Confidentiality Law — Apply duty to protect, privilege, and confidentiality statutes - Eppp Knowledge

SECTION 1

Historical Context & Motivation

The therapeutic relationship has long depended on the assurance that what a client shares in session remains private. Without this assurance, clients would self-censor, undermining the very foundation of effective psychological treatment. The legal codification of confidentiality in mental health practice evolved gradually, shaped by landmark court decisions, federal legislation, and evolving ethical standards within the profession. Understanding this history is essential for EPPP preparation because it reveals why current statutes exist and how courts balance client privacy against public safety.

1974 • Tarasoff v. Regents (Tarasoff I)

The California Supreme Court first articulated a duty to warn identifiable potential victims when a therapist determines that a client poses a serious danger. This case fundamentally challenged the absolute nature of therapist-client confidentiality.

1976 • Tarasoff v. Regents (Tarasoff II)

On rehearing, the court broadened the obligation from a duty to warn to a duty to protect, stating that 'the protective privilege ends where the public peril begins.' This expanded the range of permissible interventions beyond simply warning a victim.

1996 • Jaffee v. Redmond

The U.S. Supreme Court recognized psychotherapist-patient privilege under federal law (Federal Rule of Evidence 501), extending protections previously afforded to attorney-client communications. The Court emphasized that effective psychotherapy depends on an atmosphere of trust.

1996–2013 • HIPAA and the HITECH Act

The Health Insurance Portability and Accountability Act (1996) and its subsequent Privacy Rule (2003), along with the HITECH Act (2009), established comprehensive federal standards for protected health information (PHI), including psychotherapy notes, with civil and criminal penalties for breaches.

2010s–Present • State Variations and Telehealth Expansion

States have adopted divergent duty-to-protect statutes, ranging from mandatory duty to permissive authority to no recognized duty at all. The rapid expansion of telehealth has further complicated jurisdictional questions about which state's confidentiality laws apply.

These historical developments raise a central question that every practicing clinician must answer: Under what circumstances does the law require, permit, or prohibit a therapist from disclosing confidential information? Answering this question demands a precise understanding of the distinctions among confidentiality, privilege, and the duty to protect—three related but legally distinct concepts.

SECTION 2

Core Principles & Definitions

Three foundational legal concepts form the architecture of privacy in mental health practice. Although they are often conflated in everyday clinical conversation, each operates in a distinct legal domain with different sources of authority, different holders of the right, and different consequences when breached. A clinician preparing for the EPPP must be able to distinguish these concepts rapidly and apply them to novel fact patterns.

Confidentiality

An ethical and legal obligation not to disclose information obtained in a professional relationship without the client's consent. It is governed by professional ethics codes (APA Standard 4), state statutes, and HIPAA. Confidentiality applies in all settings—clinical, forensic, research—and the duty belongs to the clinician.

Privilege

A legal right belonging to the client (not the therapist) that prevents the disclosure of confidential communications in judicial or quasi-judicial proceedings. It is codified in evidence law and can only be waived by the client or their legal representative. Privilege is narrower than confidentiality because it applies specifically in legal contexts.

Duty to Protect

A legally imposed exception to confidentiality that requires or permits a therapist to take reasonable steps to protect an identifiable third party from serious harm threatened by a client. Steps may include warning the victim, notifying law enforcement, involuntary hospitalization, or modifying the treatment plan. This duty varies significantly across jurisdictions.

Informed Consent to Treatment

Confidentiality protections must be explained to clients at the outset of treatment, including the limits of confidentiality (e.g., child abuse reporting, danger to self or others, court orders). This proactive disclosure is both an ethical mandate under the APA Ethics Code and a legal requirement in most jurisdictions.

✦

KEY TAKEAWAY

Think of confidentiality as a locked filing cabinet in your office—you control who opens it. Privilege is a shield that your client holds up in a courtroom to keep that cabinet closed during legal proceedings. The duty to protect is a fire alarm: even though the cabinet is locked and the shield is raised, when someone's life is in imminent danger, the alarm overrides everything. The EPPP tests whether you know who holds each key, when each mechanism activates, and which legal authority governs each one.

