Confidentiality and Tarasoff: When You're Allowed to Break the Rule
Confidentiality feels like it should be simple. Keep what the client tells you private. But the boards don't test the simple version, they test the exceptions, and there are more of them than people expect. Let's go through what confidentiality actually protects and when the law lets you, or requires you, to break it.
What Confidentiality Covers
Clients have the right to expect that their private information stays private, whether it was spoken, written, or electronic.
Information can only be shared when:
It's necessary for treatment or payment
The client has signed a Release of Information (ROI)
Outside of those two situations, you need consent. This ties directly into informed consent, since a client can't meaningfully sign a release if they don't understand what they're authorizing.
Two Laws That Add Extra Protection
Most confidentiality rules fall under HIPAA, but two specific protections go further.
HIPAA and psychotherapy notes. Psychotherapy notes get special protection under HIPAA. They can't be released without the client's specific written authorization, and that includes other members of the treatment team. A general release doesn't cover these notes, you need one written specifically for them.
42 CFR Part 2. This federal regulation protects substance use treatment records, and it's stricter than HIPAA. Here's the detail that trips people up on the boards: if both psychiatric records and substance use records are requested, you need two separate releases, not one combined release. Treating these as interchangeable is a common wrong answer.
When You're Allowed, or Required, to Break Confidentiality
Confidentiality is the default, but the law carves out specific exceptions. These exceptions are where most of the exam questions live.
Danger to self or others. Confidentiality can be breached to prevent serious harm. This is where Tarasoff comes in, more on that below.
Suspected abuse. You're legally required to report suspected child abuse, elder abuse, and dependent adult abuse. Notice the word suspected. You don't need proof, you need reasonable suspicion.
Court order or subpoena. If a court orders records, HIPAA requires compliance. Release only what's specified, nothing more.
Insurance and billing. Information can be shared with insurers for claims or coverage. Disclose the minimum necessary, not the full chart.
Medical emergency. HIPAA allows disclosure of the minimum necessary information to prevent serious harm or support emergency care.
Tarasoff: The Case Behind the Duty to Warn
Tarasoff v. Regents of the University of California (1976) is one of the most tested legal cases in this whole content area, so it's worth knowing cold.
Tarasoff established the duty to warn. When a client makes a credible threat of serious harm against an identifiable victim, you have a duty to warn that person. This may include notifying law enforcement.
The key word is identifiable. A vague statement like "I'm so angry I could hurt someone" doesn't trigger Tarasoff the same way a specific, named threat does. The exam likes to test that distinction, so pay attention to whether the threat in a question stem names a specific person or stays vague.
Why This Section Gets Tested So Heavily
Confidentiality questions on the boards aren't really testing whether you know confidentiality matters, you already know that. They're testing whether you can spot which exception applies in a given scenario, and whether you know the specific requirements attached to each one. Suspected abuse doesn't require proof. 42 CFR Part 2 needs two releases, not one. Tarasoff requires an identifiable victim, not just anger or distress.
When you hit a question in this area, don't just ask whether disclosure is allowed. Ask which exception the scenario is describing, and whether the scenario actually meets that exception's specific requirements.
Want the full breakdown of patient rights, including informed consent and capacity, and least restrictive care? That's all covered in The PMHNP Playbook.
