Confidentiality Law — Apply duty to protect, privilege, and...

SECTION 1

Historical Context & Motivation

The therapeutic relationship has long depended on the assurance that what a client shares in session remains private. Without this assurance, clients would self-censor, undermining the very foundation of effective psychological treatment. The legal codification of confidentiality in mental health practice evolved gradually, shaped by landmark court decisions, federal legislation, and evolving ethical standards within the profession. Understanding this history is essential for EPPP preparation because it reveals why current statutes exist and how courts balance client privacy against public safety.

1974

Tarasoff v. Regents (Tarasoff I)

The California Supreme Court first articulated a duty to warn identifiable potential victims when a therapist determines that a client poses a serious danger. This case fundamentally challenged the absolute nature of therapist-client confidentiality.

1976

Tarasoff v. Regents (Tarasoff II)

On rehearing, the court broadened the obligation from a duty to warn to a duty to protect, stating that 'the protective privilege ends where the public peril begins.' This expanded the range of permissible interventions beyond simply warning a victim.

1996

Jaffee v. Redmond

The U.S. Supreme Court recognized psychotherapist-patient privilege under federal law (Federal Rule of Evidence 501), extending protections previously afforded to attorney-client communications. The Court emphasized that effective psychotherapy depends on an atmosphere of trust.

1996–2013

HIPAA and the HITECH Act

The Health Insurance Portability and Accountability Act (1996) and its subsequent Privacy Rule (2003), along with the HITECH Act (2009), established comprehensive federal standards for protected health information (PHI), including psychotherapy notes, with civil and criminal penalties for breaches.

2010s–Present

State Variations and Telehealth Expansion

States have adopted divergent duty-to-protect statutes, ranging from mandatory duty to permissive authority to no recognized duty at all. The rapid expansion of telehealth has further complicated jurisdictional questions about which state's confidentiality laws apply.

These historical developments raise a central question that every practicing clinician must answer: Under what circumstances does the law require, permit, or prohibit a therapist from disclosing confidential information? Answering this question demands a precise understanding of the distinctions among confidentiality, privilege, and the duty to protect—three related but legally distinct concepts.

SECTION 2

Core Principles & Definitions

Three foundational legal concepts form the architecture of privacy in mental health practice. Although they are often conflated in everyday clinical conversation, each operates in a distinct legal domain with different sources of authority, different holders of the right, and different consequences when breached. A clinician preparing for the EPPP must be able to distinguish these concepts rapidly and apply them to novel fact patterns.

Confidentiality

An ethical and legal obligation not to disclose information obtained in a professional relationship without the client's consent. It is governed by professional ethics codes (APA Standard 4), state statutes, and HIPAA. Confidentiality applies in all settings—clinical, forensic, research—and the duty belongs to the clinician.

Privilege

A legal right belonging to the client (not the therapist) that prevents the disclosure of confidential communications in judicial or quasi-judicial proceedings. It is codified in evidence law and can only be waived by the client or their legal representative. Privilege is narrower than confidentiality because it applies specifically in legal contexts.

Duty to Protect

A legally imposed exception to confidentiality that requires or permits a therapist to take reasonable steps to protect an identifiable third party from serious harm threatened by a client. Steps may include warning the victim, notifying law enforcement, involuntary hospitalization, or modifying the treatment plan. This duty varies significantly across jurisdictions.

Informed Consent to Treatment

Confidentiality protections must be explained to clients at the outset of treatment, including the limits of confidentiality (e.g., child abuse reporting, danger to self or others, court orders). This proactive disclosure is both an ethical mandate under the APA Ethics Code and a legal requirement in most jurisdictions.

✦ KEY TAKEAWAY

Think of confidentiality as a locked filing cabinet in your office—you control who opens it. Privilege is a shield that your client holds up in a courtroom to keep that cabinet closed during legal proceedings. The duty to protect is a fire alarm: even though the cabinet is locked and the shield is raised, when someone's life is in imminent danger, the alarm overrides everything. The EPPP tests whether you know who holds each key, when each mechanism activates, and which legal authority governs each one.

SECTION 3

Visual Explanation — The Confidentiality Framework

This nested diagram illustrates the hierarchical relationship among the three core concepts. Confidentiality is the broadest layer, encompassing all professional obligations to protect client information. Privilege is a subset that operates specifically within judicial proceedings. The duty to protect sits at the center as the exception that can override both outer layers when imminent danger is present.

