9.1 Confidentiality, HIPAA & Privileged Communication

Ethical Confidentiality vs. Legal Privileged Communication

Navigating client disclosures in art therapy requires distinguishing between ethical confidentiality and legal privileged communication. Although frequently conflated in everyday clinical discourse, they represent distinct legal and professional constructs with different origins, enforcement mechanisms, and jurisdictional scopes.

Ethical Confidentiality

Confidentiality is an ethical duty and professional standard established by professional bodies—such as the Art Therapy Credentials Board (ATCB) Code of Ethics, Conduct, and Disciplinary Procedures, the American Art Therapy Association (AATA) Ethical Principles, and allied mental health codes (e.g., ACA, APA, NASW). Confidentiality obligates the clinician to refrain from disclosing any information acquired during professional service—including verbal disclosures, visual artwork, preliminary sketches, titles, and diagnostic formulations—without explicit client consent or statutory mandate.

Ethical confidentiality applies universally across all clinical interactions, supervisory consultations, educational presentations, and professional communications. Breaching confidentiality without an established legal exception or informed consent exposes the clinician to disciplinary sanctions by the ATCB, revocation of credentials, state licensing board investigations, and civil malpractice liability.

Legal Privileged Communication

Privileged communication is a narrow, statutory rule of evidence established by legislative enactment or common law precedent. Privilege bars the forced disclosure of confidential communications in legal, judicial, legislative, or administrative proceedings (such as depositions, civil lawsuits, criminal trials, and grand jury hearings).

Key parameters governing privileged communication include:

• Statutory Creation: Unlike ethical confidentiality, which exists by virtue of the professional-client relationship, privilege exists only where specifically enacted by state or federal statute. While physician-patient and attorney-client privileges are ancient common law doctrines, psychotherapist-patient privilege varies widely across state jurisdictions regarding which professional credentials are recognized (e.g., LPAT, LPC, LCSW, LMFT, Licensed Psychologist).
• Holder of Privilege: The client is the sole legal holder of the privilege. The clinician does not own or hold privilege. Consequently, only the client—or their legally appointed guardian, conservator, or personal representative—has the legal authority to assert privilege (refusing to disclose) or waive privilege (authorizing disclosure).
• Therapist's Fiduciary Duty to Assert Privilege: When an art therapist is subpoenaed or ordered to testify regarding client communications or artwork, the clinician has an affirmative fiduciary and legal duty to assert privilege on behalf of the client, unless the client has provided an explicit, written, informed waiver or a judge has formally ruled that privilege does not apply.

---

Exceptions to Privileged Communication in Judicial Proceedings

Privilege is not absolute. State and federal statutes define specific legal circumstances where psychotherapist-client privilege is pierced or waived as a matter of law:

1. The Client-Litigant Exception: When a client introduces their emotional, psychological, or mental condition as an active claim or defense in a legal proceeding (e.g., suing a tortfeasor for emotional distress, claiming psychiatric disability, or asserting an insanity defense), privilege is waived regarding clinical records relevant to that condition.
2. Court-Ordered Psychological Evaluations: When an art therapy evaluation or mental health assessment is ordered directly by a court (e.g., competency to stand trial, court-ordered parental fitness evaluation), communications made during the evaluation are not privileged. The clinician must administer a comprehensive forensic informed consent prior to testing, clarifying that the results, diagnostic impressions, and artwork will be submitted directly to the court.
3. Child Custody and Welfare Proceedings: In disputed custody cases where parental fitness is contested, family court judges routinely pierce privilege if the psychological records of either parent are determined essential to serving the "best interests of the child."
4. Defense Against Malpractice or Ethics Complaints: If a client files a civil malpractice lawsuit, a formal licensing board complaint, or an ATCB ethical violation complaint against an art therapist, privilege is automatically waived to the extent necessary for the clinician to defend themselves against the allegations.
5. Involuntary Civil Commitment Proceedings: When a clinician initiates involuntary psychiatric hospitalization proceedings because a client presents an imminent danger to self or others or is gravely disabled, clinical observations and risk assessments are exempt from privilege.
6. Mandatory Reporting Statutes: State statutes mandating the reporting of suspected child abuse, elder abuse, dependent adult neglect, or duty-to-protect interventions supersede evidentiary privilege.

---

HIPAA Privacy and Security Rules in Art Therapy Practice

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), enforced by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), establishes national federal standards for the protection of individually identifiable health information. Any art therapist who qualifies as a Covered Entity—or works within a covered entity—must maintain strict compliance with both the Privacy Rule and the Security Rule.

