Confidentiality and Tarasoff: What PMHNPs Need to Know
By Aislinn Ozawa Burns, MSN, PMHNP-BC
Confidentiality questions get harder when two good responsibilities pull in different directions. You need to protect the client’s privacy. You also need to respond to danger, follow reporting laws, and coordinate care.
The useful question is: What allows or requires this disclosure, and how much information does that purpose actually need? Start there instead of assuming every request needs a release or every safety concern means calling the police.
Board focus: Know the difference between routine treatment information, specially protected notes, a serious safety threat, and a legal demand for records.
Confidentiality is the default
Confidentiality protects information shared in conversation, written in a chart, or stored electronically. A psychiatric diagnosis does not remove that protection.
Under HIPAA, covered providers can generally use or disclose ordinary health information for treatment, payment, and qualifying health care operations without a separate written authorization. Other permitted or required disclosures have their own conditions. State law and specially protected records can add restrictions. See HHS guidance on treatment, payment, and health care operations.
Example: A clinician treating a client’s diabetes requests the current psychiatric medication list to check interactions. HIPAA generally permits that treatment disclosure. Before sharing, verify the recipient and whether another applicable law restricts the information.
A release of information is useful when authorization is needed, but signing a form is not the whole task. The client should understand what information will be shared, with whom, and for what purpose. Review the related guide to capacity and informed consent.
Psychotherapy notes are different from routine progress notes
HIPAA uses psychotherapy notes in a specific way: separately maintained notes that document or analyze counseling conversations. A medication list, diagnosis, treatment plan, or routine progress summary does not become a psychotherapy note just because it comes from a psychiatric visit.
Sharing these separately maintained notes generally requires specific authorization, including sharing with another treating clinician. Limited exceptions exist, such as certain disclosures required by law or needed to address a serious and imminent threat. Avoid the absolute answer that they can never be disclosed without authorization. HHS explains the distinction and protections.
Board tip: First identify the type of record. “Psychiatric record” and “psychotherapy notes” are not interchangeable terms.
42 CFR Part 2: the current consent rule
Part 2 adds protections for qualifying substance use disorder records. Do not assume every mention of alcohol or drug use in a general medical chart automatically falls under Part 2.
Under the updated rule, with compliance required by February 16, 2026, a single consent can cover future uses and disclosures for treatment, payment, and health care operations. “Psychiatric records plus substance use records always require two releases” is not a reliable rule.
Important protections remain. Separately maintained SUD counseling notes require separate consent, and a broad treatment consent does not authorize use of protected records in proceedings against the patient. Those uses need the applicable specific consent or Part 2 court-order process. See the HHS Part 2 final-rule fact sheet.
Practical question: Which records are protected, what is the proposed use, and does the consent actually cover it?
Other disclosures: identify the authority first
Suspected abuse
Follow the applicable mandatory-reporting statute. Child abuse and abuse involving older or dependent adults can trigger reporting duties, but covered populations, thresholds, recipients, and deadlines vary. When the statutory threshold is met, do not wait to prove the allegation yourself. Document the concern and the report. HHS confirms that HIPAA permits child-abuse reporting to appropriate authorities.
Court orders and subpoenas
A subpoena is not automatically the same as a court order. HIPAA permits disclosure of information specifically described in a court order. For a subpoena without an order, requirements can include satisfactory assurances about notice to the patient or efforts to obtain a qualified protective order.
Case: An attorney requests the entire psychiatric chart with a subpoena. Do not automatically send it or ignore it. Route it promptly through the organization’s privacy or legal process, review deadlines, and check privilege, state law, and any additional record protections. HIPAA permission does not erase those requirements. See HHS guidance on court orders and subpoenas.
Medical emergencies
Sharing treatment information with an emergency clinician can be permitted under HIPAA. Part 2 has its own medical-emergency provision: qualifying disclosures to medical personnel may be made to the extent necessary for a bona fide medical emergency when prior consent cannot be obtained. Immediately after disclosure, the program must document the recipient and health care facility affiliation, the person making the disclosure, the date and time, and the nature of the emergency. Do not assume a HIPAA exception automatically overrides Part 2. See 42 CFR 2.51.