The diagram above captures a principle that EPPP questions frequently test: confidentiality and privilege are default protections that exist unless a legally recognized exception applies. The duty to protect is the most clinically urgent of those exceptions, but it is not the only one. Other exceptions include mandatory child abuse and elder abuse reporting, court orders, client waivers, and situations involving imminent danger to self. Clinicians must recognize that privilege belongs to the client, meaning a therapist cannot independently choose to waive it—even if the therapist believes disclosure would be therapeutically beneficial.

SECTION 4

How It Works — Confidentiality Statutes and Exceptions

HIPAA and Psychotherapy Notes

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule distinguishes between general protected health information (PHI) and psychotherapy notes. Psychotherapy notes—defined as a therapist's personal process notes recorded during or after a session—receive heightened protection. Unlike general PHI, psychotherapy notes cannot be disclosed for treatment, payment, or health care operations without specific client authorization. However, HIPAA sets a federal floor, not a ceiling: state laws that offer stronger privacy protections supersede HIPAA. This interplay between federal and state law is a frequent EPPP topic.

The Privilege Doctrine in Detail

Psychotherapist-patient privilege, affirmed in Jaffee v. Redmond (1996), protects confidential communications between a licensed psychotherapist and a client from compelled disclosure in federal court proceedings. The privilege extends to licensed social workers, psychologists, and psychiatrists. Critically, the privilege is not absolute. Common exceptions include situations where the client places their mental health at issue in litigation (e.g., an insanity defense or personal injury claim), child custody evaluations ordered by the court, and court-ordered psychological evaluations. When a client introduces their mental condition as an element of a legal claim, they implicitly waive the privilege with respect to that condition.

Exceptions to Confidentiality — A Systematic Framework

Danger to others (Duty to Protect/Warn): When a client poses a credible, imminent threat to an identifiable third party, the clinician may or must (depending on jurisdiction) breach confidentiality to take protective action.
Danger to self: Clinicians may breach confidentiality to prevent imminent self-harm, including involuntary hospitalization procedures.
Mandatory reporting (child/elder abuse): All 50 states require mental health professionals to report suspected child abuse or neglect; most also mandate reporting of elder or dependent adult abuse.
Court orders and subpoenas: A valid court order generally compels disclosure. A subpoena alone, however, does not override privilege—the clinician should assert privilege and seek legal guidance before disclosing.
Client waiver: The client may voluntarily authorize release of records. Even so, clinicians should disclose only the minimum necessary information.

⚠️ EPPP Alert: Subpoena vs. Court Order

A common EPPP trap involves confusing a subpoena with a court order. A subpoena is issued by an attorney and does not, by itself, compel a therapist to disclose privileged information. A court order is issued by a judge and generally does compel disclosure. When receiving a subpoena, the correct first step is to assert privilege and consult with an attorney—not to release records.

SECTION 5

State Variations in Duty-to-Protect Statutes

One of the most challenging aspects of confidentiality law for EPPP candidates is the wide variability in how states have implemented the duty to protect. Not all states follow the Tarasoff model, and some have rejected it entirely. Understanding the spectrum of state approaches is crucial because the EPPP may present scenarios requiring you to identify which type of duty applies in a given jurisdiction.

This diagram categorizes states into three models of duty-to-protect law. On the EPPP, when a question does not specify a jurisdiction, the default assumption is the Tarasoff mandatory duty standard. However, questions that specify a state with a permissive or no-duty approach require you to adjust your analysis accordingly.

It is worth emphasizing that even in states without a statutory duty to protect, the APA Ethics Code (Standard 4.05) permits psychologists to disclose confidential information without consent when the disclosure is necessary to protect the client or others from harm. Therefore, a clinician in a "no statutory duty" state who fails to take any protective action when a client threatens serious violence may not face tort liability under Tarasoff, but could still face sanctions from a licensing board for violating ethical standards. The EPPP tests awareness of this distinction between legal liability and ethical responsibility.

SECTION 6

Worked Example — Clinical Scenario Analysis

The following scenario mirrors the type of clinical vignette frequently encountered on the EPPP. We will walk through the decision-making process step by step, identifying the relevant legal and ethical considerations at each stage.

