Trends in Confidentiality and Disclosure

The private nature of personal medical information has long been recognized as a key component of the physician-patient relationship in the Western tradition. The Hippocratic Oath of the fourth century B.C. required the following pledge of would-be doctors:

This respect for “secrecy, and delicacy when required” was echoed in English physician Thomas Percival’s seminal codification of medical conduct in 1803 and later incorporated as an “obligation of secrecy” in the American Medical Association’s first Code of Ethics in 1847 (2, 3). Medical confidences are now protected by state and federal statutes, the bylaws of most professional organizations, and widely held ethical norms. However, both the nature and the parameters of medical confidentiality have evolved with time. Whereas earlier arguments for confidentiality were centered on beneficence and grounded in “a physician-based commitment to a professional ideal” intended to enhance the caregiver’s therapeutic role, contemporary justifications see confidentiality as “a patient-based right” furthering privacy and autonomy (4). However, the legacy of these therapeutic justifications survives today in consequentialist defenses of confidentiality that note the important of such guarantees in ensuring that patients will trust their providers with sensitive medical information or will even choose to seek medical care at all. At the same time, what was once thought of as an absolute, fiduciary obligation of doctors to patients has witnessed considerable recent erosion as society has imposed various duties to disclose medical information for the protection of specific third parties and the public welfare.

Confidentiality is now best understood in the context of dual or competing loyalties (5). Physicians have a broad duty to protect patient confidences, but one that is limited—in specific circumstances—by a competing obligation to serve the commonweal and protect the health of others. These duties first arose in the late 19th and early 20th centuries because the emerging field of public health required physicians to report communicable diseases. They were closely related to the rise in quarantine measures to prevent the spread of disease but have since been extended to a wide range of areas in which the welfare of third parties is implicated (6). Today, gunshot, knife, icepick, and burn injuries must be reported to authorities in many jurisdictions; some states require the reporting of sexually transmitted diseases to facilitate the notification of at-risk partners. All states compel physicians to breach confidentiality to report child abuse, most states extend this requirement to elder abuse, and an increasing number are mandating the reporting of intimate partner violence. The trend is toward more disclosure: In Bradshaw v. Daniel, the Tennessee Supreme Court found a duty to warn a patient’s spouse of a common exposure to a noncontagious disease (Rocky Mountain spotted fever), a case in which both spouses had been exposed to the same tick vector; in Safer v. Estate of Pack, the New Jersey courts imposed a duty to warn patients’ family members of genetic predispositions to illness (colon cancer) (7, 8).

Providers seeking guidance on breaching confidentiality should be familiar with the law in their specific jurisdiction because considerable variation often exists. For instance, some authorities take the position that victims of elder abuse or intimate partner violence are inherently vulnerable, and their right to confidentiality must be breached to protect their welfare. However, others believe that victims are best positioned to determine whether or not reporting stands in their own interest and they must live with the consequences, so confidentiality must not be breached without their permission. In addition, the fear exists that without such assurances of confidentiality, victims might not seek medical care at all. Another concern is that abridging the autonomy of patients who already lack considerable agency or power may have negative psychological sequelae. Because jurisdictions have adopted different approaches, no generalized principle of law can be stated, and providers might be wise to seek guidance from their own counsel or insurer.

In many circumstances, the law continues to afford physicians discretion regarding breaches of confidentiality. A majority of states, for instance, let individual providers decide whether to report potentially impaired drivers—such as the alcohol-dependent patient who confesses to driving while intoxicated (9). Physicians might choose to perform a cost-benefit analysis in such cases, possibly reporting a school bus operator or commercial truck driver but not an occasional motorist; alternatively, physicians might adhere to a per se policy against ever breaching confidentiality. When rendering a decision, psychiatrists should be aware of their jurisdiction’s malpractice laws in this area. For instance, if they do not report an impaired driver and that patient then injures a third party, can they be liable?

Considerable debate exists regarding the systematic impact of such lawful, discretionary divulgences. Most notably, philosopher Kenneth Kipnis has argued in favor of unqualified confidentiality protections on the grounds that the perceived erosion of such safeguards drives patients away from care, ultimately placing the public at greater risk (10). In thinking through these challenging cases, psychiatrists should carefully document the reasoning behind their decision either to report or not to report. In litigation, showing that they were aware of the complexities of the situation and gave them due consideration may prove important in protecting their interests before a jury.

