3.2 Counselor-Client Privilege, Confidentiality, and HIPAA Compliance

Counselor-Client Privilege, Confidentiality, and HIPAA Compliance

Confidentiality is the cornerstone of the therapeutic relationship, protecting client privacy and fostering the trust necessary for effective clinical intervention. In Oklahoma, confidentiality is governed by a combination of state statutes, administrative codes, and federal regulations. Licensed Professional Counselors (LPCs) must navigate these overlapping standards to ensure compliance with the law.

1. Statutory Basis of Counselor-Client Privilege

The primary legal foundation for confidentiality in Oklahoma is Title 59 O.S. § 1910, which establishes the statutory counselor-client privilege. Under this statute, communications between a Licensed Professional Counselor and their client are deemed confidential and privileged on the same basis as attorney-client privilege.

The privilege belongs to the client, not the counselor. This means the client holds the authority to waive the privilege and consent to disclosure. An LPC cannot disclose confidential information obtained during counseling without the client's explicit, written consent, unless a specific legal exception applies. This duty persists even after the therapeutic relationship has terminated and after the death of the client.

2. HIPAA Compliance and State Preemption

LPCs who transmit health information electronically are considered "covered entities" under the federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Parts 160 and 164). HIPAA establishes national standards for the protection of Protected Health Information (PHI).

Under the preemption principle, where federal HIPAA rules and state laws conflict, the standard that is more protective of client privacy applies. If Oklahoma law is stricter than HIPAA, then Oklahoma law preempts HIPAA. Under HIPAA, counselors must distinguish between general PHI and Psychotherapy Notes. Psychotherapy notes are defined as notes recorded by a professional documenting session conversations, kept separate from the rest of the record. HIPAA provides psychotherapy notes with an elevated level of protection, requiring a separate, specific written authorization for release.

3. Couples, Family, and Group Counseling Records

A unique and highly tested area of Oklahoma regulation involves record access in multi-client settings, such as marriage, couples, family, or group therapy.

Under OAC 86:10-3-3(b)(4), in situations where counseling services are rendered to more than one client simultaneously (e.g., couples or family counseling), the LPC must limit the disclosure of records to information about the requesting individual. The rule explicitly prohibits the counselor from disclosing any parts of the record containing confidential information about other participants in the couples/family session without their written, signed consent (waiver). This restriction is essential in divorce or child custody disputes. If one spouse requests the records of a couples counseling session to use as evidence in court, the LPC must not release the joint records unless both spouses sign a Release of Information. If one spouse refuses to sign, the counselor must redact all information relating to the non-consenting spouse before releasing the requesting spouse's information, or refuse to release the joint record entirely in the absence of a direct court order signed by a judge.

4. Minors' Confidentiality and Parent Access

The confidentiality rights of minors in Oklahoma require careful clinical and legal balancing. Generally, under Oklahoma law, parents or legal guardians are the legal representatives of their minor children and have the right to access the minor's clinical records.

However, there are important statutory exceptions to this rule. Minors in Oklahoma may seek treatment for substance abuse, chemical dependency, or sexually transmitted infections without parental consent, and in these specific cases, the minor holds the privilege, and parental access is restricted. Furthermore, if an LPC determines that releasing the clinical records to a parent or legal guardian would result in clear and substantial harm to the child’s physical or mental health, the counselor may restrict parental access to the records, documenting the clinical justification for the restriction in the client file.

5. Release of Information Requirements

To legally disclose confidential client information, an LPC must obtain a valid, written Release of Information (ROI). Under OAC 86:10-3-3, a legally compliant ROI must be signed and dated by the client (or their legal representative) and must contain the following components:

1. Identifiable Client Information: The name and date of birth of the client.
2. Specific Scope of Disclosure: A precise description of the information to be released (e.g., "assessment and treatment plan only" vs. "complete billing and progress notes").
3. Specific Purpose: The reason for the disclosure (e.g., "coordination of care" or "legal representation").
4. Authorized Recipient: The name and organization of the individual or entity authorized to receive the information.
5. Revocation Clause: A statement informing the client of their right to revoke the release in writing at any time.
6. Expiration Date: A specific date or event upon which the release automatically expires, typically not to exceed one (1) year.

Overview of Confidentiality Frameworks