Privacy in Therapy & Its Limits

Therapy is one of the most heavily protected spaces in our society in terms of privacy.

Everything we talk about in session is something I keep confidential, with just a few very uncommon exceptions. Because I exclusively work with adults, I’ll only be explaining what applies in my own practice.

If you are reading this while considering a child or teenager (younger than 18) in therapy, there are many more exceptions that I’m not covering here; I encourage you to research those independently.

What “confidential” means is that it stays between me and you (the client, or the couple/pair). I don’t tell your emergency contact. I don’t tell your employer. I don’t tell the government.

Even if I seek guidance from other therapists, I am extremely careful not to talk about it in ways that could ever possibly let others know that you are the person I’m talking about. We call this “identifying information” – information by which someone could conceivably connect dots and guess who it’s about.

Clients are usually more surprised by what is protected, than by what isn’t.

Imagine that you are an individual client, meeting with me one-on-one, navigating addiction.

You’re buying and using illegal drugs? Stays between us.

You’re doing it by secretly using your spouse’s income or financial gifts from your parents? Stays between us.

You’re high every day at your office job? Stays between us.

You share trade secrets? Stays between us (and I can’t act on them).

You’re embezzling an enormous amount of money from the company? Stays between us.

You confess to me that you murdered someone, but I can see that you pose no threat to yourself or other people now? Stays between us.

Really?

Really. If I were to share any information like that, I would quite likely lose my license, and can even face federal prison sentences. Like I said: it’s one of the most heavily protected spaces in our society in terms of privacy.

So what are the exceptions?

There are indeed limits, but I want to open this section with a very honest reassurance: I have literally had thousands of sessions with clients, and I have only had to “break confidentiality” – disclosing information without a client explicitly telling me to – two times.

Just two.

One of those was a report to the Texas Department of Family and Protective Services (DFPS) in which – to my client’s relief – DFPS told me directly that they could not and would not be taking any kind of action.

The other was one that my client would have asked me to do anyway, but it came up unexpectedly before the client had completed a “Release of Information” form. More on that in a moment.

A final point before moving forward: the two cases above are examples of non-identifying information. Yes, I’ve shared real information about real clients. But no, you could never, ever know who I’m talking about. It is simply too vague, very strictly.

You ask me to break confidentiality by sharing information with someone

I’m starting with this one because it really illustrates how heavily protected your information is, and because it accounts for virtually all of the times that I share health information.

You have the right to ask me, in writing, to share information with someone else.

The most common examples are with clients who are doing both individual therapy and couples therapy, so their therapists can talk to each other. This can be incredibly helpful and reassuring for clients for a number of reasons that I won’t go into here.

The other common one is giving me permission to speak with the person who prescribes you medications that affect mental health – your psychiatrist, your primary care provider, very rarely an OBGYN.

Even if you verbally ask me to do that, that’s not enough permission on its own; I have to send you a link to the portal to fill out a “Release of Information” (ROI) form.

On an ROI, you specify (1) what information I’m allowed to share (these are checkboxes), (2) who, precisely, I should be speaking to, and (3) their email (and phone number if you have it).

This permission automatically expires after 1 year, and you can revoke it at any time by saying so in writing. Let’s take the first example:

Imagine that you’re seeing an individual therapist (Therapist X) and so is your partner (Therapist Y), and you’ve started seeing me (Therapist Z) for couples therapy. I’m going to recommend that I be able to speak with X and Y.

You both see your individual therapists, and we all agree that it’s a good idea. Therapist X needs an ROI form to talk to me; so does Therapist Y; and because I’m seeing both you and your partner, I need an ROI from each of you to speak with X, and another from each of you for Y (four forms).

Let’s say you both get X and Y the ROIs to talk to me. Now they can. And you both fill out the ROI for me to talk to X, but only your partner fills out the ROI for Y. X calls me, and we have a two-way conversation. When Y calls me, though, they can say things to me, but I can’t even confirm or deny that I’m seeing you and your partner; Y is talking to a wall.

We meet again, and I mention that I spoke with Therapist X, and that Therapist Y spoke to me, but that I couldn’t say anything back to Y. I ask you about that ROI, and you say that you changed your mind and don’t want me to tell Therapist Y anything about what we’re doing in couples therapy. That’s that.

The bottom line here is that it is 100% your choice. There is a piece of paperwork you’ll be filling out before our first session called “Notice of Privacy Practices” that describes your privacy rights – including your right to request that I share information – everything that’s protected, and the few exceptions.

Ok, so what are the exceptions that aren’t chosen?

On insurance, disclosures to your insurance company

Well, this is semi-chosen. The privacy decision is made all-at-once, up front, and you may be in the middle of making that decision right now. It’s time-sensitive. If you’re thinking about using insurance, I don’t want you dropping off before getting through this section.

If you choose to use insurance, this applies the whole time; if you choose not to, it doesn’t apply at all.

There are three buckets of what your insurance company can see, and what they can’t:

(1) What they see all the time: billing records, dates of service, the diagnosis that the treatment is for, the specific treatment (individual vs family counseling, duration), and other more surface-level information needed for claims.

(2) What they don’t see all the time, but can access when they scrutinize things: progress notes, treatment plans, and clinical summaries. These describe what we’re doing in session; they contain just enough detail to prove that the therapy was medically necessary, and that what I provided was actual therapy.