SECTION 3

Visual Explanation — The Confidentiality Framework

This nested diagram illustrates the hierarchical relationship among the three core concepts. Confidentiality is the broadest layer, encompassing all professional obligations to protect client information. Privilege is a subset that operates specifically within judicial proceedings. The duty to protect sits at the center as the exception that can override both outer layers when imminent danger is present.

The diagram above captures a principle that EPPP questions frequently test: confidentiality and privilege are default protections that exist unless a legally recognized exception applies. The duty to protect is the most clinically urgent of those exceptions, but it is not the only one. Other exceptions include mandatory child abuse and elder abuse reporting, court orders, client waivers, and situations involving imminent danger to self. Clinicians must recognize that privilege belongs to the client, meaning a therapist cannot independently choose to waive it—even if the therapist believes disclosure would be therapeutically beneficial.

SECTION 4

How It Works — Confidentiality Statutes and Exceptions

HIPAA and Psychotherapy Notes

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule distinguishes between general protected health information (PHI) and psychotherapy notes. Psychotherapy notes—defined as a therapist's personal process notes recorded during or after a session—receive heightened protection. Unlike general PHI, psychotherapy notes cannot be disclosed for treatment, payment, or health care operations without specific client authorization. However, HIPAA sets a federal floor, not a ceiling: state laws that offer stronger privacy protections supersede HIPAA. This interplay between federal and state law is a frequent EPPP topic.

The Privilege Doctrine in Detail

Psychotherapist-patient privilege, affirmed in Jaffee v. Redmond (1996), protects confidential communications between a licensed psychotherapist and a client from compelled disclosure in federal court proceedings. The privilege extends to licensed social workers, psychologists, and psychiatrists. Critically, the privilege is not absolute. Common exceptions include situations where the client places their mental health at issue in litigation (e.g., an insanity defense or personal injury claim), child custody evaluations ordered by the court, and court-ordered psychological evaluations. When a client introduces their mental condition as an element of a legal claim, they implicitly waive the privilege with respect to that condition.

Exceptions to Confidentiality — A Systematic Framework

Danger to others (Duty to Protect/Warn): When a client poses a credible, imminent threat to an identifiable third party, the clinician may or must (depending on jurisdiction) breach confidentiality to take protective action.
Danger to self: Clinicians may breach confidentiality to prevent imminent self-harm, including involuntary hospitalization procedures.
Mandatory reporting (child/elder abuse): All 50 states require mental health professionals to report suspected child abuse or neglect; most also mandate reporting of elder or dependent adult abuse.
Court orders and subpoenas: A valid court order generally compels disclosure. A subpoena alone, however, does not override privilege—the clinician should assert privilege and seek legal guidance before disclosing.
Client waiver: The client may voluntarily authorize release of records. Even so, clinicians should disclose only the minimum necessary information.

⚠

EPPP Alert: Subpoena vs. Court Order

A common EPPP trap involves confusing a subpoena with a court order. A subpoena is issued by an attorney and does not, by itself, compel a therapist to disclose privileged information. A court order is issued by a judge and generally does compel disclosure. When receiving a subpoena, the correct first step is to assert privilege and consult with an attorney—not to release records.

SECTION 5

State Variations in Duty-to-Protect Statutes

One of the most challenging aspects of confidentiality law for EPPP candidates is the wide variability in how states have implemented the duty to protect. Not all states follow the Tarasoff model, and some have rejected it entirely. Understanding the spectrum of state approaches is crucial because the EPPP may present scenarios requiring you to identify which type of duty applies in a given jurisdiction.

This diagram categorizes states into three models of duty-to-protect law. On the EPPP, when a question does not specify a jurisdiction, the default assumption is the Tarasoff mandatory duty standard. However, questions that specify a state with a permissive or no-duty approach require you to adjust your analysis accordingly.

It is worth emphasizing that even in states without a statutory duty to protect, the APA Ethics Code (Standard 4.05) permits psychologists to disclose confidential information without consent when the disclosure is necessary to protect the client or others from harm. Therefore, a clinician in a "no statutory duty" state who fails to take any protective action when a client threatens serious violence may not face tort liability under Tarasoff, but could still face sanctions from a licensing board for violating ethical standards. The EPPP tests awareness of this distinction between legal liability and ethical responsibility.

SECTION 6

Worked Example — Clinical Scenario Analysis

The following scenario mirrors the type of clinical vignette frequently encountered on the EPPP. We will walk through the decision-making process step by step, identifying the relevant legal and ethical considerations at each stage.

