate family member, or law enforcement or other appropriate authorities.” Florida – Allowed Disclosure re: HIV Status to Sexual Partner or Needle Sharer
§ 456.061 “(1) A [health care] practitioner. . . shall not be civilly or criminally liable for the disclosure of otherwise confidential information to a sexual partner or a needle-sharing partner under the following circumstances: (a)If a patient of the practitioner who has tested positive for human immunodeficiency virus discloses to the practitioner the identity of a sexual partner or a needle-sharing partner; (b)The practitioner recommends the patient notify the sexual partner or the needle-sharing partner of the positive test and refrain from engaging in sexual or drug activity in a manner likely to transmit the virus and the patient refuses, and the practitioner informs the patient of his or her intent to inform the sexual partner or needle-sharing partner; and (c)If pursuant to a perceived civil duty or the ethical guidelines of the profession, the practitioner reasonably and in good faith advises the sexual partner or the needle-sharing partner of the patient of the positive test and facts concerning the transmission of the virus.” [This must be done through protocols developed by the Department of Health.] Virginia – Health Records Privacy Act: Broad Disclosures Legally Allowed Without Consent |
2. FEDERAL:
The HIPAA regulations legally allow disclosure without patient consent for a very broad range of purposes. It is important for therapists to remember that, ethically speaking, there is a big difference between such “legally allowed” disclosures and a disclosure that is truly “legally required.”
FEDERAL:
HIPAA regulations legally allow disclosures without patient authorization in a very broad range of circumstances, as indicated by the Privacy Act regulation quoted below. The broad definitions of the terms “treatment,” “payment” and “health care operations” can be obtained at http://www.hipaa.com/2009/05/the-definition-of-treatment/
| HIPAA – Privacy Rule 45 CFR 164.502(a)(1) – “Permitted uses and disclosures. A covered entity is permitted to use or disclose protected health information as follows: . . . (ii) For treatment, payment, or health care operations . . .” |
IV. LAWS REQUIRING THERAPISTS TO
INFORM PROSPECTIVE CLIENTS ABOUT THE
LIMITS OF CONFIDENTIALITY
Just as most professional Ethics Codes require therapists to inform prospective patients about the limits of confidentiality, most states include this among the legal requirements. This usually appears within the state licensing board regulations, sometimes within the confidentiality section (See Maryland, below). Sometimes they are combined with other informed consent requirements within the board’s practice standards or code of conduct (see Virginia, below). Some states impose special requirements in particular cases or circumstances. For example, see below the Missouri informed consent regulations regarding third party referrals; the Ohio informed consent regulations in cases involving multiple parties (e.g., couple or family therapy; non-patient collateral participants); and the Montana regulation regarding the taping, recording, or observation of patients.
| Maryland Regulations – Board of Psychology Examiners 10.36.05.08. 08 Confidentiality and Client Records. “A. A psychologist shall . . . 2) Discuss the requirements and limitations of confidentiality at the beginning of the professional relationship or at the intake interview.”Missouri Regulations – Committee of Psychologists 20 CSR 2235-5 “7(A )(2). When a psychologist agrees to provide services to a person or entity at the request of a third party, the psychologist shall explain and document the nature of the relationships with all individuals or organizations involved. This includes the role of the psychologist, who is the client, the probable uses of the services provided or the information obtained, and any known or probable limits to confidentiality.”Montana Board of Social Work Examiners 2419.801 “(vii) obtain informed written consent of the client or the client’s legal guardian prior to taping, recording, or permitting third party observation of the client’s activities that might identify the client or place them at risk”Ohio Regulations – Board of Counselors, Social Workers, Marriage & Family Therapists OAC 4757-5 -02 Standards of Ethical Practice & Professional Conduct –(B) Responsibility to clients/consumers of services as to informed consent: “(6) When a counselor, social worker, or marriage and family therapist provides services to two or more clients who have a relationship with each other and who are aware of each other’s participation in treatment (for example couples, family members), a counselor, social worker, or marriage and family therapist shall clarify with all parties the nature of the licensee’s professional obligations to the various clients receiving services, including limits of confidentiality. A counselor, social worker, or marriage and family therapist who anticipates a conflict of interest among the clients receiving services or anticipates having to perform in potentially conflicting roles (for example a licensee