Laws governing confidentiality derive from a combination of state and federal statues, court decisions, and administrative regulations. Among the most significant of these for practicing psychiatrists are state laws and regulations protecting the confidentiality of medical records and disclosures; the HIPAA, which incorporated such limits into federal law, often expanding them in the process; several additional statutes imposing more detailed restrictions in specific fields, such as Part Two of 42 Code of Federal Regulations (42 C.F.R.), protecting substance abuse records, and state statutes applicable to protecting HIV status; the Supreme Court ruling in Jaffee v. Redmond upholding a federal psychotherapist-patient privilege; and the duties to warn and protect that stemmed from the California case of Tarasoff v. Regents of the University of California and have since shaped statutes and court decisions across the nation (11, 12). An overview follows.

Duty to Warn and Protect

A third-party interest of particular concern to psychiatrists is the well-being of identified targets of potential patient violence. This complex issue is pivotally linked to the California case of Tarasoff v. Regents of the University of California (11). The Tarasoff case stemmed from the murder of 20-year-old Berkeley student Tatiana “Tanya” Tarasoff by graduate student Prosenjit Poddar. Tarasoff had reportedly rebuffed Poddar’s romantic advances, and he had a “severe emotional crisis” (13). Poddar voluntarily entered the care of Dr. Lawrence Moore, a psychologist at the University of California, Berkeley, Cowell Memorial Hospital and confided in Moore that he had homicidal thoughts toward Tarasoff. Although Moore contacted the campus police and Poddar was questioned, neither Moore nor his supervisor, Dr. Harvey Powelson, took further steps to protect the intended victim. Two months later, on October 27, 1969, Poddar stabbed Tarasoff to death. (Poddar was convicted of second-degree murder, served five years in prison, and was eventually deported to India; he later married and pursued a Ph.D. in naval architecture in Germany.) Tarasoff’s parents brought a civil action against Moore, Powelson, and their employer. The question that eventually reached the California Supreme Court was what duty of care, if any, existed between the providers and the nonpatient victim.

The initial 1974 court decision in the case (known as Tarasoff I) established a duty to warn specifically identifiable third-party targets. However, a 1976 rehearing (Tarasoff II) replaced this duty to warn with a duty to protect such potential victims. (The distinction here is that warning merely involves notifying third parties directly that they are at risk, whereas protecting means taking steps—such as involving law enforcement—to ensure their safety; the two are not mutually exclusive.) Justice Mathew Tobriner held for the court, “We conclude that the public policy favoring protection of the confidential character of patient-psychotherapist communications must yield to the extent to which disclosure is essential to avert danger to others. The protective privilege ends where the public peril begins” (11). (Although this was a novel ruling, its origins can be traced back to holdings in earlier “negligent release” cases such as Fair v. United States [1956] and Underwood v. United States [1966]) (14). An appellate court briefly reimposed a duty to warn in California from 2004 to 2006, but between 1976 and 2004, and again from 2007 onward, so-called Tarasoff duties in California have only required protection, not warning (15). Reasonable steps to protect a patient might include contacting appropriate authorities, hospitalizing the patient, or warning the intended victim (16). However, in certain circumstances—such as in cases of intimate partner violence—warning may prove insufficient to meet the protection standard. Precisely how much action must be taken by the psychiatrist will depend on both the specific circumstances of the case and the jurisdiction in which it occurs.

Tarasoff had a widespread legal and cultural impact. However, many jurisdictions responded with so-called Tarasoff-limiting statues to curtail physician liability, which softened its impact to some degree (17). As legal precedent, the case is only binding in California. Significant variation exists among state laws on the subject: Thirty-four states impose either a duty to warn or to protect (23 states by statute and another 11 by common law; 18). An additional 10 states and the District of Columbia permit voluntary disclosure (18). Six jurisdictions (Arkansas, Kansas, Maine, Nevada, New Mexico, and North Dakota) offer no legal guidance in such cases (18). Therapists face a particular bind in these jurisdictions because they “are open to significant legal risk no matter how they proceed: if they breach confidentiality, a patient could sue, and if they fail to breach confidentiality and a victim is harmed, the victim could sue” (18). States vary on the standards for foreseeability of future risk required to trigger a duty and also on how specifically the intended target must be identified in advance. For instance, in Almonte v. New York Medical College, the U.S. District Court for Connecticut found a psychiatrist liable for not disclosing the potential threat posed by a pedophile physician-in-training, even though no particular child had been individually named as a target (19). One controversial Washington State case, Volk v. DeMeerleer, expanded the obligation of the physician to take action to protect third parties from patients with dangerous propensities—even if they had not voiced any threats to others (20). However, this decision has been highly criticized (21).

