Criterion 12: Collateral information and ROI

Criterion 11 selected the tools that gather information directly from the client. Criterion 12 addresses the information the client cannot or does not provide, obtained from secondary sources with the client's authorization. The work here is procedural and legal: the release-of-information process, the choice of which sources to contact and how, and the handling of what corroboration reveals, including when it contradicts the client on a safety-critical fact. The confidentiality and consent foundation is carried from Criterion 6 rather than re-taught, and the medical hazards that corroboration can surface are cross-referenced to Criteria 1 and 2.

Learning Objectives

By the end of this module, the trainee will be able to:

• Explain why corroborative information from secondary sources is part of a complete and safe assessment, and what specifically it protects against.
• State the core elements and required statements of a valid release of information, and complete one that meets them.
• Distinguish the different legal footings of contacting a covered healthcare provider versus contacting a family member, and apply the right requirement to each.
• State accurately what HIPAA does and does not govern, including the redisclosure reality when a non-covered program receives protected health information.
• Identify the most relevant secondary sources for a given client and select proportionate methods for obtaining information from each.
• Integrate corroborative information with client self-report and standardized assessment, and apply a decision framework when the two conflict.
• Handle a safety-critical discrepancy, such as an omitted seizure or medication history, without breaching the client's trust or autonomy.
• Maintain transparency with the client throughout, so corroboration is collaborative rather than covert.

Key Terms

Release of information (ROI). A signed authorization by which a client permits the program to obtain or share specified information with a specified party for a specified purpose and period. It is the instrument that makes corroboration lawful and ethical.

Corroborative information. Information obtained from a secondary source that confirms, supplements, or contradicts the client's self-report, gathered to make the assessment more accurate and safer.

Secondary or collateral source. A party other than the client who holds relevant information about the client's history, for example a treating physician, psychiatrist, therapist, or family member.

Covered entity. Under HIPAA, a health plan, healthcare clearinghouse, or healthcare provider who transmits health information electronically in connection with certain transactions. Whether a psychedelic program is itself a covered entity depends on what it is and does; many are not.

Protected health information (PHI). Individually identifiable health information held or transmitted by a covered entity or its business associate. HIPAA governs PHI in the hands of covered entities, not all health information everywhere.

HIPAA authorization. A specific written permission, defined at 45 CFR 164.508, that a covered entity must obtain before using or disclosing PHI outside permitted purposes. It has defined core elements and required statements (see Core Teaching).

Redisclosure. The further sharing of information after it has been disclosed. Once PHI is disclosed to a recipient who is not a covered entity, it may no longer be protected by HIPAA, which is the redisclosure reality a program must understand.

Discrepancy. A conflict between the client's self-report and a corroborative source. Discrepancies range from minor to safety-critical, and the safety-critical ones drive a defined response.

Transparency. The practice of conducting corroboration openly, with the client's knowledge and consent, and discussing what was learned, so the process is collaborative rather than covert or coercive.

Core Teaching

Why corroboration belongs in a safe assessment

Self-report is central to assessment, yet it is inherently incomplete. Clients underreport, forget, minimize, or omit, sometimes out of shame, sometimes out of fear of exclusion, and sometimes because they do not connect a past event to the present question. In ordinary care, an incomplete history produces suboptimal treatment. In psychedelic work, it can produce a crisis because the intervention reaches into body and psyche at once, and the omitted fact is often the one that matters. A history of seizures not mentioned, a medication not disclosed, or an episode of psychosis reframed as a bad reaction can each change the safety plan entirely, and none may surface from the client alone. Corroboration from secondary sources is the structured response to the known incompleteness of self-report. It is a safety practice before it is a thoroughness practice, and the facts it most needs to catch are the ones that feed the hazards taught in Criteria 1 and 2.

Corroboration involves ethical concerns that must be carefully managed. Including external voices in a client's assessment risks infringing on their privacy and autonomy, and if done improperly, it can be perceived as surveillance. The solution lies in ensuring consent and transparency: corroboration should only happen with the client's permission, clearly communicated about who will be contacted, the purpose, and the information that will be discussed, not simply recorded. Conducting corroboration without the client's knowledge or approval breaches confidentiality and masquerades as diligent practice.

The release of information, and what makes one valid

The instrument that makes corroboration lawful is the release of information, a signed authorization by which the client permits a specified exchange of specified information with a specified party. Where the source is a HIPAA-covered entity, a physician, a psychiatrist, or a hospital, the authorization that provider needs before disclosing is defined precisely by federal regulation at 45 CFR 164.508, and a facilitator should know its structure because an authorization missing a required element is invalid and any disclosure made on it violates the rule, even if the client signed.