Scenario: A Client Threatens a Co-Worker

Step 1 — Identify the Clinical FactsDr. Reyes, a licensed psychologist in California, is treating Marcus, a 34-year-old man with a history of intermittent explosive disorder. During a session, Marcus states: 'I'm going to kill my supervisor, Daniel Chen, the next time he humiliates me in a meeting. I know where he parks his car.' Marcus has a prior arrest for aggravated assault, and Dr. Reyes assesses the threat as credible and imminent.

Key facts: specific, identifiable victim (Daniel Chen); credible, imminent threat of serious physical harm; jurisdiction is California (mandatory duty state).

Step 2 — Determine Applicable Legal StandardCalifornia follows the Tarasoff mandatory duty-to-protect standard, codified in California Civil Code § 43.92. Under this statute, a therapist has a duty to protect an identifiable victim from a patient's serious threat of physical violence. The statute specifies that the duty is discharged by making reasonable efforts to communicate the threat to the victim and to a law enforcement agency. Dr. Reyes is legally required—not merely permitted—to take protective action.

Applicable standard: California's mandatory duty to protect (Tarasoff II / Civil Code § 43.92).

Step 3 — Evaluate Confidentiality ExceptionsDr. Reyes must consider whether breaching confidentiality is legally justified. The duty-to-protect exception clearly applies here because: (a) Marcus has communicated a serious threat of physical violence, (b) the threat is directed at an identifiable individual, and (c) the threat appears imminent and credible based on Marcus's history and specificity. Confidentiality must yield to the duty to protect. Privilege would also not bar disclosure in this context because privilege applies to judicial proceedings, not to protective warnings.

Exception applies: Duty to protect overrides confidentiality. Privilege is not implicated (no judicial proceeding).

Step 4 — Select Appropriate Protective ActionsUnder California law, Dr. Reyes should: (1) make reasonable efforts to communicate the threat to Daniel Chen directly, (2) notify a law enforcement agency, and (3) consider additional clinical interventions such as increasing the frequency of sessions, adjusting medication (in consultation with a prescriber), or initiating voluntary or involuntary hospitalization if Marcus meets criteria. The therapist should also document all steps taken and the clinical reasoning behind each decision.

Actions: Warn Daniel Chen, notify law enforcement, consider hospitalization, document thoroughly.

Step 5 — Address Ongoing Therapeutic and Ethical ObligationsAfter taking protective action, Dr. Reyes has continuing obligations. She should inform Marcus that she has breached confidentiality and explain the legal and ethical basis for doing so, unless doing so would further endanger Daniel Chen or others. She should document the disclosure in Marcus's clinical record, continue to assess and manage risk, and consider whether the therapeutic relationship can continue effectively. If Marcus feels that trust has been broken, appropriate referral options should be explored. Dr. Reyes should also consult with a colleague or supervisor to ensure her actions were clinically and legally sound.

Post-disclosure duties: Inform client, document, continue risk management, consult, consider referral.

SECTION 7

Comparing Confidentiality, Privilege, and Duty to Protect

Comparison of the three core concepts in confidentiality law

Dimension	Confidentiality	Privilege	Duty to Protect
Legal source	Ethics codes, HIPAA, state licensing statutes	Evidence rules (federal & state), Jaffee v. Redmond	Tarasoff case law, state duty-to-protect statutes
Who holds it	Therapist's duty	Client's right	Society's interest (imposed on therapist)
Scope	All professional settings	Judicial/legal proceedings only	Applies when imminent danger exists
Who can waive	Client (via written authorization)	Client or their legal representative only	Not waivable—it is a legal obligation or authority
Consequence of violation	Licensing sanctions, malpractice liability, HIPAA penalties	Contempt of court (if wrongfully asserted), malpractice	Tort liability for harm to third party (in mandatory states)
Relationship to others	Broadest concept; contains privilege as a subset	A specific application of confidentiality in legal settings	An exception that overrides both confidentiality and privilege

✦ KEY TAKEAWAY

These three concepts form a hierarchy with a built-in override. Imagine a Russian nesting doll: the largest doll is confidentiality (it encompasses everything), the middle doll is privilege (a specialized form of confidentiality for the courtroom), and the smallest doll is the duty to protect—except that this smallest doll has a spring mechanism that, when triggered, pops open all the outer dolls. The EPPP tests whether you can identify which doll you are dealing with and whether the spring has been triggered.

SECTION 8

Connection to Advanced Legal and Ethical Issues

The foundational concepts of confidentiality, privilege, and duty to protect extend into several advanced areas that EPPP candidates should be aware of. These issues represent the evolving frontier of confidentiality law and are increasingly tested on the examination.