Scenario: A Client Threatens a Co-Worker

1
Step 1 — Identify the Clinical Facts

Dr. Reyes, a licensed psychologist in California, is treating Marcus, a 34-year-old man with a history of intermittent explosive disorder. During a session, Marcus states: 'I'm going to kill my supervisor, Daniel Chen, the next time he humiliates me in a meeting. I know where he parks his car.' Marcus has a prior arrest for aggravated assault, and Dr. Reyes assesses the threat as credible and imminent.

Key facts: specific, identifiable victim (Daniel Chen); credible, imminent threat of serious physical harm; jurisdiction is California (mandatory duty state).
2
Step 2 — Determine Applicable Legal Standard

California follows the Tarasoff mandatory duty-to-protect standard, codified in California Civil Code § 43.92. Under this statute, a therapist has a duty to protect an identifiable victim from a patient's serious threat of physical violence. The statute specifies that the duty is discharged by making reasonable efforts to communicate the threat to the victim and to a law enforcement agency. Dr. Reyes is legally required—not merely permitted—to take protective action.

Applicable standard: California's mandatory duty to protect (Tarasoff II / Civil Code § 43.92).
3
Step 3 — Evaluate Confidentiality Exceptions

Dr. Reyes must consider whether breaching confidentiality is legally justified. The duty-to-protect exception clearly applies here because: (a) Marcus has communicated a serious threat of physical violence, (b) the threat is directed at an identifiable individual, and (c) the threat appears imminent and credible based on Marcus's history and specificity. Confidentiality must yield to the duty to protect. Privilege would also not bar disclosure in this context because privilege applies to judicial proceedings, not to protective warnings.

Exception applies: Duty to protect overrides confidentiality. Privilege is not implicated (no judicial proceeding).
4
Step 4 — Select Appropriate Protective Actions

Under California law, Dr. Reyes should: (1) make reasonable efforts to communicate the threat to Daniel Chen directly, (2) notify a law enforcement agency, and (3) consider additional clinical interventions such as increasing the frequency of sessions, adjusting medication (in consultation with a prescriber), or initiating voluntary or involuntary hospitalization if Marcus meets criteria. The therapist should also document all steps taken and the clinical reasoning behind each decision.

Actions: Warn Daniel Chen, notify law enforcement, consider hospitalization, document thoroughly.
5
Step 5 — Address Ongoing Therapeutic and Ethical Obligations

After taking protective action, Dr. Reyes has continuing obligations. She should inform Marcus that she has breached confidentiality and explain the legal and ethical basis for doing so, unless doing so would further endanger Daniel Chen or others. She should document the disclosure in Marcus's clinical record, continue to assess and manage risk, and consider whether the therapeutic relationship can continue effectively. If Marcus feels that trust has been broken, appropriate referral options should be explored. Dr. Reyes should also consult with a colleague or supervisor to ensure her actions were clinically and legally sound.

Post-disclosure duties: Inform client, document, continue risk management, consult, consider referral.

SECTION 7

Comparing Confidentiality, Privilege, and Duty to Protect

Dimension	Confidentiality	Privilege	Duty to Protect
Legal source	Ethics codes, HIPAA, state licensing statutes	Evidence rules (federal & state), Jaffee v. Redmond	Tarasoff case law, state duty-to-protect statutes
Who holds it	Therapist's duty	Client's right	Society's interest (imposed on therapist)
Scope	All professional settings	Judicial/legal proceedings only	Applies when imminent danger exists
Who can waive	Client (via written authorization)	Client or their legal representative only	Not waivable—it is a legal obligation or authority
Consequence of violation	Licensing sanctions, malpractice liability, HIPAA penalties	Contempt of court (if wrongfully asserted), malpractice	Tort liability for harm to third party (in mandatory states)
Relationship to others	Broadest concept; contains privilege as a subset	A specific application of confidentiality in legal settings	An exception that overrides both confidentiality and privilege

Comparison of the three core concepts in confidentiality law

✦

KEY TAKEAWAY

These three concepts form a hierarchy with a built-in override. Imagine a Russian nesting doll: the largest doll is confidentiality (it encompasses everything), the middle doll is privilege (a specialized form of confidentiality for the courtroom), and the smallest doll is the duty to protect—except that this smallest doll has a spring mechanism that, when triggered, pops open all the outer dolls. The EPPP tests whether you can identify which doll you are dealing with and whether the spring has been triggered.