who is asked or ordered to testify in a child custody dispute or divorce proceeding involving clients) shall clarify their role with the parties involved and take appropriate action to minimize any conflict of interest. “(7) When a counselor, social worker, or marriage and family therapist sees clients for individual or group treatment, there may be reason for a third party to join the session for a limited purpose. The licensee shall ask the client or legal guardian to provide written authorization that describes the purpose and need for the third party to join the session and describes the circumstances and extent to which confidential information may be disclosed to the third party. The counselor, social worker, or marriage and family therapist shall make it clear that the third party is not a client and there is no confidentiality between the licensee and the third party. The counselor, social worker, and marriage and family therapist shall make it clear to the third party that he/she shall not have rights to access any part of the client’s file including any session in which they participated unless the client signs a release. A counselor, social worker, or marriage or family therapist shall not make recommendations to courts, attorneys or other professional concerning non-clients.” Virginia – Board of Psychology |
V. LAWS RELEVANT TO STAFF TRAINING
ABOUT CONFIDENTIALITY
Laws and regulations can contain provisions about the responsibilities of mental health professionals in ensuring that their staff and employees understand how to protect patient confidentiality. While this does not explicitly impose a legal requirement to train staff in a particular way, it does imply that each therapist must be sure that all staff members–clinical and non-clinical– understand the ethical and legal confidentiality requirements that apply to his/her profession.
1. STATE:
Most of the relevant state requirements about staff training are in licensing board regulations rather than general statutes. (See examples below).
| Florida – 64B19-19.006 – Board of Psychology “(5) The licensed psychologist shall also ensure that no person working for the psychologist, whether as an employee, an independent contractor, or a volunteer violates the confidentiality of the service user.”Indiana – 868 IAC 1.1-11-2 State Psychology Board “(c) A psychologist shall ensure that all employees and psychology trainees are engaged only in activities consistent with their training and are aware of and adhere to the code of professional conduct as found in this rule.” Oregon – AR 833-100-0051(3) – Board of Licensed Professional Counselors and Therapists
“(3) A licensee, including employees and professional associates of the licensee, does not disclose any confidential information that the licensee, employee, or associate may have acquired in rendering services except as provided by rule or law. All other confidential information is disclosed only with the written informed consent of the client.” |
The federal regulations from the Health Insurance Portability & Accountability Act (HIPAA) explicitly require confidentiality training for the entire “workforce” in medical and mental health settings. The term “workforce” is defined to include paid employees, contracted agents, trainees, supervisees, volunteers – anyone under the direct control of the provider. (For detailed summary of HIPAA workforce training requirements, see Appendix IV of the book described above.)
| HIPAA: Privacy Rule: (45 CFR 184 530 (b) (1)). “A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information [PHI] required by this subpart, as necessary and appropriate for the members of the workforce to carry out their function within the covered entity” Enforcement Rule: Explains the circumstances under which clinicians may be held accountable for HIPAA violations by a member of their “workforce” or of a contracted “agent,” unless the provider had required them to sign a confidentiality contract explaining the HIPAA policies, and they broke it. The Enforcement Rule allows HHS to impose fines of up to $100 per violation, up to a maximum of $25,000 for violations of an identical requirement during one calendar year. (A continuing violation is deemed a separate violation for each day it occurs.) |
Go to Oxford Appendix III in pdf format
The Center for Ethical Practice is approved by the American Psychological Association (APA) to sponsor continuing education for psychologists. The Center maintains responsibility for this program and its content.
The Center for Ethical Practice has been approved by National Board for Certified Counselors (NBCC) as an Approved Continuing Education Provider (ACEP No. 6768). The Center is solely responsible for all aspects of the programs. Programs that do not qualify for NBCC credit are clearly identified.
The Center for Ethical Practice (provider 1287), is approved as an ACE provider to offer social work continuing education by the Association of Social Work Boards (ASWB) Approved Continuing Education (ACE) program. Regulatory boards are the final authority on courses accepted for continuing education credit. ACE provider approval period: 3/21/2021-3/21/2024.