Some states extend the duty beyond the psychiatrist to other physicians. State courts have taken “directly opposite positions in cases involving the duty to warn and protect,” and legislatures have imposed such duties after they have been rejected judicially, as did Virginia lawmakers after Nasser v. Parker (2006) repudiated Tarasoff (22). After a decade of rapid adoption and expansion subsequent to Tarasoff, the general trend at the state level has been a slow but steady retreat from extensive duties (14). Outcomes also appear to favor narrow obligations: Of 70 appellate-level breach-of-duty cases reported by Soulier and colleagues, only six favored the plaintiff (23).

Testimonial Privilege

Testimonial privilege refers to the legal right of an individual to “prevent the discovery or introduction in judicial proceedings of confidential relational communications” (24). Historically, Anglo-American common law has only recognized two such privileges—those between spouses and those between attorneys and clients. Although New York State enacted a physician-patient privilege by statute in 1828, and many jurisdictions followed, these protections were riddled with exceptions and were the subject of considerable criticism (25). During the 1960s, a campaign by the Group for the Advancement of Psychiatry called for the creation of a specific psychotherapist-patient privilege (25). Connecticut adopted such a law in 1961, and some form of the privilege is now recognized in every state (25). In the influential case of In re Lifschutz (26), California psychiatrist Joseph Lifschutz refused to turn over his records during a personal injury lawsuit and was briefly jailed. In a losing but well-regarded plea to the California Supreme Court, Lifschutz’s attorney (Sigmund Freud’s great-grandnephew, Nicholas) argued that forced disclosure would undermine his client’s relationships with his other patients, who could no longer be certain of their privacy, and was a violation of the equal protection clause because clergy did not face the same compulsion (16). Lifschutz himself later pointed out another argument for creating the privilege: The alternative was the unpalatable prospect of jailing noncompliant psychiatrists (27). The U.S. Supreme Court created a psychotherapist-patient privilege for the federal courts in Jaffee v. Redmond (12).

At dispute in Jaffee was the admissibility of psychotherapy notes taken by a social worker treating an Illinois police officer, Mary Lu Redmond, who was accused of using excessive and fatal force in breaking up a knife fight. The estate of Ricky Allen (represented by executor Jaffee) sought to admit these notes to impeach Redmond on cross-examination. Writing for a seven-two Supreme Court majority, Justice John Paul Stevens upheld such a privilege:

Stevens distinguished psychotherapy from general medical care, in which physical examination and diagnostic tests can form the basis for treatment. (Although all states recognize a more general physician-patient privilege, such protections are not afforded in the federal courts.) In practice, the courts have interpreted psychotherapy as described in Jaffee to cover all interactions with a psychiatrist necessary for diagnosis or treatment of a patient (28). In other words, the distinction between talk therapy and medication management—while relevant as it pertains to psychotherapy notes under HIPAA—is not relevant to privilege under Jaffee. Both are generally protected. (In contrast, a social worker involved only in placement or logistics, rather than diagnosis or treatment, might not be.) In dissent, Justice Antonin Scalia noted the price of creating such a privilege: the loss of potentially probative evidence at trial that might lead to “occasional injustice” (12).

One key aspect of physician-patient privilege is that it is said to be held by the patient. Although therapists may assert the privilege on the patient’s behalf, they may not do so over a patient’s objections. Critics of this approach (including Lifschutz) have contended that the psychotherapist should be able to assert a therapeutic privilege to protect patients who “do not know what they are waiving” when, for example, revealing the unconscious fantasies exposed by projective tests (25, 29). In some (but not all) jurisdictions, psychotherapist-patient privilege survives the death of the patient (30); a Supreme Court ruling in Swidler & Berlin v. United States (31), finding a posthumous attorney-client privilege, implicitly raises the prospect that a federal psychotherapist-patient privilege may also extend beyond the grave. States vary on whether this privilege applies to group therapy—with some statutes explicitly extending protections and other silent. An Alaska Court of Appeals decision, Beaver v. State (32), held that “communications made by an adjudicated juvenile sex offender, Patrick Beaver, were admissible as evidence even though the statements were made during group therapy at a juvenile correctional facility” (30, 33). One unresolved question regarding the boundaries of privilege relates to the precise definition of psychotherapists. The Supreme Court in Jaffee referred specifically to psychiatrists, psychologists, and social workers doing psychotherapy, but other courts have extended the interpretation of psychotherapist under the Jaffee precedent to include those engaged in marriage counseling and “counseling on problems of alcohol dependency” through an employee assistance program, but not “statements . . . made to volunteer workers at an Alcoholics Anonymous office” (34). Similarly, the scope of psychotherapy itself remains indeterminate. For example, a defendant police officer’s postincident psychiatric debriefing has been found not to qualify (35).

