Source: http://www.centerforethicalpractice.org/lawsaffectingconfidentiality
Timestamp: 2019-04-23 17:59:09+00:00

Document:
A Practice Model for Mental Health Professionals.
as an official “Online Appendix” on this website.
specific types of laws that can affect confidentiality.
This is not a substitute for learning the legal details that apply in your own state.
When the discussion mentions a “Chapter,” this refers to a chapter in the published book. When a “Step” is mentioned, this refers to a specific section of the Ethical Practice Model that was the basis for the book. This website also contains an annotated version of that Model to indicate how state laws and federal HIPAA regulations can be integrated into the ethical requirements.
As defined here, these laws impose a duty not to disclose, and/or they apply a penalty for disclosing without the patient’s consent. Sometimes these confidentiality or non-disclosure provisions can be hard to find, because they may consist of a single clause in a very long law. They may also be widely scattered within the state or federal legal codes, since they can appear in general statutes, in laws governing specific mental health professions, in licensing board regulations, and in state agency regulations. Finally, the relevant laws in this category include legal mandates to maintain confidentiality, laws that protect confidentiality only in certain circumstances, and laws and regulations that impose legal penalties for disclosing information without the patient’s consent.
This category would also include legal requirements about protecting patient confidentiality through insuring the security of records during storage, retention, or destruction.
A. Medical records . . . may be stored by computerized or other electronic process or microfilm, or other photographic, mechanical, or chemical process; however, the stored record shall identify the location of any documents or information that could not be so technologically stored. If the technological storage process creates an unalterable record, the nursing facility, hospital or other licensed health care provider shall not be required to maintain paper copies of medical records that have been stored by computerized or other electronic process, microfilm, or other photographic, mechanical, or chemical process. Upon completing such technological storage, paper copies of medical records may be destroyed in a manner that preserves the patient’s confidentiality. However, any documents or information that could not be so technologically stored shall be preserved.
Wisconsin: § 134.97 Disposal of records containing personal information.
Finally, also in this category are laws that impose legal penalties for failing to protect confidentiality. These can be in the form of statutes (as in the Florida statutory examples below) or in regulations (as in the Florida Board regulations in the next section).
(b) Regulations: State non-disclosure regulations ordinarily apply only to specific providers, or in specific settings. For example, licensing board regulations apply only to licensees of a specific board (see first Ohio example, below); and state agency regulations apply only to providers in specific state agencies or institutions (see second Ohio example, below).
Case Law: State Supreme Court decisions apply only in the state in which they were decided, although they sometimes have an impact elsewhere by being cited as examples in other states’ cases. Examples of state cases that created or expanded confidentiality protections within a specific state include those such as the Virginia case summarized in the box below.
This decision awarded $100,000 to a patient whose hospital records were released without her consent in the context of a court case. The basis of that decision was that no judge had determined that these records were admissible as evidence in the case.
By far the most prominent federal regulations affecting confidentiality and privacy are the HIPPA regulations . Created under the Health Insurance Privacy & Portability Act, they apply not only to mental health care providers, but to providers of all health care services who electronically transmit identifiable patient information. These regulations are discussed briefly in Part I of this book; their provisions are summarized in more detail in Appendix VIII; and links to their text and interpretations are available on the website of the Center for Ethical Practice (2010). These regulations are extensive, which is why therapists and/or their staff often obtain specialized HIPPA training.
Other federal regulations affecting confidentiality include those which apply only in educational settings. These include FERPA and IDEA, both of which protect the confidentiality of student information, including mental health information.
Ohio § 2317.02 B)(1)(e)(iii). Privileged communications.
Sometimes a privilege statute explicitly gives a therapist the legal right to claim the privilege in the patient’s behalf. (See Florida privileged communications statute below.) Although this right is not explicitly granted in most states, judges do often allow therapists to act in a patient’s behalf to contest an attorney’s subpoena or to file a motion asking the judge to quash it, especially if the patient does not want the information disclosed but has no attorney, or if the patient’s attorney does not file a motion to quash.
Florida § 90.503 Psychotherapist-Patient Privilege – Therapist May Claim.
“(2) A patient has a privilege to refuse to disclose, and to prevent any other person from disclosing, confidential communications or records made for the purpose of diagnosis or treatment of the patient’s mental or emotional condition, including alcoholism and other drug addiction, between the patient and the psychotherapist, or persons who are participating in the diagnosis or treatment under the direction of the psychotherapist. This privilege includes any diagnosis made, and advice given, by the psychotherapist in the course of that relationship.
