3 Confidentiality and Information Handling

Confidentiality and its limits

Confidentiality is the professional duty to protect private information learned through work. It supports trust and client autonomy, but it is not absolute: ethical codes, laws, court orders, and immediate safety concerns may require or permit limited disclosure.

Applicable rules vary by profession, jurisdiction, and setting. HIPAA applies to covered entities and their business associates, not automatically to every professional or organization. When uncertain, consult a supervisor, privacy officer, or qualified legal counsel.

Explain privacy expectations

At the beginning of a professional relationship, explain in clear language what information is recorded, who may access it, how it may be used, and the circumstances in which it could be shared without permission. Revisit this explanation when circumstances change, and involve the client in the discussion as appropriate, including when working with minors, families, groups, or organizations. Do not promise secrecy that cannot be guaranteed.

Possible limits include legally required reporting, a serious and imminent risk of harm, or a valid legal process. The details and thresholds depend on applicable law and professional standards. A request, subpoena, or court order is not necessarily interchangeable with another: verify what applies, consult the organization’s designated expert, and disclose only what is authorized or required.

Decide what to share

Before sharing private information, consider the purpose of disclosure: whether it is necessary for care, safety, a legal duty, or another valid professional purpose. Then verify the authority and its scope. This may be valid client consent, a specific ethical permission, or a legal requirement; do not assume that authority covers more than it does.

Share information only with authorized people who have a legitimate role, and limit it to what is relevant to the purpose. Under HIPAA, the minimum-necessary rule generally applies to uses and disclosures, with exceptions such as provider-to-provider disclosures for treatment. Use an approved, reasonably secure channel and confirm the recipient when appropriate.

Document the request, the authority or consent relied on, what information was disclosed, who received it, and the reasoning, following workplace policy and applicable rules.

For example, if a school asks a clinician for a client’s full file, the clinician should not send it automatically. The clinician checks the client’s authorization and applicable rules, clarifies what the school needs, consults a supervisor if necessary, and shares only authorized, relevant information through an approved channel.

Protect records and communications

Private information can include spoken conversations, paper files, electronic records, messages, images, and identifying details. Match safeguards to the format: restrict access to authorized users, secure devices and paper records, avoid discussing cases where others may overhear, and verify recipients before sending. Follow approved procedures for storage, transfer, retention, and secure disposal.

Obtain required permission before recording or sharing identifiable information for teaching, consultation, or publication, and disguise identities when appropriate.

Respond to possible breaches

If information may have been lost or disclosed improperly, act promptly. Limit further access or sharing, notify the appropriate supervisor or privacy lead, preserve relevant facts, and follow the organization’s incident and notification procedures.

For organizations subject to HIPAA, the Breach Notification Rule sets requirements for assessing and notifying about certain breaches of unsecured protected health information.

• covered entity