SECTION 8

Connection to Advanced Legal and Ethical Issues

The foundational concepts of confidentiality, privilege, and duty to protect extend into several advanced areas that EPPP candidates should be aware of. These issues represent the evolving frontier of confidentiality law and are increasingly tested on the examination.

Foundational Concept	Advanced Extension	Key Consideration
Confidentiality in individual therapy	Confidentiality in group, couple, and family therapy	Privilege may not extend to statements made in the presence of third parties (e.g., other group members). Clinicians must clarify limits at the outset.
Duty to protect identifiable victims	Duty to protect unidentifiable victims	Some courts have expanded the duty beyond identifiable victims to foreseeable victims (e.g., Hedlund v. Superior Court extended duty to foreseeable bystanders).
HIPAA Privacy Rule	State privacy laws and preemption	HIPAA preempts state law only when the state law is less protective. When state law provides greater privacy protections, the state law controls.
Adult client privilege	Minor client confidentiality	Parents generally hold the privilege for minor children, but mature minor doctrines and state laws on adolescent consent to treatment can complicate parental access to records.
In-person therapy confidentiality	Telehealth and digital confidentiality	Telehealth introduces multi-state jurisdictional issues, electronic record security, and platform compliance with HIPAA. The therapist must determine which state's laws govern the session.

Foundational concepts and their advanced legal extensions

Looking forward, the intersection of technology and confidentiality law continues to generate new legal questions. The use of electronic health records, artificial intelligence in clinical decision-making, and social media all present novel challenges to traditional confidentiality frameworks. EPPP candidates should be prepared for questions that test their ability to apply foundational principles to these emerging contexts, recognizing that the core logic—protecting client trust while safeguarding public welfare—remains constant even as the specific applications evolve.

SECTION 9

Practice Problems

Question 1: CONCEPTUAL

A psychologist receives a subpoena from an attorney requesting all treatment records for a current client. The client has not provided authorization for release. What is the psychologist's most appropriate first step?

Show answer

The psychologist should assert psychotherapist-patient privilege and not release the records in response to the subpoena alone. A subpoena, unlike a court order, is issued by an attorney and does not by itself override privilege. The correct first step is to contact the client to inform them of the subpoena, advise them to consult with their attorney, and seek legal consultation. If the client wishes to waive privilege, the psychologist may then release the records. If the client does not waive privilege, the psychologist should assert it and, if necessary, file a motion to quash the subpoena. Only a valid court order issued by a judge compels disclosure over a privilege assertion.

Question 2: BASIC APPLICATION

Dr. Patel is treating a 28-year-old woman in individual psychotherapy. During a session, the client discloses that she has been physically abusing her 4-year-old daughter. Dr. Patel practices in a state with mandatory child abuse reporting laws. Is Dr. Patel required to break confidentiality? Identify the applicable exception.

Show answer

Yes, Dr. Patel is required to break confidentiality and file a report with the appropriate child protective services agency. The applicable exception is mandatory child abuse reporting, which exists in all 50 states and overrides both confidentiality and privilege. Under mandatory reporting statutes, mental health professionals are designated as mandated reporters and must report suspected child abuse or neglect when they have reasonable suspicion, regardless of whether the abuser is their client. Dr. Patel should inform the client that she is obligated to make the report, explain the legal basis for doing so, and document the disclosure and the report in the clinical record.

Question 3: INTERMEDIATE

A psychologist in a permissive duty-to-protect state is treating a client who expresses homicidal ideation toward his ex-girlfriend but states he 'would never actually do anything.' The client has no history of violence and no access to weapons. The psychologist conducts a thorough risk assessment and determines the risk of violence is low. Must the psychologist break confidentiality? What factors should guide this decision?