“(3)The privilege may be claimed by . . . ?(d) The psychotherapist, but only on behalf of the patient. The authority of a psychotherapist to claim the privilege is presumed in the absence of evidence to the contrary.”?
Patients who receive substance abuse treatment in federally funded facilities are given special protection from having their records routinely available as evidence in a court case. These additional protections arise both by federal statute ( 42 U.S.C. § 290dd-2 ) and by federal regulation ( 42 C.F.R. Part 2)..
or Allow Others to Re-Disclose Information They Have Received from Therapists.
During the Initial Informed Consent Interview.
These laws arise at the state level and vary a great deal, not only state by state, but by profession and by setting within each state. The boxes below contain examples of these types of laws, but therapists are responsible for knowing the confidentiality limitations that apply in their own state and setting.
All states have laws and/or regulations mandating the reporting of suspected child abuse or neglect; and most states also mandate the reporting of suspected abuse or neglect of elderly and/or vulnerable and/or incapacitated adults. These laws can be found in the state civil code or criminal code, or both (see Utah example, below). All such laws include mental health care providers in the list of mandated reporters and include definitions of the persons/conditions which must be reported. The wording of the reporting mandate varies; however, therapists are never required to investigate first, but instead are required to report if they have “reason to suspect” or “reasonable cause to suspect” the abuse/neglect.
Reporting statutes often impose penalties for failure to report (see Kansas and Utah, below). Some indicate that reporting must be done “promptly” or “immediately” (see Kansas, below); others impose a specific time frame within which the report must be made; and some require both an oral report and a written report (see Massachusetts, below). In some states, reporting of child abuse is not legally required if the information on which the report is based is privileged (see Oregon, below).
Oregon – § 419B.010 Child Abuse Report Not Required if Communication Is Privileged.
Many states also have laws requiring therapists to report misconduct by other providers. Sometimes such reports are required about any health care provider (see Florida, below); sometimes reports are legally required only about another mental health care provider; and sometimes reports are legally required only about someone licensed by the reporting therapist’s own board (see Indiana and Louisiana, below). Some states provide penalties for failure to report (see Louisiana, below). Most states require reports even if it requires breaching confidentiality; but others require a report only with the client’s written permission (see Indiana, below).
“A. The board shall have the power to deny, revoke, or suspend any license, certificate, or registration issued by the board or applied for in accordance with this Chapter, or otherwise discipline a social worker for: . . .(8) Failure to report to the board knowledge of a violation or infraction of the social work practice act, rules and regulations promulgated by the board or ethical standards, or both.
State case law ordinarily applies only in the state in which the case was decided, but the California Tarasoff case created major ripples across the country – subsequently all states enacted laws requiring therapists to initiate action if their patients threaten direct harm to another person. Unlike a true “duty to warn” requirement, most states impose a “duty to protect” — which can often be accomplished in ways other than by a breach of confidentiality to warn the intended victim. As noted in Part II, Step 1, however, research indicates that up to 75% of psychologists are misinformed about what the laws of their state require, with 90% of those nevertheless being confident that they are right — which can create unnecessary disclosures, placing patients at risk.
Most states legally impose a “duty to protect” requirement only if the patient poses a threat to others; but a very few states legally impose on therapists a duty to protect a patient from harm to self. (See examples below quoted from statutes in Nebraska and New Jersey.) As described in a later section of this Appendix, however, many states explicitly allow disclosure in circumstances of danger to self, but do not require such disclosure.
Nebraska: § 38-2137 “The duty to warn of or to take reasonable precautions to provide protection from violent behavior shall arise only under the limited circumstances specified in subsection (1) of this section” [i.e., “when the patient has communicated to the mental health practitioner a serious threat of physical violence against himself, herself, or a reasonably identifiable victim or victims.” . . .”The duty shall be discharged by the mental health practitioner if reasonable efforts are made to communicate the threat to the victim or victims and to a law enforcement agency.” [emphasis added]New Jersey: § 2A:62A-16 – Duty to Warn and Protect “b. A duty to warn and protect is incurred when the following conditions exist: (1) The patient has communicated to that practitioner a threat of imminent, serious physical violence against a readily identifiable individual or against himself and the circumstances are such that a reasonable professional in the practitioner’s area of expertise would believe the patient intended to carry out the threat; or (2) The circumstances are such that a reasonable professional in the practitioner’s area of expertise would believe the patient intended to carry out an act of imminent, serious physical violence against a readily identifiable individual or against himself.
