Confidentiality and its limits

The key ideas

• NASW 1.07(a)-(c) Privacy and confidentiality: core and limit

  Respect privacy and do not solicit private information without compelling professional reason. Confidentiality is the default; it does not apply when disclosure is necessary to prevent serious, foreseeable, and imminent harm to a client or others, and then only the least information needed.^[1]

• NASW 1.07(b),(d),(e) Consent to disclose and discussing limits

  Disclose with valid consent from the client or a legally authorized person. Planned disclosures should be preceded, when feasible, by telling the client about it and consequences, whether legally required or consented. Discuss confidentiality limits early and as needed.^[1]

• NASW 1.07(f)-(g) Confidentiality in family, couple and group work

  In family, couple, or group counseling seek agreement among participants on each person's confidentiality and tell them the worker cannot guarantee others will honor it. Explain agency and worker policy on sharing among parties.^[1]

• NASW 1.07(h)-(i) Third-party payers and private settings

  Do not give confidential information to third-party payers without client authorization. Do not discuss confidential information in public or semipublic areas such as hallways, elevators, waiting rooms or restaurants.^[1]

• NASW 1.07(j)-(k) Court orders and media

  Protect confidentiality in legal proceedings to the extent law permits. If a court or other legally authorized body orders disclosure of confidential or privileged information without the client's consent and disclosure could harm the client, ask the court to withdraw the order, limit it as narrowly as possible, or keep the records under seal. Protect confidentiality with media.^[1]

• NASW 1.07(l)-(w) Records security, electronic communication, breach, disposal, teaching and consultation

  Secure written and electronic records, use safeguards for electronic communication, have breach notification policies and tell clients of unauthorized access, dispose of records protectively, and plan for end of practice or death. Identifying details need client consent for teaching or training, and consent or compelling need for consultation. Confidentiality continues after a client dies.^[1]

• HIPAA general rule and minimum necessary

  Covered entities may use or disclose PHI only as the Privacy Rule permits or requires. Disclosures and requests must be limited to the minimum necessary, except for treatment disclosures between providers, disclosures to the individual, authorized disclosures, and those required by law.^[2]

• HIPAA judicial and administrative proceedings: subpoenas

  PHI may be disclosed under a court order, limited to what the order expressly authorizes. A subpoena or discovery request without a court order requires satisfactory assurance of notice to the individual or a qualified protective order. Psychotherapist-patient privilege is separate (Jaffee, state law).^[3]

• Jaffee v. Redmond: federal psychotherapist-patient privilege

  The Supreme Court (1996) held that confidential communications between a licensed psychotherapist and patient made in diagnosis or treatment are protected from compelled disclosure in federal court, and that this extends to licensed clinical social workers. The Court noted all 50 states have some form of the privilege.^[4]

• 42 CFR Part 2: scope

  Part 2 protects records identifying a person as having or having had a substance use disorder, created by federally assisted SUD programs. Records may be used or disclosed only as Part 2 allows, including in legal proceedings; protection is stricter than HIPAA.^[5][6]

How the ASWB exam tests it

• Preventing serious, foreseeable, and imminent harm is the ethical exception, and even then share only the minimum necessary.^[1]
• The best first step before a required disclosure is usually to tell the client, when that is feasible.^[1]
• The worker cannot guarantee group confidentiality and should address it at the start.^[1]
• Discussing a client in a hallway, elevator, or other public area breaches confidentiality.^[1]
• When a subpoena arrives, the best answer is to assert confidentiality and seek to limit the disclosure, not to ignore it or simply comply.^[1]
• Teaching or training with identifiable information needs consent; consultation needs consent or a compelling need. Confidentiality survives client death.^[1]

Try a related question

1. LCSW practice · Values and Ethics

   Which of the following is a key legal requirement when handling client information electronically?

   • A.Allowing access to all agency staff, regardless of their involvement with the client.
   • B.Ensuring that client information is stored securely and only accessible to authorized personnel.
   • C.Sharing client electronic records through unsecured email systems for convenience.
   Show answer

   Answer: B. Ensuring that client information is stored securely and only accessible to authorized personnel.

   Protecting client information in electronic records requires using secure storage systems and ensuring only authorized personnel have access, maintaining confidentiality and security.

More LCSW practice questions with answers

Covered on other pages

• HIPAA serious threat to health or safety

  HIPAA permits (does not require) a provider, in good faith and consistent with applicable law and ethical standards, to disclose PHI believed necessary to prevent a serious and imminent threat, to people able to prevent or lessen it including the target. It also covers aiding law enforcement. Good faith is presumed when based on actual knowledge or credible representation.

• HIPAA psychotherapy notes

  Psychotherapy notes are a mental health professional's notes analyzing session content, kept separate from the rest of the record; they exclude medications, session times, modalities, test results, and summaries of diagnosis, treatment plan, symptoms and progress. They need specific authorization except for the originator's treatment use, supervised training, defense against the client's legal action, HHS compliance review, and a few permitted disclosures such as 164.512(j)(1)(i). Clients have no HIPAA access right to them.

Related explainers

• Duty to warn and duty to protect
• HIPAA psychotherapy notes vs progress notes
• Informed consent
• Mandated reporting of child abuse