5.3 Confidentiality, HIPAA, and Duty to Protect

Confidentiality, Privacy, and Evidentiary Privilege

Confidentiality is the ethical core of the psychiatric relationship. PMHNPs must understand the distinctions among three key legal concepts:

• Privacy: An individual's constitutional right to control the disclosure of personal information and physical integrity.
• Confidentiality: The ethical and legal duty of healthcare providers to prevent unauthorized disclosure of patient information.
• Privilege (Evidentiary Privilege): A legal rule of evidence that protects communications between a patient and psychotherapist from compelled disclosure in court proceedings. Established at the federal level in Jaffee v. Redmond (1996) under Federal Rule of Evidence 501, privilege belongs to the patient, who alone has authority to waive it.

HIPAA Privacy and Security Rules

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 defines national standards for protecting Protected Health Information (PHI). The Privacy Rule allows PHI disclosure without explicit authorization for Treatment, Payment, and Healthcare Operations (TPO):

• Treatment: Consulting with other healthcare providers involved in the patient's care.
• Payment: Submitting diagnostic billing codes to insurance carriers for reimbursement.
• Operations: Internal quality reviews, clinical audits, and accreditation activities.

The Minimum Necessary Standard mandates that clinicians disclose only the minimum amount of PHI required to achieve the intended clinical or administrative purpose. The Security Rule outlines administrative, physical, and technical safeguards for electronic PHI (ePHI), including mandatory 256-bit data encryption, role-based user authentication, audit logs, and automatic log-off.

Psychotherapy Notes: Heightened Protections

Psychotherapy Notes are defined by HIPAA as notes recorded by a mental health professional documenting private or group therapy sessions that are maintained separately from the rest of the medical record. Psychotherapy notes receive heightened protection:

• They CANNOT be disclosed under standard TPO authorizations.
• Disclosure requires a specific, standalone written authorization signed by the patient.
• Exceptions where disclosure is permitted without patient authorization are narrow: defense in a malpractice suit filed by the patient, HHS compliance investigations, or preventing imminent serious threats to health and safety.

General progress notes (medication management notes, mental status exams, lab results, diagnoses) are part of the general medical record and are NOT psychotherapy notes.

42 CFR Part 2: Substance Use Disorder Confidentiality

For programs providing substance use disorder (SUD) diagnosis, treatment, or referral, federal law 42 CFR Part 2 applies. It imposes protections stricter than HIPAA:

Under 42 CFR Part 2, a standard court subpoena signed by an attorney cannot compel disclosure of SUD records. Disclosure requires explicit patient consent or a specialized court order signed by a judge after finding "good cause" where public interest outweighs injury to the patient.

Exceptions to Confidentiality

Tarasoff: Duty to Warn and Duty to Protect

The landmark California Supreme Court rulings in Tarasoff v. Regents of the University of California redefined psychiatric duty to third parties:

• Tarasoff I (1974): Established the Duty to Warn—when a clinician determines that a patient presents a serious danger of violence to an identified victim, the clinician must warn the victim.
• Tarasoff II (1976): Expanded to the Duty to Protect—the clinician must exercise reasonable care to protect the intended victim, which may include warning the victim, notifying law enforcement, or hospitalizing the patient.

Mandatory criteria to trigger a Tarasoff duty:

1. An explicit, credible threat of severe physical violence or homicide.
2. Uttered by a patient currently under the clinician's care.
3. Targeted at a specific, identifiable victim or reasonably identifiable group.

Vague, generalized expressions of anger ("I hate society") do not trigger Tarasoff obligations, though they require suicide and homicide risk assessment. State laws vary: some states mandate Tarasoff duty, others permit disclosure, and a minority do not recognize the duty.

Mandatory Abuse Reporting

PMHNPs are legally mandated reporters for vulnerable populations. Standard: Reasonable suspicion—proof or absolute certainty is NOT required:

• Child Abuse (CAPTA): Mandatory reporting of physical, sexual, or emotional abuse or neglect of minors (<18) to Child Protective Services (CPS) or law enforcement within 24 to 72 hours.
• Elder & Dependent Adult Abuse: Mandatory reporting of physical, emotional, or financial abuse or neglect involving adults aged 60–65+ or dependent adults to Adult Protective Services (APS).
• Statutory Immunity: Reporters acting in good faith receive civil and criminal immunity from liability.

Subpoenas vs. Judicial Court Orders

A subpoena signed by an attorney does NOT authorize the release of psychiatric records without patient consent. The PMHNP must assert privilege, notify the patient, and seek to quash the subpoena. A court order signed by a judge legally compels compliance, requiring disclosure limited to the minimum necessary scope specified by the court.