Laws of this type take many forms, and they can be difficult to discover within the state code. The first Virginia statute below reflects the presence of “threat assessment teams” at state colleges and universities; these were created following recent episodes of campus violence in that state and elsewhere. This statute gives the threat assessment team legal access to certain mental health records, but it does not authorize re-disclosure of that information.
A. Services in each local court-appointed special advocate program shall be provided by volunteer court-appointed special advocates, hereinafter referred to as advocates. The advocate’s duties shall include: (1.) Investigating the case to which he is assigned to provide independent factual information to the court. (2.) Submitting to the court of a written report of his investigation . . . B. . . . The advocate may testify if called as a witness. . .
Sometimes these exceptions to privilege are listed within the privilege statute itself; sometimes they appear as a separate free-standing statute or within the Rules of Evidence.
Certain exceptions to privilege exist in almost every state: Communications between therapist and patient are usually not privileged if (1) the patient brings his/her own mental health into issue in the court case (see Florida, below); (2) the case involves child (or sometimes elder adult) abuse or neglect (see Ohio, below); (3) the court case involves an involuntary commitment proceeding (see Maryland, below); or if the testimony is pursuant to a court-ordered psychological evaluation or examination of the patient (see California, below).
Many states, however, have additional exceptions to privilege. Examples of these can include cases where the patient brings a complaint against the therapist or threatens to commit a crime or harmful act (see Oregon, below); or when the patient brings a personal injury claim (see Louisiana, below).
The broadest and least predictable exception to privilege is the “judicial discretion” exception, which applies only in Virginia and North Carolina (see Virginia example, below). It is broad because any judge may determine that any communication between a patient and his/her therapist is admissible as evidence. It is unpredictable because there is no way for patient or therapist to know in advance what determination a judge will make in any particular case, so attorneys are more likely to issue subpoenas in attempts to obtain that evidence, leaving patients and their therapists needing to try to quash them, case by case.
510 (Rules of Evidence). “(B)(2) Exceptions. There is no privilege under this Article in a noncriminal proceeding as to a communication: (a) When the communication relates to the health condition of a patient who brings or asserts a personal injury claim in a judicial or worker’s compensation proceeding.
§ 9.109 . . . “(d) There is no privilege if (1) A disclosure is necessary for the purposes of placing the patient in a facility for mental illness.
Client privilege does not apply if client initiates legal action or makes a complaint against the licensed professional, or if client communicates clear intent to commit a crime or harmful act.
These laws allow (but do not require) therapists to disclose information without patient consent.
they do not legally require therapists to disclose anything.
if they intend to voluntarily disclose in such circumstances.
The relevant state laws vary. Examples below are of laws that create legally-permitted exceptions to confidentiality, thereby permitting disclosure. They may be found among the listed exceptions to confidentiality within a non-disclosure law (such as in the first Florida statute below) or they may be in the form of a stand-alone statute (as in the second Florida statute below).
Just as most professional Ethics Codes require therapists to inform prospective patients about the limits of confidentiality, most states include this among the legal requirements. This usually appears within the state licensing board regulations, sometimes within the confidentiality section (See Maryland, below). Sometimes they are combined with other informed consent requirements within the board’s practice standards or code of conduct (see Virginia, below). Some states impose special requirements in particular cases or circumstances. For example, see below the Missouri informed consent regulations regarding third party referrals; the Ohio informed consent regulations in cases involving multiple parties (e.g., couple or family therapy; non-patient collateral participants); and the Montana regulation regarding the taping, recording, or observation of patients.
“(6) When a counselor, social worker, or marriage and family therapist provides services to two or more clients who have a relationship with each other and who are aware of each other’s participation in treatment (for example couples, family members), a counselor, social worker, or marriage and family therapist shall clarify with all parties the nature of the licensee’s professional obligations to the various clients receiving services, including limits of confidentiality. A counselor, social worker, or marriage and family therapist who anticipates a conflict of interest among the clients receiving services or anticipates having to perform in potentially conflicting roles (for example a licensee who is asked or ordered to testify in a child custody dispute or divorce proceeding involving clients) shall clarify their role with the parties involved and take appropriate action to minimize any conflict of interest.
Laws and regulations can contain provisions about the responsibilities of mental health professionals in ensuring that their staff and employees understand how to protect patient confidentiality. While this does not explicitly impose a legal requirement to train staff in a particular way, it does imply that each therapist must be sure that all staff members–clinical and non-clinical– understand the ethical and legal confidentiality requirements that apply to his/her profession.
Most of the relevant state requirements about staff training are in licensing board regulations rather than general statutes. (See examples below).

References: § 134
 § 2317
 § 90
 § 290
 § 419
 § 38
 § 2

§ 9