What a therapist may repeat, and who actually decides

General information about how confidentiality works in therapy in the United States, not advice about a particular situation. The rules that decide the answer sit in state licensing statutes, state evidence codes and the form signed at intake.

Confidentiality and privilege protect different things

The two words get used as synonyms. They are not. Confidentiality is a duty the clinician owes, arising from licensing law, the profession's ethics code, and HIPAA where the practice is covered. Privilege is a rule of evidence: it decides whether a court can compel the material, and it belongs to the patient. The gap matters, because a therapist can be under a strict duty of confidentiality and still be compelled to produce a file. Confidentiality always yields to a lawful order. Whether an order can lawfully issue is the privilege question.

In federal court the privilege exists because of Jaffee v. Redmond (1996), where the Supreme Court held that Federal Rule of Evidence 501 requires it and extended it to licensed social workers doing psychotherapy. The Court refused to attach a balancing test, reasoning that a privilege whose application cannot be predicted is not much of a privilege. A footnote allowed that it must give way where a serious threat of harm can only be averted by disclosure.

Mandatory reporting is the part with no discretion in it

Every state has a child abuse and neglect reporting statute, and mental health professionals are covered by all of them — most by name, the rest through a provision requiring any person who suspects abuse to report. Once the threshold is met the clinician has no judgement left to exercise.

• The trigger is suspicion, not proof. Reasonable cause to suspect is the usual standard, and the clinician is not permitted to investigate first.
• It does not matter who the patient is. The duty attaches whether the person in the room is the suspected abuser, the suspected victim, or a witness.
• Privilege is generally displaced. Reporting statutes commonly abrogate professional privileges for the report and for any proceeding that follows.
• Older and dependent adults are a separate scheme. Adult protective services statutes have their own reportable categories and their own lists of who is covered.

The genuinely uncertain case is an adult describing abuse suffered in childhood, where the alleged abuser may still have access to children. Some states read their statute to require a report; others confine it to a child currently at risk.

Duty to warn is not one rule, and in some places it is not a rule

The doctrine traces to Tarasoff v. Regents of the University of California. The 1974 decision framed it as a duty to warn the identifiable victim; the 1976 decision that superseded it framed it as a duty to use reasonable care to protect, which may mean warning, but may also mean notifying police or seeking hospitalisation.

California codified the position at Civil Code § 43.92, and the structure has been widely copied. The statute gives the psychotherapist immunity for failing to protect against a patient's violence, then removes that immunity in one case: where the patient has communicated a serious threat of physical violence against a reasonably identifiable victim. The duty is then discharged by reasonable efforts to communicate the threat to the victim and to a law enforcement agency.

Which category a state falls into is contested. A StatPearls review names Arkansas, Kansas, Maine, Nevada, New Mexico and North Dakota as lacking Tarasoff guidance; other fifty-state surveys draw the line differently, partly because statutes get amended and partly because a state without a statute may still have appellate case law. The conclusion is not a list, but that a list found online is not reliable enough to act on.

HIPAA sits on top without settling it. 45 CFR 164.512(j) permits a disclosure the provider believes in good faith is necessary to prevent or lessen a serious and imminent threat, made to someone reasonably able to prevent it. Permits, not requires: HIPAA never supplies the duty, only the federal permission to comply with one state law imposes.

The privilege is yours, and you are usually the one who gives it away

This is the mechanism that catches people, and nobody breaks a rule doing it. Every version of the privilege carries a patient-litigant exception. California Evidence Code § 1016 is the plain model: no privilege for communications relevant to a mental or emotional condition the patient has raised as an issue. Raise it, and the file that documented it is in play.

Federal courts split three ways on how much has to be claimed before that happens. A broad view treats any allegation of emotional distress as a waiver. A narrow view requires actual reliance on the records, or calling the therapist as a witness. The common middle position asks whether the distress claimed exceeds the "garden variety" — humiliation, anger, embarrassment — into a named psychiatric condition or an inability to work. How the damages are pleaded therefore decides whether years of notes are discoverable.

Custody cases apply pressure from a different direction, because the records sought are often the child's. In the New Hampshire case In the Matter of Berg (2005), the state supreme court held that parents have no exclusive right to waive a child's therapist-client privilege, that a sufficiently mature minor's own assertion of it carries substantial weight against a parent's wishes, and that a court may appoint a guardian ad litem or read the records privately first.

A subpoena is not a court order

The most common failure in this area is a practice that treats a lawyer-issued subpoena as an instruction and posts the chart. It is not an instruction, and under HIPAA it does not by itself authorise the disclosure.

That notice requirement exists for the patient's benefit and only works if it is used. An objection filed in time puts the privilege question in front of a judge; silence counts as no objection, and the assurance the requesting lawyer needs is satisfied. The same logic runs through a medical records release, which is why the named recipient and the date range repay reading.

Psychotherapy notes are a separate file with separate rules

HIPAA carves out a category at 45 CFR 164.501: notes analysing the contents of a counselling session and kept separate from the rest of the medical record. The definition excludes what people assume is inside it — medication and monitoring, session start and stop times, modalities and frequencies, test results, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress.

What the category buys is real. Under 164.508(a)(2) a specific authorisation is needed for almost any use or disclosure, and the exceptions are a short closed list: the originator using them for treatment, the entity's own training programmes, defending a legal action the individual brought, and a few oversight and public-safety provisions. That authorisation cannot be bundled with any other. A general records release does not reach them.

Substance use disorder records from a federally assisted programme carry their own regime under 42 CFR Part 2, stricter again, expressly restricting their use in civil, criminal, administrative and legislative proceedings without consent or a qualifying court order. Do not reason from HIPAA where it applies. HIPAA authorization vs a medical records release sets out the two ordinary routes.

Can a therapist tell my parents?

HIPAA generally treats a parent as an unemancipated minor's personal representative. 45 CFR 164.502(g)(3) sets out the departures: where the minor consented to the care themselves and no other consent is required, where the minor could lawfully obtain the service without parental consent, or where the parent agreed to a confidential relationship between minor and provider. Whether the first two apply turns on state law about minor consent to mental health treatment, which varies by age and by service.

Under 164.502(g)(5) a provider may also decline to treat a parent as personal representative where it reasonably believes the minor has been or may be subjected to abuse or neglect by that person, or that doing so could endanger them. In practice most adolescent therapy runs on an understanding reached at the start: general progress goes to the parent, specific content does not, safety concerns are the stated exception. That understanding is not law, and is worth having in writing. What informed consent actually requires covers the form it takes, and a telehealth consent adds a layer again where sessions are remote.

The reassuring part is that the exceptions are narrow, and most require something specific to have happened: a suspicion of abuse, a threat against an identifiable person, a proceeding somebody started. The unsettling part is that the exception most likely to reach an ordinary patient is none of the dramatic ones. It is the litigation waiver, triggered by a decision taken with your own lawyer months before anyone thinks about the therapy file.