The level of detail we’re generally talking about in bucket #2 is something like describing the problem as “anxiety symptoms (muscle tension, feeling on edge, worry, difficulty concentrating)”.

(3) What they don’t have access to: video, audio, or transcripts of our conversations. Given the anxiety symptoms I just named, this would be something like the specific things you worried about, or the contents of a nightmare.

In a way, when it comes to your privacy, choosing to receive therapy through insurance is like writing a blank check to your insurance company: you can make the choice to write it and hand it over, or not, but you can’t control the number after that.

If later on you wish you hadn’t, it’s too late to change your mind about sessions your insurance company already paid for; buckets #1 and #2 above remain within your insurance company’s reach for those sessions.

You do have a federal right to change your mind and protect your privacy for future sessions. To do this, you would need to stop using your insurance benefits and pay out-of-pocket in full instead. To better understand this last point, and privacy concerns in general, you might consider reading this article.

Ultimately, that initial choice is yours, and I encourage you to choose whatever you feel is best for you.

If there’s imminent danger to yourself or others

You may have picked up on this in the last example I offered in the imaginary scenario at the beginning. Serious homicidal intentions are not common. What does commonly come up in therapy is suicidality. I’m very comfortable talking about it – in some people’s lives, suicidal thinking isn’t even a negative thing, necessarily.

Just thinking about killing yourself or someone else stays between us. These thoughts have a broad range of seriousness, but it stays confidential unless I sincerely believe that you are really going to try.

In those moments, we’re first going to talk about safety planning, or I’m going to encourage you to seek a higher level of care (inpatient), or both. If I continue to believe you or others are in imminent danger, Texas permits me to involve mental health officers if I think it’s the right move.

I have never had to go beyond safety planning.

If there’s abuse, neglect, or harm to a child, older adult (65+), or person with a disability

Most Texans don’t know this, but every adult in Texas is legally required to make a report if they learn of any past or present abuse, neglect, or harm to someone in one of these vulnerable groups.

The exact language is “a person having reasonable cause to believe that a child's physical or mental health or welfare has been adversely affected by abuse or neglect by any person shall immediately report.” A parallel law covers older adults and people with disabilities too.

The same standard applies to me as a therapist; also worth mentioning is a special rule that says that I have to make the report within 24 hours of learning about it.

Before you become too worried, read on:

The key question is whether someone in one of these groups is still in danger – that’s what actually determines if a report has to be made.

I have only ever had to make one report. Yet I have heard countless stories of abuse, neglect, and harm to children.

Then why no reports? They were my clients (adults) when they were children. There has not been reason to believe that a vulnerable person is endangered by those abusive/neglectful/harmful people. I would have to have determined in good faith that a report was necessary to protect another child, an elder, or a person with a disability.

That said, in the extremely unlikely event that I have to make a report, I would let you know as soon as I realize that I have to. From there, I would let you know that you could be involved as much or as little as you would like, with your responses ranging from “gladly, I want to be on the call with you” to “I understand that you don’t have a choice, but I hate that you’re doing this, and I don’t want to keep working with you.”

Obviously that latter end would be rough, but it would be your right to make that choice, and I would understand.

If all Texans are required to make these kinds of reports, then why are we talking about this in such detail?

Because of how extremely private and protected our conversations are in comparison to almost any other context. It’s a very unusual disruption to the privacy of a very sensitive relationship.

If I’m legally forced to, in a different way

If I have been made aware that a court has subpoenaed my records, and I’ve had the opportunity to object to disclosing those records / seek legal counsel to nullify the request, and I’m met with a court order in response, then I must turn them over.

Similarly, if some other law enforcement proceedings truly force me to turn my records over, I must. Short of any actual criminal level of resistance, my ethics typically point toward fighting tooth and nail to not have to comply with this.

What is more common – though still something that hasn’t happened for me – is a client requesting that their therapist comply.

If you’re having a medical emergency

This is the last one I’m going to give its own section, and I’ll keep it brief.

If, for instance, I’m having a session and a client starts having a stroke, or if they’ve parked somewhere private enough to have a session from their car, but something really bad is happening: I can call paramedics to their location, if I believe it can prevent serious harm.

The rest: specialized government functions, deceased patients & health oversight activities

I’ll keep these brief too.

If you’ve served in the armed forces or worked in highly controlled government settings (ex. the FBI, CIA, the Dept of State), unsurprisingly you’ve waived some of your privacy rights to the government. I could be forced to disclose information to those entities if you were a part of them.

If one of my clients passes away, unless that client had designated someone before their death as having special rights to make decisions about their health care (their DPOA-HC), I can’t share records with anybody (ex. their family members). The health privacy law (HIPAA) actually protects their records in this way for 50 years after their death.

And finally, if health oversight agencies are investigating me as a health care professional, they may access my records.

Conclusion

Therapy really is an exceptionally private space. The degree of privacy is actually fairly extreme. Because of that, therapists have an obligation to be very clear about the limits on that privacy.

We’re required to do it during the very first session, before any of these exceptions have had a chance to come up. But because those circumstances are quite uncommon, and because that first session has such emotional importance, it’s rare that a therapist offers a truly detailed explanation up front.

I’ve written this article mainly as a place to direct new clients if they have lingering questions and concerns, so we’re using sessions to talk about life, not the law.

As always, though, if questions remain, I’m here to answer them.