Privacy, HIPAA, and Beyond

Common-law actions for breach of confidentiality were recognized in Britain by the mid-19th century, but American case law has “taken a more circuitous route” (35). Early cases either addressed disclosures that were also defamatory or those justified by significant public policy concerns (36). Not until the 1980s did American courts broadly start to recognize breach of confidentiality and invasion of privacy claims in the physician-patient context (35). A watershed case was that of Humphers v. First Interstate Bank (37), in which the Supreme Court of Oregon upheld a tortious breach of confidentiality claim after a physician provided a patient’s biological daughter (who at birth had a closed adoption to another couple) with information that allowed the daughter to identify her biological mother (35). Several high-profile incidents added public impetus to the development of legal protections. In the case of Jane Doe v. Joan Roe and Peter Poe (38), a former patient of two New York psychotherapists sued after the pair “published a book that contained verbatim and extensive aspects of the patient’s thoughts, feelings, emotions, fantasies, and other biographical and diagnostic information” (16). In ruling for the plaintiff, the New York State Supreme Court rejected the argument that the scientific merits of the material justified publication. In 1991, Diane Wood Middlebrook penned a biography of Pulitzer Prize–winning poet Anne Sexton that relied on the contents of audiotapes recorded by Sexton’s psychiatrist, Dr. Martin Orne. Although Sexton had authorized the posthumous release of the tapes to her daughter, who later passed them along to Middlebrook, a public outcry over this supposed breach of privacy ensued (36). In 1995, the Los Angeles Times revealed the contents of extensive and nearly verbatim notes based on audio recordings that psychiatrist Ralph Greenson recorded of sessions with actress Marilyn Monroe, producing another backlash (39).

Before 1996, the protection of private health care information was largely left to the regulation of individual states. Although every state had “some statutes restricting the use and disclosure of medical information,” rare were those that had “taken a comprehensive approach” (40). Instead, most protections were “either condition specific or entity specific, leaving much information in the health care system uncovered” (41). Most states had specific confidentiality laws that applied to AIDS patients or public health data, but not more general protections. Oklahoma, for example, prevented disclosure by dentists and chiropractors but by not physicians or hospitals (40). One exception was the field of substance abuse treatment: The confidentiality of alcohol and drug abuse patient records has been protected since 1972 by specific federal regulations (42 C.F.R.) implementing sections of the Public Health Act. The enactment of HIPAA largely nationalized the regulation of physician-patient confidentiality and the protection of personal health care information (42). The HIPAA privacy rule was later modified by the Health Information Technology for Economic and Clinical Health Act (43).

The confidentiality sections of HIPAA were largely implemented by the U.S. Department of Health and Human Services under what is known as the Privacy Rule. The rule places significant limitations on the disclose of protected health information (PHI) and individually identifiable health information, which now generally requires patient consent. Under HIPAA, covered entities (which include hospitals and providers) should only request or disclose the minimum amount of PHI necessary to achieve the goals of a disclosure. These entities face both civil and criminal penalties for disclosing protected information in violation of the statute—with fines of up to $250,000 and 10 years in prison per incident. State confidentiality laws may prove stricter than HIPAA—and federal regulations do not preempt additional safeguards. For instance, HIPAA allows release of medical records in response to grand jury subpoenas, but in Turk v. Oiler (41), an Ohio hospital was found liable for doing so because it had breached a more narrowly tailored state statute.

During the course of practice, psychiatrists may receive subpoenas for patient records. They should be careful not to release such records in violation of the HIPAA privacy rule. Subpoenas are not synonymous with court orders. They may be issued by a wide range of attorneys in the legal system, as well as court clerks and certain other government authorities. Unlike a court order, which is generally binding on a provider under HIPAA, those receiving a subpoena should be sure that meaningful efforts are taken to inform the patient-owner of the health care information subject to the subpoena so that they have an opportunity to object; providers may also have an obligation to attempt to seek a qualified protective order (QPO) for the information. This QPO is an order limiting the purposes for which the disclosed PHI can be used—generally keeping it confidential and limiting its use to the legal matter at hand. When receiving a subpoena, a psychiatrist should consult her or his insurer and an attorney for guidance.

The advent of new technologies further complicates the interplay of confidentiality, therapeutics, and public welfare. For example, plugging a patient’s name into an Internet search engine or a publicly accessible database, such as those used by the judicial system, allows third parties with access to both search terms and URLs to trace patients back to specific health care facilities. In theory, breaches can then render such data available to the general public. In an ever more complex world, society—whether through public health agencies, law enforcement entities, or civil litigation—can also be anticipated to make increased demands on providers for information. Even for those psychiatrists acting in good faith, navigating these challenges will likely require sound judgment and considerable guidance from medicolegal experts.