                               HIPAA COMPLIANCE ARCHITECTURE
                                             │
                     ┌───────────────────────┴───────────────────────┐
                     ▼                                               ▼
             HIPAA PRIVACY RULE                              HIPAA SECURITY RULE
     (Standards for All PHI: Oral, Paper, Electronic)    (Safeguards for Electronic PHI / ePHI)
                     │                                               │
         ┌───────────┴───────────┐                       ┌───────────┼───────────┐
         ▼                       ▼                       ▼           ▼           ▼
  Designated Record       Psychotherapy Notes      Administrative   Physical   Technical
     Set (DRS)                 Exception             Safeguards   Safeguards  Safeguards
  (Client access right)   (Heightened privacy)      (Policies,     (Locks,    (AES-256,
  • Progress notes        • Subjective process        BAAs,       facility      MFA, audit
  • Clinical artwork      • Separated from DRS       training)    security)      logs)
  • Treatment plans       • No billing audits

Protected Health Information (PHI) and Client Artwork

Protected Health Information (PHI) encompasses any individually identifiable health information created, received, maintained, or transmitted by a covered entity that relates to the past, present, or future physical or mental health condition of an individual, the provision of healthcare, or payment for healthcare.

In art therapy, PHI extends significantly beyond traditional alphanumeric medical charts. It encompasses:

• Physical Client Artwork: Original drawings, paintings, sculptures, collages, and ceramic works created in treatment contain graphic expressions of psychological distress, unconscious material, and diagnostic data.
• Photographs and Digital Scans of Artwork: Digital image files, process photography documenting stages of creation, and 3D digital renderings are classified as electronic PHI (ePHI).
• Artwork Metadata: Titles assigned by clients, spontaneous artist statements, written verbal associations, dates of creation, and diagnostic clinical notations appended to artwork mounts or digital image headers.
• Signatures and Identifying Imagery: Clients frequently write signatures, monograms, personal dates, or identifiable cultural/familial iconography directly onto artwork surfaces, converting the visual piece into direct, identifying PHI.

The HIPAA Security Rule: Safeguarding Physical and Electronic Art

The Security Rule mandates three operational tiers of safeguards to ensure the confidentiality, integrity, and availability of ePHI:

1. Administrative Safeguards: Developing written clinical privacy policies, designating a compliance privacy officer, conducting annual risk assessments, executing Business Associate Agreements (BAAs) with all digital vendors (cloud storage providers, digital software platforms, billing processors), and delivering ongoing staff compliance training.
2. Physical Safeguards: Securing clinical studios with locked doors and restricted badge access; housing physical client art portfolios in locked flat files or fireproof storage cabinets; positioning computer screens away from waiting room observation; and ensuring proper physical chain-of-custody when artwork is transported.
3. Technical Safeguards: Requiring unique user logins, multi-factor authentication (MFA), role-based access controls, automatic session timeout, comprehensive audit logs, and end-to-end encryption (AES-256 standard) for all stored and transmitted digital photographs of client artwork.

---

The Psychotherapy Notes Exception (§ 164.501)

A critical distinction under the HIPAA Privacy Rule is the difference between the Designated Record Set (DRS) and Psychotherapy Notes.

Defining the Designated Record Set (DRS)

The Designated Record Set includes medical records, billing documentation, clinical assessments, treatment plans, progress notes, and diagnostic summaries used to make clinical decisions about an individual. Under HIPAA § 164.524, clients possess a legal right to inspect and obtain copies of all records contained within their DRS upon written request.

The Psychotherapy Notes Distinction

Psychotherapy notes are defined under 45 CFR § 164.501 as notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session, that are separated from the rest of the individual's medical record.

Psychotherapy notes receive heightened legal protection. They are not part of the Designated Record Set. Consequently:

• Clients do not have an automatic legal right to inspect or obtain copies of psychotherapy notes under HIPAA.
• Third-party insurance payers and managed care organizations cannot condition reimbursement, benefits, or claim authorization upon the disclosure of psychotherapy notes.
• Subpoenas requesting the "complete medical chart" do not automatically capture psychotherapy notes unless the notes are explicitly subpoenaed or the client executes a specific waiver.

Strict Boundaries: What Psychotherapy Notes CANNOT Contain

To maintain the legal exemption, psychotherapy notes must be kept physically or electronically segregated from the general chart and CANNOT include:

• Medication prescription, dosage, and monitoring records
• Session start and stop times
• Clinical treatment modalities, frequencies, and settings
• Formal diagnostic codes (DSM-5-TR / ICD-11)
• Functional status and prognosis
• Formal treatment plan goals and objectives
• Results of clinical tests and standardized assessments
• Progress toward therapeutic goals to date

For art therapists, subjective reflections, raw countertransference reactions, preliminary symbolic hypotheses, and personal processing of the client's creative process may be maintained in separated psychotherapy notes. However, formal objective documentation of media utilized (e.g., Media Dimension Scale placement), diagnostic observations (e.g., DDS or PPAT scoring), treatment progress, and behavioral response must remain in the designated record set.