Foundational concepts and their advanced legal extensions

Foundational Concept	Advanced Extension	Key Consideration
Confidentiality in individual therapy	Confidentiality in group, couple, and family therapy	Privilege may not extend to statements made in the presence of third parties (e.g., other group members). Clinicians must clarify limits at the outset.
Duty to protect identifiable victims	Duty to protect unidentifiable victims	Some courts have expanded the duty beyond identifiable victims to foreseeable victims (e.g., Hedlund v. Superior Court extended duty to foreseeable bystanders).
HIPAA Privacy Rule	State privacy laws and preemption	HIPAA preempts state law only when the state law is less protective. When state law provides greater privacy protections, the state law controls.
Adult client privilege	Minor client confidentiality	Parents generally hold the privilege for minor children, but mature minor doctrines and state laws on adolescent consent to treatment can complicate parental access to records.
In-person therapy confidentiality	Telehealth and digital confidentiality	Telehealth introduces multi-state jurisdictional issues, electronic record security, and platform compliance with HIPAA. The therapist must determine which state's laws govern the session.

Looking forward, the intersection of technology and confidentiality law continues to generate new legal questions. The use of electronic health records, artificial intelligence in clinical decision-making, and social media all present novel challenges to traditional confidentiality frameworks. EPPP candidates should be prepared for questions that test their ability to apply foundational principles to these emerging contexts, recognizing that the core logic—protecting client trust while safeguarding public welfare—remains constant even as the specific applications evolve.

SECTION 9

Practice Problems

PROBLEM 1 — CONCEPTUAL

A psychologist receives a subpoena from an attorney requesting all treatment records for a current client. The client has not provided authorization for release. What is the psychologist's most appropriate first step?

PROBLEM 2 — BASIC APPLICATION

Dr. Patel is treating a 28-year-old woman in individual psychotherapy. During a session, the client discloses that she has been physically abusing her 4-year-old daughter. Dr. Patel practices in a state with mandatory child abuse reporting laws. Is Dr. Patel required to break confidentiality? Identify the applicable exception.

PROBLEM 3 — INTERMEDIATE

A psychologist in a permissive duty-to-protect state is treating a client who expresses homicidal ideation toward his ex-girlfriend but states he 'would never actually do anything.' The client has no history of violence and no access to weapons. The psychologist conducts a thorough risk assessment and determines the risk of violence is low. Must the psychologist break confidentiality? What factors should guide this decision?

PROBLEM 4 — APPLIED

Dr. Kim, a psychologist licensed in New York, provides telehealth services to a client physically located in Texas during sessions. During a session, the client reveals a plan to harm a specific co-worker. Dr. Kim is unsure which state's duty-to-protect law applies. How should Dr. Kim proceed, and what jurisdictional considerations are relevant?

PROBLEM 5 — CRITICAL THINKING

Consider a hypothetical case where a client in couples therapy discloses to the therapist, in an individual session, that he is HIV-positive and has not informed his wife, who is also a client in the couples treatment. The jurisdiction has a mandatory duty-to-protect statute, and the therapist is aware that the wife may be at risk of contracting a life-threatening illness. Analyze the competing legal and ethical obligations. What should the therapist do?

SUMMARY

Lesson Summary

This lesson examined the three pillars of privacy in mental health practice. Confidentiality is the broadest obligation, rooted in ethics codes, HIPAA, and state licensing statutes, requiring therapists to protect all information obtained in the professional relationship. Privilege is a narrower, client-held right that prevents compelled disclosure in judicial proceedings, as affirmed in Jaffee v. Redmond (1996). The duty to protect, originating from the Tarasoff decisions (1974, 1976), is the critical exception that overrides both confidentiality and privilege when a client poses an imminent, serious threat to an identifiable third party.

For the EPPP, remember these key distinctions: privilege belongs to the client, not the therapist; a subpoena alone does not override privilege (only a court order does); states vary in whether they impose a mandatory, permissive, or no statutory duty to protect; and HIPAA sets a federal floor for privacy protections, but more protective state laws supersede it. When in doubt on the EPPP and no jurisdiction is specified, apply the Tarasoff mandatory duty-to-protect standard as the default. Above all, clinicians must provide informed consent at the outset of treatment that clearly explains both the protections and the limits of confidentiality.