Minimum necessary: know when it applies
HIPAA generally requires reasonable limits on information used, requested, or disclosed, including for payment and health care operations. An insurer’s request is not an automatic reason to send every detail in the chart.
The formal minimum-necessary standard has exceptions. These include disclosures to or requests by a health care provider for treatment, disclosures under the patient’s authorization, and disclosures required by law. That does not eliminate the limits of an authorization, the scope of a legal requirement, or other privacy protections. HHS lists the minimum-necessary exceptions.
Board tip: Keep disclosures purposeful and limited, but do not state that HIPAA’s minimum-necessary rule applies to every treatment exchange.
Tarasoff: understand the duty to protect
Tarasoff v. Regents of the University of California is associated with a clinician’s duty to protect a person threatened by a patient. It does not establish one identical reporting rule for every clinician in every state.
California’s Civil Code section 43.92 addresses a patient’s communicated serious threat of physical violence against a reasonably identifiable victim or victims. Its statutory protection from liability includes reasonable efforts to communicate the threat to both the potential victim and law enforcement. California describes the responsibility as a duty to protect. Warning may be part of protecting someone; the clinical response may also require emergency evaluation and other safety measures. The California Legislature’s explanation of section 43.92 describes this distinction.
In practice, check the applicable state’s law, which professionals it covers, the triggering facts, and the required protective actions. A board question may supply those details. Use them.
HIPAA permission and a state-law duty are separate questions
HIPAA permits disclosure when a provider has a good-faith belief it is necessary to prevent or lessen a serious and imminent threat, and the recipient can reasonably help reduce that threat. The disclosure must also be consistent with applicable law and ethical standards. That permission does not itself create a universal duty to warn. Read HHS guidance on serious threats.
Case: A client says they plan to shoot their former partner tonight and have access to a firearm. This calls for an immediate safety response. Assess the threat and activate the appropriate emergency and protective procedures. Do not postpone action until the next visit or rely only on a medication adjustment.
Different case: “I’m so angry I could hurt someone” still needs assessment. Ask about intent, plans, access to weapons, timing, and possible targets. The absence of a named victim does not establish that the situation is safe.
A quick way to work through the question
Identify the request or risk. Is this treatment coordination, billing, a safety emergency, suspected abuse, or a demand for records?
Identify the information. Ordinary chart information, psychotherapy notes, and Part 2 records can follow different rules.
Find the authority. Is disclosure permitted, required, or dependent on valid authorization?
Choose the recipient and scope. Send information only through an appropriate channel to someone authorized to receive it.
Act and document. Record the assessment, applicable basis, consultations, recipient, information shared, and follow-up plan.
When immediate danger is present, protective care cannot wait for a routine records-review workflow. Confidentiality decisions and decisions about involuntary hospitalization may occur together, but each requires its own legal and clinical basis.
Frequently Asked Questions
Does Tarasoff mean every threat must be reported?
No. Assess the threat and apply the relevant state law. The wording, target, timing, and ability to act matter. A concerning statement still deserves assessment even when a particular warning requirement is not triggered.
Do all psychiatric records need special authorization?
No. Ordinary treatment records and separately maintained psychotherapy notes have different protections. Additional state law may also apply.
Does Part 2 always require two release forms?
No. Identify the protected information and purpose. The current rule allows a single treatment, payment, and health care operations consent, while preserving separate requirements for certain uses and notes.
Put the rules into practice
Try the confidentiality and Tarasoff practice questions, then explain why each disclosure is permitted or required before looking at the rationale.
For the broader review of patient rights, ethics, and clinical decision-making, explore The PMHNP Playbook on Amazon.
Educational review for PMHNP students and clinicians, not individualized legal advice. Federal sources checked October 9, 2026. Verify current state law and organizational procedures for a real clinical situation.
Prefer digital? Buy the PDF edition
