Confidentiality and its limits

Transcript

RyanIt's a Monday morning. The phone rings in a small group practice. It's the HR manager at a client's company, and she sounds friendly and a little worried. She says, I just need to know two things. Is he seeing you, and is he ready to come back to work?

SoheeAnd the psychologist has to decide, in about three seconds, what to say.

RyanWelcome to EPPP Prep, the podcast. I'm Ryan.

SoheeI'm Sohee. Today we're going deep on confidentiality: what stays private, the handful of times it doesn't, and how the exam likes to test it.

RyanAnd we'll come back to that phone call, I promise. But first, the foundation. The Ethics Code starts this whole section with Standard 4.01. It says psychologists have a primary obligation to protect confidential information, obtained through or stored in any medium.

SoheeAny medium. So paper charts, emails, texts, the notes app on your phone, video sessions. It all counts.

RyanAll of it. And the same standard recognizes that the limits of confidentiality may be set by law, or by institutional rules. So confidentiality is strong, but it isn't absolute.

SoheeWhich is exactly why the next standard matters so much. 4.02. Discussing the limits of confidentiality.

RyanPsychologists discuss the relevant limits of confidentiality, and the foreseeable uses of the information. And here's the timing piece people miss. Unless it isn't feasible, or it's contraindicated, that conversation happens at the outset of the relationship, and again as new circumstances warrant.

SoheeSo not, wait until something reportable comes up and then explain.

RyanRight. Think about why. If a client learns the rules only after they've said something, the trust is already damaged. The Code puts the conversation at the start, so the client decides what to share knowing the rules.

SoheeThat's a really common wrong answer, by the way. Choices like, discuss confidentiality once rapport is established, or, when the client asks. The Code says the outset.

RyanOkay. Back to Monday morning. The HR manager on the phone.

SoheeNo release is signed. No law requires anything here. There's no safety concern.

RyanThen the answer is: the psychologist shares nothing. Standard 4.05 has two parts. Part a: psychologists may disclose with the appropriate consent of the client, or of another legally authorized person. Part b: without consent, they disclose only as mandated by law, or where permitted by law for a valid purpose.

SoheeAnd the Code gives examples of those valid purposes, right?

RyanFour of them. To provide needed professional services. To obtain appropriate professional consultations. To protect the client, the psychologist, or others from harm. Or to obtain payment for services. And for payment, the disclosure is limited to the minimum that is necessary.

SoheeSo the HR manager's reason, even a kind, sincere reason, isn't on that list. She's not the client, she has no consent, and no law is involved.

RyanAnd the exam will dress this up. The caller is a spouse. Or a parent of an adult client. Or they promise to keep it secret. None of that replaces consent or a legal basis.

SoheeLet me add one that trips people up. Consultation. Psychologists consult with colleagues all the time. Is that a breach?

RyanNot if it's done the way Standard 4.06 describes. When consulting, psychologists don't disclose information that could reasonably identify the client, unless they have consent or it can't be avoided. And they share only what's needed for the purpose of the consultation.

SoheeAnd reports work the same way, under 4.04. Only information germane to the purpose of the report.

RyanOkay, pause and think. You're writing a report for a school about a child's learning needs. The parent mentioned a past marital conflict. Does that go in the report?

SoheeOnly if it's germane to the purpose, which here is the learning needs. If it isn't relevant to that purpose, it stays out.

RyanNow the big one. The case every psychology student hears about. Tarasoff.

SoheeTarasoff versus Regents of the University of California. California Supreme Court, 1976.

RyanAnd the line everyone quotes: The protective privilege ends where the public peril begins.

SoheeLet's be precise about what it requires, because the exam is precise. When a therapist judges that a client seriously endangers an identifiable person, the therapist must use reasonable care to protect that person.

RyanAnd reasonable care can mean warning the intended victim, or notifying the police. What it doesn't mean is just writing it in the chart, or just scheduling more sessions.

SoheeHere are the traps. One: the duty only applies if the client has been violent before. Wrong, no prior attempt is needed. Two: confidentiality is absolute, so do nothing without written consent. Also wrong. Confidentiality gives way when disclosure is essential to avert danger.

RyanAnd notice the identifiable person piece. The threat is serious, and it's aimed at someone you can identify. A named coworker. An ex-partner. A specific neighbor.

SoheeNow, a question I get a lot. Doesn't all this depend on what state you're in?

RyanIt does in real practice. States have since written their own duty-to-protect laws, and they differ. That's exactly why exam questions on this name the case, or the court and the year. They're asking about the 1976 Tarasoff ruling itself, not your state's statute.

SoheeSo when you see the word Tarasoff in a question, answer with Tarasoff's rule.

RyanLet's move to records, because HIPAA has its own vocabulary. What exactly are psychotherapy notes?

SoheeThe federal definition is very specific. They're notes recorded by a mental health professional, documenting or analyzing the contents of conversation during a counseling session, and kept separate from the rest of the medical record.

RyanAnd here's the deep part, the part that turns hard questions into easy ones. The same definition lists what psychotherapy notes are not.

SoheeMedication prescription and monitoring. Session start and stop times. The kinds and frequency of treatment. Results of clinical tests. And any summary of diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

RyanSo if a question says the psychologist's notes summarize the diagnosis and progress, those aren't psychotherapy notes. They're part of the regular record.

SoheeOkay, so why does the label matter so much?

RyanBecause psychotherapy notes get extra protection. Using or releasing them requires the client's authorization, even for treatment or payment, with narrow exceptions like the note-taker's own use in treatment.

SoheeSo an insurer asks for those separately kept notes to approve more sessions. The psychologist needs the client's authorization, specifically for the psychotherapy notes.

RyanAnd a general records release won't do it. An authorization for psychotherapy notes can only be combined with another authorization for psychotherapy notes.

SoheeNow flip it. The client is the one asking.

RyanUnder HIPAA's right of access, clients can see and get a copy of their information in what's called the designated record set. Think medical records and billing records.

SoheeBut the separately kept psychotherapy notes are excepted from that right of access.

RyanAnd there's a deadline. The practice must act on the request no later than 30 days after receiving it. It may extend once, by no more than 30 more days, and only with a written statement of the reasons.

SoheeSo if an answer choice says 90 days, you can cross it out.

RyanPause and think, last one. A client in a HIPAA-covered practice asks for her records. The psychologist keeps separate notes analyzing their sessions. What does she get, and how fast?

SoheeShe gets her designated record set, like her medical and billing records, within 30 days. The separately kept psychotherapy notes aren't required.

RyanLet's pull it together. Confidentiality covers information in any medium. Talk about its limits at the start, and again when things change.

SoheeWithout consent, share only what the law mandates or permits for a valid purpose. A good reason from the caller isn't enough.

RyanConsult and write reports with only what's necessary for the purpose.

SoheeTarasoff: a serious danger to an identifiable person means reasonable care to protect them. No prior violence required, and documenting alone isn't enough.

RyanAnd HIPAA: psychotherapy notes need their own authorization, they're excluded from the right of access, and summaries of diagnosis and progress don't count as psychotherapy notes. Record requests get action within 30 days.

SoheeIf you've ever felt shaky on this topic, you're not alone. It's detailed. But you just walked through every major rule, and the reasons behind them.

RyanTry a few practice questions on confidentiality while it's fresh. I think you'll surprise yourself. Thanks for listening to EPPP Prep.

Loading the read-along timings…