The duty of confidentiality for mental health professionals

Mental health professionals must maintain confidentiality when working with clients to keep health information private. However, there are some cases in which information can be shared to protect the client or others, and there are varying rules around this.

What is client confidentiality?

Confidentiality laws apply to all healthcare professionals and refer to the privacy of an individual’s information and health records. Client confidentiality prevents professionals from sharing information about an individual without consent, aside from specific necessary circumstances ^[1].

Confidentiality in mental health care ensures the privacy of information relating to the diagnosis and treatment of the individual, as well as specific details, such as conversations within therapy sessions. Breaching confidentiality agreements can result in legal repercussions, which can be instigated by the state or affected individuals ^[2][3].

What are the client confidentiality laws for mental health therapists in the U.S.?

All healthcare providers in the U.S. must abide by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a federal law created to protect individuals’ healthcare information ^[4]. This law outlines the regulations around sharing any health information and details by setting specific privacy rules relating to information discussed in psychotherapy ^[3].

Before commencing therapy sessions, the therapist must inform the client of confidentiality laws. This may involve the use of a form detailing the rules around information privacy and the exceptions in which information can be shared ^[2].

The client will be informed that they have the following rights ^[1][5]:

• They are permitted to access their own records and information.
• Their information will only be shared with others if they provide consent.
• Information may be shared with other agencies should the client pose a significant risk to themselves or others or if the information is required for legal reasons.
• If the therapist breaches confidentiality, the client has the right to pursue legal action.

The client must be able to read and understand this information before signing the agreement if they have the capacity to do so. They may also consent to share information with specific family members, friends, or people involved in their care ^[5].

It should be noted that the age of consent for mental health services varies state to state. Depending on the state’s age requirement, the child’s guardian will have to complete the form regardless of the minor’s ability to do so.

If the client does not have capacity, which may occur in the case of those with severe mental illness or cognitive impairment, it could be in their best interest for a guardian or caregiver to be informed of the details around their mental health. This may include information relating to their diagnosis and treatment plan ^[3].

However, this will likely depend on the circumstances, and the therapist is not permitted to share specific details of information discussed within their sessions ^[6][7].

The therapist is legally required to ensure that health information records must be inaccessible to others, such as in locked drawers or on password-protected computers. Additionally, they must ensure that communication with their client remains private, such as not mentioning confidential information in voicemails or messages ^[2].

Are there any exceptions to confidentiality in mental health therapy?

There are exceptions to the confidentiality laws applicable to mental health therapists. Information disclosed in therapy sessions may be shared with others if ^[3][8]:

• The individual demonstrates that they are at serious risk of suicide.
• The individual discloses intentions of committing a crime.
• The individual discloses intentions of severely harming another person.
• The client is a child or vulnerable adult who is suspected to be at risk of abuse or other criminal activity.

In these circumstances, the therapist is legally required to disclose information about a client’s health or therapy discussions to ensure the individual’s and others’ safety. This is commonly called the Duty to Warn or Duty to Protect ^[9].

Additionally, confidential information may be shared if ^[8]:

• Information is required for a legal evaluation of the individual’s mental state or competence.
• Information is required for any other legal proceeding.

In these circumstances, health records and information shared in therapy sessions may be presented as evidence in court or used to evaluate the individual’s mental state ^[10].

Duty to Warn/Protect

The mental health professional is likely to be immune from legal repercussions for breaching confidentiality if information is shared to prevent harm. However, the mental health professional may face liability if they fail to report a potential risk.

Information that can be disclosed includes ^[9][11]:

Suicide risk

The therapist might disclose this information to the individual’s next of kin or caregiver in order to ensure their safety and prevent harm. If the client is deemed a high risk of suicide, it may be necessary for the therapist to arrange hospitalization. Therefore, this information must be shared to ensure the client receives appropriate treatment and their safety is maintained.

Risk of harming a victim or group

If the client discloses that they intend to harm a specific person or commit an act that could cause harm to several people, the therapist can report this information.

They might disclose this information to the potential victim to alert them of the potential risk and allow them to take precautions or instigate safety measures. If necessary, the therapist might report this risk to law enforcement, so appropriate action can be taken to prevent severe harm, such as removing firearms or weapons.

Risk of child abuse

This information can be reported if the client is a child believed to be encountering abuse or neglect. Similarly, if the client is an adult discussing a past occurrence or intention of child abuse, this can also be reported.

The therapist can disclose this information to Child Protection Services, law enforcement, or the parent or guardian of the child if they are not the suspected abuser and it is appropriate to do so.

State differences

This law varies from state to state. In some states, the Duty to Warn/Protect is mandatory, and a professional can be held liable for failing to disclose a risk of harm. Because of the potential for liability, the rules around this are very specific. The professional is required to disclose information if there is an imminent or inevitable risk and if a specific victim can be identified ^[9].

States in which the Duty to Warn/Protect is mandatory include ^[11]:

• Washington
• California
• Colorado
• Ohio

In some states, the Duty to Warn is permissive, so a professional can use their discretion to decide the level of risk and if information needs to be shared. In these states, information can be legally disclosed if there is any potential risk of harm. Additionally, the professional might be protected from being held liable for failing to report a potential threat if they did not consider the risk inevitable ^[9].

States in which the Duty to Warn/Protect is permissive include ^[11]:

• Oregon
• Arizona
• Texas
• Florida

Some states do not allow any breach of confidentiality, so the Duty to Warn/Protect is not applicable. This is the case in ^[11]:

• North Dakota
• Maine
• North Carolina

State laws also vary concerning ^[9][11]:

• The type of professional they apply to, such as psychologists, social workers, and counselors
• How the certainty of risk is determined
• How and to whom the risk can be reported

There are conflicting opinions about the enforcement of information disclosure. Some professionals consider mandatory reporting a barrier to care, as it may prevent individuals from attending therapy or disclosing their intentions. Additionally, it could discourage therapists from working with potentially violent individuals for fear of facing liability if they fail to report risk.

Permissive disclosure allows the professional to use their professional judgment and determine the individual’s level of risk. This may be beneficial in some cases, allowing for confidentiality to be maintained and preventing damaging therapeutic relationships. Although for others, it may cause a failure to report risks that are later acted upon and may have been prevented ^[9][11].

Ultimately, the therapist must use their professional experience and judgment to decide the best course of action in each individual circumstance ^[10].