A valid HIPAA authorization contains six core elements: a specific and meaningful description of the information to be disclosed, the name or identification of the person or entity authorized to disclose it, the name or identification of the person or entity to whom it may be disclosed, the purpose of the disclosure, an expiration date or event, and the signature of the client and the date, with a description of authority if a personal representative signs. It also contains three required statements: the client's right to revoke the authorization in writing and how to do so, whether treatment is conditioned on signing, and a redisclosure notice warning that information disclosed may be redisclosed by the recipient and may no longer be protected. The client must receive a copy, the authorization must be in plain language, and it generally may not be combined with other documents. Revocation is available at any time in writing, except as to actions already taken in reliance on the authorization.

Two different flows, two different footings

The single most common error in this area is treating all corroboration as one undifferentiated process governed by one rule. There are two distinct information flows, and their legal footings differ by who is being contacted. When the program asks a covered healthcare provider to release the client's records, the governing requirement is the HIPAA authorization the provider needs in order to disclose, with the elements above. When the program contacts a family member or a significant other, HIPAA is not the governing frame at all, because a family member is not a covered entity disclosing PHI; that contact is governed by the client's consent and by the program's own duty of confidentiality established in Criterion 6. The practical consequence is that a program needs the client's authorization for both, but the form and the legal weight differ, and a facilitator who applies a HIPAA authorization to a conversation with a spouse, or who assumes a casual verbal agreement suffices to obtain a psychiatrist's records, has misjudged the footing. Match the instrument to the source.

What HIPAA does and does not govern

A precise understanding of HIPAA's scope prevents two opposite errors, and a credentialing workbook should state it plainly because the loose version misleads in both directions. HIPAA governs covered entities and their business associates, and it governs protected health information in their hands. It does not govern every holder of health information everywhere. Many psychedelic programs, particularly non-clinical retreats, are not themselves covered entities, which means HIPAA may not govern the program's own handling of the information it collects at all. This cuts two ways. A facilitator should not assume HIPAA gives them authority or obligations it does not, and a facilitator should not assume that receiving records under a HIPAA authorization discharges their confidentiality duty, because once the records land with a non-covered program the redisclosure reality applies: the information may no longer be protected by HIPAA, and the program's obligation to protect it now rests on the client's consent, on state law, and on the professional duty of confidentiality taught in Criterion 6, not on HIPAA. The correct posture is to treat corroborative information as sensitive regardless of whether HIPAA reaches it, and to protect it under the program's own confidentiality framework. Where the specific legal obligations are unclear, this is a question for counsel, consistent with the scope discipline of Criterion 4.

Choosing sources and proportionate methods

Not every collateral source is equally useful, and corroboration is targeted rather than exhaustive. The sources that yield the most safety-relevant information are usually the treating clinicians: a physician for medical conditions and medications, a psychiatrist or therapist for psychiatric history and stability. These are the sources most likely to hold the facts that bear on the hazards of Criteria 1 and 2, and their records are also the most reliable. Family members and significant others hold a different kind of information: the social dynamics, patterns, and history a client may not fully disclose, and they are valuable for exactly the omissions clinicians would not see. The selection principle is proportionality: contact the sources whose information materially affects safety or planning, and do not cast a wider net into a client's private life than the assessment requires. A program that contacts every person in a client's life is not being thorough; it is being intrusive.

Methods should be standardized and proportionate to the source. Records requests to clinicians follow the authorization process above. Structured interviews with family members, using a consistent set of questions focused on safety and support, keep the inquiry fair and on-purpose and reduce the bias that an unstructured conversation invites. Whatever the method, the information gathered is documented and integrated into the assessment record established in Criterion 5, so it is available to the team and traceable to its source.

Integrating corroboration, and the discrepancy framework

Corroborative information earns its place when it is integrated with self-report and standardized assessment rather than filed separately, and the hard case is the discrepancy, when a source contradicts the client. Discrepancies are not all equal, and the response is graded by what is at stake. A minor discrepancy, a date misremembered, a detail softened, is noted and clarified. A material discrepancy on a psychosocial fact, a family member reporting significant binge drinking the client minimized, is addressed directly with the client and integrated into eligibility and planning, because it changes the picture the program is responding to. A safety-critical discrepancy is different in kind: when corroboration reveals a fact that bears directly on the lethal hazards, an omitted seizure history, an undisclosed serotonergic medication, a cardiac condition the client did not mention, the discrepancy is a stop condition. The safety plan is revisited before the work proceeds, the finding is routed to the appropriate medical professional per Criteria 2 and 3, and admission is reconsidered if the new fact changes eligibility. The seizure example is the paradigm: a corroborative source revealing a seizure history the client omitted does not prompt a note in the file; it changes the safety plan entirely, and possibly the decision to proceed.

