The APA Ethics Office receives frequent calls concerning disclosures of confidential information. While each possible disclosure is unique and must be treated as such, there are nonetheless helpful ways for psychologists to consider more generally whether, and in what manner, confidential information should be released. Ethical Standard 4.05 in our new APA Ethics Code provides a framework for thinking through alternatives when the possibility of disclosing confidential information arises.
(a) Psychologists may disclose confidential information with the appropriate consent of the organizational client, the individual client/patient, or another legally authorized person on behalf of the client/patient unless prohibited by law.
(b) Psychologists disclose confidential information without the consent of the individual only as mandated by law, or where permitted by law for a valid purpose such as to (1) provide needed professional services; (2) obtain appropriate professional consultations; (3) protect the client/patient, psychologist, or others from harm; or (4) obtain payment for services from a client/patient, in which instance disclosure is limited to the minimum that is necessary to achieve the purpose. (See also Standard 6.04e, Fees and Financial Arrangements.)
Imagine that you are sitting in a comfortable room, marked "The Confidential Room," which contains all the confidential information from your practice. A red light begins to blink each time someone wants you to release confidential information, signaling that the possibility of disclosing confidential information is at hand. The catch is that, for you to take information out of the confidential room when the red light blinks, you must do so by walking through one of the room's three doors. Other than these three doors, there is no other way of leaving the room or communicating with anyone outside. Each of the three doors is labeled. The labels are taken from Ethical Standard 4.05.
Client consent is the foundation on which Ethical Standard 4.05 is based. Paragraph (a) addresses disclosures in the context of consent. Paragraph (b), which addresses disclosures in the absence of consent, states that when psychologists do not have client consent they disclose confidential information only when there is a legal mandate or legal permission to do so. Thus, the confidential room's three doors are labeled: Client Consent, Legal Mandate and Legal Permission.
When the red light blinks, the psychologist must decide which of these three doors--the room's only openings--to go through. The psychologist will approach the door and provide a reason why that door should open. If the reason is good enough, the door will open and the psychologist may exit the room with the information. If the reason is not good enough, the door remains closed. Then, the psychologist must find another door to exit or the information remains in the room.
The client consent door
According to Ethical Standard 4.05(a), client consent is one basis on which to disclose confidential information. Disclosing confidential information pursuant to client consent "respect[s] the dignity and worth of all people, and the rights of individuals to...self-determination," by treating the client as autonomous and capable of deciding when and to whom the information will be disclosed (General Principle E, Respect for People's Rights and Dignity). Our Ethics Code does not require that the consent be in writing, but relevant laws, such as HIPAA, may well have such a requirement, depending upon the circumstances. Determining whether the consent is "appropriate," in the language of Standard 4.05(a), may require additional attention when working with clients of compromised capacity who have a guardian, when a third party has requested the services or when services are delivered through organizations. In these situations, the psychologist will identify who the client is and confirm who has the legal authority to consent to the disclosure.
The legal mandate door
According to Ethical Standard 4.05(b), psychologists may disclose confidential information when the law mandates them to do so. Legal mandates to disclose information come in various forms, such as mandatory reporting laws, for which society has determined that some value should take precedence over confidentiality. As an example, child and elderly abuse reporting laws are the result of a legislature having decided that the need to protect children and the elderly, who are often vulnerable and cannot protect themselves, outweighs confidentiality. A court order to release information is another example of a legal mandate that falls under Standard 4.05(b).
The legal permission door
Ethical Standard 4.05(b) also allows a psychologist to disclose confidential information when the law provides permission to do so for a "valid purpose." Standard 4.05 provides examples of a valid purpose: providing services, obtaining consultations, protecting from harm and obtaining payment. The confidentiality laws in many states allow, but do not require, disclosures of confidential information for one or more of these reasons, and HIPAA contains similar permissive provisions for certain circumstances. Before disclosing confidential information in the absence of client consent or a legal mandate, psychologists will determine whether the law permits the release and whether there is a "valid reason" for the disclosure.
Ethical Standard 4.04(a)
Once the psychologist has identified which door allows the disclosure of confidential information and provided a reason for the door to open, the psychologist must then choose what information to take out of the confidential room. In certain cases, this choice will be straightforward, as, for example, when a court order specifies what information is to be disclosed. In other instances, however, Ethical Standard 4.04(a), which is similar to HIPAA's "minimum necessary" rule, may govern. In a nutshell, Ethical Standard 4.04(a) says that psychologists identify what information is necessary to fulfill the need for the disclosure and disclose only that information.
4.04 MINIMIZING INTRUSIONS ON PRIVACY
(a) Psychologists include in written and oral reports and consultations, only information germane to the purpose for which the communication is made.Thus, the psychologist will need to explain why particular information is necessary to disclose. If the psychologist demonstrates the need, the door will open wide enough for the psychologist to take the information out of the room. If the psychologist does not demonstrate the need, the opening will be narrow. The psychologist may carry only information that is indeed germane to the reason for disclosure.
Ethical Standard 4.05 indicates when psychologists disclose confidential information. The standard can also be read as providing a framework for psychologists to think through whether they should disclose confidential information. In the confidential room metaphor, psychologists must choose the consent door, the legal mandate door or the legal permission door: Perhaps a mandatory reporting law requires the disclosure, perhaps the client has consented, perhaps the law permits the disclosure and the psychologist is acting to protect someone's safety. As the psychologist decides what information to disclose, Ethical Standard 4.04 becomes relevant: The door opens only wide enough for the psychologist to take from the room information germane to the purpose for disclosure.
I hope this way of approaching a potential disclosure of confidential information is simple but not simplistic, and is helpful to psychologists as a start in determining whether to release, or withhold, information gained during the course of a professional relationship.
Readers may submit vignettes (without identifying information) for "Ethics Rounds" discussion.