Confidentiality and Its Exceptions

• The default is absolute: information is not shared with family, employers or other clinicians not involved in care without the patient's permission. Discussing patients in elevators, corridors or on social media is a breach.
• Exceptions where disclosure is permitted or required:
• Serious, identifiable threat to a third party — the Tarasoff duty to warn and protect.
• Reportable communicable diseases to public health authorities.
• Suspected child or elder abuse, and abuse of dependent adults — reporting is mandatory and requires only reasonable suspicion, not proof.
• Patients who pose a driving or public safety risk, in accordance with state law.
• Gunshot and certain other injuries, where mandated.
• Court order or subpoena — a valid legal compulsion, distinct from a lawyer's request.
• Risk of harm to self, permitting intervention.
• Minors are a special case: many states permit confidential care for sexually transmitted infections, contraception, pregnancy, substance use and mental health.

The legal and ethical framework

• Confidentiality vs. privacy vs. privilege: privacy is the patient's right to control access to their person and information; confidentiality is the clinician's duty not to redisclose what was learned in the encounter; testimonial privilege is the patient's right to bar the clinician from testifying in court. Privilege belongs to the patient, so only the patient (or a judge overriding it) can waive it.
• HIPAA Privacy Rule (HHS Office for Civil Rights): governs protected health information (PHI). Disclosure without authorization is permitted for treatment, payment, and health care operations (TPO) and where required by law. The minimum necessary standard limits what may be shared — but it does not apply to disclosures to another clinician for treatment purposes.
• Heightened-protection records: federally assisted substance use disorder treatment records fall under 42 CFR Part 2 (SAMHSA) and generally require specific written consent even for treatment; psychotherapy notes are separately protected under HIPAA.

The exception categories, defined

• ***Tarasoff* duty**: from Tarasoff v. Regents of the University of California (1976). Tarasoff I framed a duty to warn the identifiable victim; Tarasoff II broadened it to a duty to protect, which may be discharged by warning the victim, notifying police, or hospitalizing the patient. Two elements must be present: a serious threat of violence and a reasonably identifiable victim. Statutes implementing this vary by state (mandatory in some, permissive in others).
• Mandatory disease reporting: state law, informed by the CDC/CSTE National Notifiable Diseases Surveillance System, compels reporting of specified infections to the health department. The threshold is diagnosis or suspicion, not patient consent.
• Mandated abuse reporting: child abuse reporting derives from CAPTA and state statutes; elder and dependent-adult abuse from state law and the Elder Justice Act. The standard is reasonable suspicion — the clinician reports, agencies investigate.
• Legal compulsion: a court order or judge-signed warrant compels release. An attorney-issued subpoena does not by itself override confidentiality; the response is to notify the patient and seek legal counsel or a protective order.
• Adolescent confidentiality: AAP and ACOG both support confidential care for sexual health, contraception, mental health, and substance use, within state minor-consent statutes.

• ***Tarasoff* = serious threat + identifiable victim. Both elements required. The duty is to protect**, not merely to warn — warning the victim, notifying police, or hospitalizing all satisfy it. A diffuse threat with no named target calls for risk assessment, not disclosure.
• Mandated reports need suspicion, not proof. For suspected child, elder, or dependent-adult abuse, file the report; you do not interrogate the alleged perpetrator, gather corroborating evidence, or wait for imaging results. Investigation is the agency's job.
• Subpoena ≠ court order. An attorney's subpoena does not defeat privilege; a judge's order does. The best next step for a subpoena is to notify the patient and consult counsel.
• Reportable diseases go to the health department, not to the contact. Public health performs partner notification and contact tracing, usually anonymously. The distractor is "call the partner yourself immediately."
• Substance use treatment records are extra-protected under 42 CFR Part 2, and psychotherapy notes are carved out under HIPAA — these are the records that still need specific authorization when ordinary PHI would not.
• Confidential minor care for sexually transmitted infections, contraception, pregnancy, substance use, and mental health is supported by AAP and ACOG within state law. Suicidality, abuse, or another *Tarasoff*-type threat overrides it.
• Incapacity is not a loophole to ignore the patient — HIPAA permits sharing with involved family when the patient assents, does not object, or is incapacitated and it serves their interest. Curiosity, employment, or insurance interest never qualifies.
• The most common wrong answer is deferring action: "obtain a court order," "ask the patient for permission," or "consult the ethics committee" when the scenario is a mandatory report or an imminent, identifiable threat. Ethics committees resolve value conflicts; they do not authorize legally required disclosures.