8.3 Informed Consent, Confidentiality, Privacy, and Records

Protect Choice and Information

Informed consent (APA Standards 3.10 and 10.01) tells the client what service is offered, by whom, the foreseeable risks and benefits, alternatives, fees, record-keeping, and the limits of confidentiality — all before services begin. On the EPPP, consent is rarely just an intake form; it is an ongoing process revisited when the modality, role, risk level, third-party involvement, or fee structure changes (e.g., moving from individual to group, or in-person to telehealth).

Three terms the exam separates carefully:

• Confidentiality — the ethical duty to protect information learned in the relationship.
• Privacy — the broader right of a person to control access to their information.
• Privilege — a legal protection of communications in court proceedings; it is generally held by the client, and the psychologist asserts it on the client's behalf unless an exception applies or the client waives it.

Limits of Confidentiality and the Duty to Protect

Confidentiality is not absolute. Standard 4.05 (Disclosures) permits release with client consent or where mandated/permitted by law — for valid services, consultation, protection of the client or others, or to obtain payment, limited to the minimum necessary. Heavily tested statutory limits include mandated child/elder abuse reporting and the duty to protect stemming from *Tarasoff v.

Regents (1976)*: when a client makes a serious threat of violence against a reasonably identifiable victim, the psychologist may have a duty to take reasonable protective steps (which can include warning, notifying police, or initiating hospitalization), depending on the jurisdiction's statute.

A classic trap distinguishes a subpoena (a request, often from an attorney) from a court order signed by a judge. A subpoena alone does not automatically authorize disclosure of privileged records — the psychologist typically asserts privilege and consults counsel; a valid court order can compel release.

Records

Good records (Standard 6.01) include relevant assessment data, consent, formulation/diagnosis, treatment plan, progress, risk assessments, consultations, releases, missed appointments, fees, and termination/referral information. They should be accurate, timely, and intelligible to another qualified professional while avoiding speculation and stigmatizing language. Standard 6.02 requires confidential maintenance and lawful disposal; HIPAA governs many access and amendment rights.

For EPPP items, prefer answers that verify the request, check consent or law, consult when unclear, disclose narrowly, and document. Releasing the entire file automatically is too broad; refusing every lawful request forever ignores legal authority.

Minors, Couples, and Group Confidentiality

Confidentiality gets complex when there is more than one party. With minors, the parent or guardian usually holds the legal right to consent and access records, but the EPPP expects the psychologist to discuss assent with the child, clarify at the outset what will and will not be shared with parents, and protect the therapeutic relationship. In couples and family therapy, the psychologist should clarify early who the client is and how information shared individually will be handled (a 'no-secrets' versus 'limited-secrets' policy), because an undisclosed policy can later force an ethical bind.

In group therapy, the psychologist can guarantee their own confidentiality but cannot guarantee that group members will keep what they hear private. Consent must state this clearly. The exam trap is an answer implying the leader can promise total group confidentiality.

HIPAA and Mandated Reporting

Under HIPAA, psychotherapy notes (the clinician's private process notes kept separate from the record) receive heightened protection and generally require specific authorization to release, beyond the standard for the rest of the record. Mandated reporting of suspected child abuse or neglect and, in most states, elder or dependent-adult abuse, is a legal duty that overrides confidentiality; reports are made in good faith to the designated agency. The duty is to report reasonable suspicion — the psychologist does not need to confirm the abuse first.

A frequent EPPP error is the answer that waits to 'gather more proof' before reporting, or that asks the client's permission before making a legally mandated report. The protective action and, when safe, an honest explanation to the client both have a place — but the legal duty is not subject to client veto.