---

Release of Information (ROI) and the Minimum Necessary Standard

Disclosing clinical information or client artwork to third parties (e.g., schools, primary care physicians, insurance providers, family members) requires an executed, legally valid Release of Information (ROI).

Mandatory Elements of a Valid ROI

Under HIPAA § 164.508 and ATCB ethical guidelines, a compliant authorization must contain:

1. Specific name and identifying details of the client
2. Specific name or entity authorized to release the records (the art therapist or clinical facility)
3. Specific name or organizational title of the designated recipient
4. Precise, detailed description of the information to be disclosed (e.g., "Treatment summary and photographs of artwork created between Jan 1, 2026, and June 1, 2026")
5. Specific clinical, legal, or administrative purpose of the disclosure
6. An explicit expiration date or terminating event (e.g., "Expires one year from signature" or "Expires upon discharge")
7. Clear statement of the client's right to revoke the authorization in writing at any time
8. Notice that information disclosed may be subject to redisclosure by the recipient and no longer protected by HIPAA
9. Signature of the client (or legal representative) and date of signing

The "Minimum Necessary" Disclosure Rule (§ 164.502(b))

Under the HIPAA Privacy Rule, covered entities must make reasonable efforts to limit the disclosure of PHI to the minimum necessary to achieve the intended clinical or administrative purpose.

Clinical Application: If a client's academic institution requests documentation confirming attendance for an excused medical absence, releasing full clinical progress notes, psychiatric history, and detailed photos of trauma artwork violates the minimum necessary rule. The art therapist must provide only an administrative letter verifying dates and times of attendance.

---

Comparative Matrix: Legal and Ethical Confidentiality Frameworks

---

Subpoenas vs. Court Orders: Responding to Legal Demands

One of the highest-stakes legal situations an art therapist faces is being served with formal legal papers demanding client clinical records, deposition testimony, or original artwork.

Differentiating Subpoena from Court Order

• Subpoena: An adversarial legal demand issued by an attorney or court clerk commanding a witness to appear for testimony (subpoena ad testificandum) or produce designated documents and physical records (subpoena duces tecum). A subpoena is NOT a court order. An attorney is an advocate for a party in litigation, not an impartial judicial officer.
• Court Order: A direct legal mandate issued and signed by a presiding judge following a motion, legal hearing, or in camera review. A court order represents the direct authority of the court and compels legal compliance.

Step-by-Step Response Protocol

When served with legal demands, art therapists must follow a disciplined, four-phase procedural protocol:

                               LEGAL PROCESS RESPONSE PROTOCOL
                                              │
                                     RECEIVE SUBPOENA
                                              │
                     ┌────────────────────────┴────────────────────────┐
                     ▼                                                 ▼
       ATTORNEY-ISSUED SUBPOENA                              JUDICIAL COURT ORDER
     (Signed by Lawyer or Clerk)                           (Signed by Presiding Judge)
                     │                                                 │
     1. Do NOT immediately release records                 1. Review scope of ordered items
     2. Immediately contact client / guardian              2. Request in camera review or
     3. Consult legal / liability counsel                     protective sealing if warranted
     4. Assert psychotherapist-patient privilege           3. Comply strictly with order to
     5. If client refuses waiver: counsel files               avoid contempt of court
        Motion to Quash Subpoena

1. Phase 1: Verification and Preliminary Restraint
   • Examine the document carefully to determine whether it is an attorney-issued subpoena or a judge-signed court order.
   • Never panic and never immediately deliver client files or artwork. Immediate disclosure upon receipt of an attorney subpoena violates HIPAA and ethical confidentiality.
   • Confirm whether a valid, signed HIPAA-compliant Release of Information accompanied the subpoena.
2. Phase 2: Client Consultation and Privilege Assertion
   • Contact the client (or their legal attorney) immediately to inform them that a subpoena has been served.
   • Inquire whether the client wishes to waive privilege or assert privilege. If the client refuses to authorize release, the art therapist has a legal and ethical duty to formally assert psychotherapist-patient privilege in writing to the issuing attorney.
3. Phase 3: Legal Consultation and Protective Motions
   • Notify your professional malpractice insurance carrier and consult with specialized healthcare legal counsel.
   • If the issuing attorney refuses to withdraw the subpoena following assertion of privilege, the art therapist's legal counsel must file a Motion to Quash the Subpoena or a Motion for a Protective Order in the presiding court.
4. Phase 4: Complying with a Direct Court Order
   • If a judge denies the Motion to Quash and issues a direct, signed Court Order compelling production, the therapist must comply to avoid criminal contempt of court.
   • Even upon receiving a judge's direct order, the art therapist may petition the judge to conduct an in camera inspection (reviewing records privately in judicial chambers) to exclude irrelevant or deeply sensitive artistic imagery from open public court records, or request that records be placed under a protective seal.