Show answer

In a permissive duty-to-protect state, the psychologist is not legally required to break confidentiality but is legally permitted to do so without liability if she acts in good faith. The decision should be guided by the results of a thorough risk assessment, which this psychologist has conducted. Relevant factors include: the specificity and credibility of the threat, the client's history of violence, access to means, identifiability of the victim, substance use, recent stressors, and protective factors. Since the risk assessment yields a low risk determination, the psychologist may reasonably choose to continue treatment, increase monitoring, develop a safety plan, and document the assessment and clinical reasoning. However, the psychologist should also consider consulting with a colleague and continuing to reassess risk at each subsequent session. The APA Ethics Code (Standard 4.05) provides ethical authorization for disclosure to protect others from harm, even in the absence of a legal mandate.

Question 4: APPLIED

Dr. Kim, a psychologist licensed in New York, provides telehealth services to a client physically located in Texas during sessions. During a session, the client reveals a plan to harm a specific co-worker. Dr. Kim is unsure which state's duty-to-protect law applies. How should Dr. Kim proceed, and what jurisdictional considerations are relevant?

Show answer

This scenario illustrates the complex jurisdictional issues arising in telehealth practice. As a general principle, the laws of the state where the client is physically located at the time of the session typically govern the clinical encounter—in this case, Texas. Texas has a permissive duty-to-protect statute, meaning Dr. Kim is permitted but not required to warn the potential victim. However, New York, where Dr. Kim is licensed, has a mandatory duty-to-protect statute. Dr. Kim may be subject to licensing board jurisdiction in New York as well. Given the ambiguity, the most prudent course is to: (1) treat the situation as if the most protective standard applies (i.e., treat it as a mandatory duty), (2) take steps to warn the identified co-worker and notify law enforcement, (3) consult with an attorney familiar with both states' laws, (4) document the analysis and actions taken, and (5) continue clinical risk management. When in doubt, erring on the side of protecting life is both ethically and legally defensible.

Question 5: CRITICAL THINKING

Consider a hypothetical case where a client in couples therapy discloses to the therapist, in an individual session, that he is HIV-positive and has not informed his wife, who is also a client in the couples treatment. The jurisdiction has a mandatory duty-to-protect statute, and the therapist is aware that the wife may be at risk of contracting a life-threatening illness. Analyze the competing legal and ethical obligations. What should the therapist do?

Show answer

This scenario presents a genuine conflict between multiple legal and ethical obligations. First, confidentiality generally prohibits the therapist from disclosing the husband's HIV status to the wife without his consent. Second, the therapist must consider whether the jurisdiction's duty-to-protect statute encompasses serious health threats (not only physical violence)—some states have expanded Tarasoff to include HIV disclosure, while others have not. Third, many states have specific HIV disclosure statutes that either prohibit or regulate the circumstances under which HIV status may be revealed. Fourth, the APA Ethics Code (Standard 4.05) permits disclosure to protect identifiable third parties from serious harm. The therapist should: (1) strongly encourage the husband to disclose his status to his wife voluntarily, (2) consult the specific jurisdiction's laws regarding both duty-to-protect and HIV-specific confidentiality statutes, (3) seek legal consultation and peer supervision, (4) if the jurisdiction permits or requires disclosure and the husband refuses to inform his wife, consider making a carefully limited disclosure to the wife regarding risk, and (5) document all consultations, decision-making processes, and actions taken. This case illustrates that when statutes conflict—HIV confidentiality laws versus duty-to-protect statutes—the most protective and specific statute generally controls, and the clinician must navigate with extreme care.

SUMMARY

Lesson Summary

Summary

This lesson examined the three pillars of privacy in mental health practice. Confidentiality is the broadest obligation, rooted in ethics codes, HIPAA, and state licensing statutes, requiring therapists to protect all information obtained in the professional relationship. Privilege is a narrower, client-held right that prevents compelled disclosure in judicial proceedings, as affirmed in Jaffee v. Redmond (1996). The duty to protect, originating from the Tarasoff decisions (1974, 1976), is the critical exception that overrides both confidentiality and privilege when a client poses an imminent, serious threat to an identifiable third party.

For the EPPP, remember these key distinctions: privilege belongs to the client, not the therapist; a subpoena alone does not override privilege (only a court order does); states vary in whether they impose a mandatory, permissive, or no statutory duty to protect; and HIPAA sets a federal floor for privacy protections, but more protective state laws supersede it. When in doubt on the EPPP and no jurisdiction is specified, apply the Tarasoff mandatory duty-to-protect standard as the default. Above all, clinicians must provide informed consent at the outset of treatment that clearly explains both the protections and the limits of confidentiality.