The discrepancy is handled with the client, not behind them. Discovering a contradiction is not an occasion to confront or accuse; it is an occasion to bring the discrepancy into the open and understand it. A client who minimized their drinking may be ashamed, and a client who omitted a seizure may not have understood its relevance. The facilitator's task is to address the fact for what it means for safety while treating the client as a partner in resolving it, which both preserves the alliance and produces a more accurate account than confrontation would.

Transparency as the throughline

The practice that keeps corroboration ethical from start to finish is transparency. The client knows corroboration is part of the assessment, authorizes each contact, knows who will be reached and why, and is told what was learned. This is continuous with the informed-consent commitments of Criterion 6, and it is what separates corroboration as collaborative care from corroboration as covert investigation. A client who is blindsided by information gathered without their knowledge experiences the program as something that operates on them rather than with them, and that rupture undermines the alliance that Criterion 8 identified as a predictor of outcome. Conducted transparently, corroboration does the opposite: it models the integrity of the program, demonstrates that the client's safety is taken seriously enough to verify, and produces the accurate, holistic picture on which the evaluation of Criterion 15 will be built. This criterion feeds directly into the history-gathering of Criterion 13 and the integrated evaluation that closes Core Function IV.

Clinical and Decision Tools

Tool 1. Valid release of information: required content

The core elements and required statements of a valid HIPAA authorization (45 CFR 164.508). A release missing a core element is invalid, and a disclosure made on it violates the rule even though the client signed. Shaded rows are the elements most often omitted or done vaguely.

Tool 2. Two flows, two footings

Match the instrument to the source. Applying the wrong footing is the most common error in corroboration.

Tool 3. Source selection and method

Select proportionate sources and methods. Contact whoever materially affects safety or planning, no wider. The shaded row holds the sources most likely to carry safety-critical facts (C1, C2).

Tool 4. Discrepancy response framework

Grade the response to a discrepancy by what is at stake. Shaded rows are stop conditions that halt or reconsider the work.

Worked Example: A Corroboration Process, Start to Finish

The following models the reasoning and documentation this criterion should produce. Details are fictional. The point is that each source is chosen for a reason, the right instrument is used for each, and a safety-critical discrepancy is handled as a stop condition, transparently.

Client and context: A 39-year-old client seeking psilocybin work for treatment-resistant depression. Self-report is thorough but the facilitator notes a vague answer about past neurological history and wants to corroborate medical and psychiatric history before proceeding.

Source selection and rationale: Two sources chosen for safety relevance: the client's primary physician, for medical conditions and medications, and the client's current therapist, for psychiatric stability. Family contact is judged unnecessary here, since the safety questions are clinical, so the client's private life is not opened further than the assessment requires.

Instruments matched to sources: For the physician and therapist, both covered providers, valid HIPAA authorizations are completed, each specifying the records sought (medical and medication history; psychiatric history and stability), the source, the program as recipient, the purpose, an expiration tied to the assessment, and the client's signature, with the revocation, conditioning, and redisclosure statements included. The client receives a copy of each.

What corroboration revealed: The physician's records document a history of seizures the client did not mention, controlled on medication. This is a safety-critical discrepancy.

Response as a stop condition: The work does not proceed on the prior plan. The seizure history and its medication are routed to the program's medical professional for evaluation of interaction and risk (Criteria 2 and 3), the safety plan is revisited, and eligibility is reconsidered pending that review. The finding is not filed as a note; it changes the plan.

Transparency with the client: The facilitator discusses the finding openly: 'Your physician's records mention a history of seizures. I am not raising this to catch you out. It matters for your safety with this medicine, and I want to understand it together and make sure we proceed safely.' The client, who had not understood its relevance, is relieved rather than accused, and the account becomes more accurate.

Documentation: The authorizations, the sources contacted, the finding, the referral, and the revised plan are documented in the assessment record (Criterion 5), traceable to their source and protected under the program's confidentiality framework (Criterion 6), since the program is not itself a covered entity and the records are no longer HIPAA-protected in its hands.

Case Vignettes

Work each vignette by identifying the ROI or corroboration error, the principle at stake, and the correct handling. Fillable response sheets are in the companion worksheet PDF.

Vignette A

A facilitator telephones a client's former psychiatrist and asks for the client's history, having obtained only a verbal 'sure, that's fine' from the client that morning. The psychiatrist, correctly, declines to disclose without a valid authorization.

Guided questions: What did the facilitator fail to complete, and why was the psychiatrist right to decline? What are the core elements the authorization needed? How should the facilitator have set up this contact?

Vignette B

A retreat program obtains a client's medical records from a physician under a proper authorization and then stores them in a shared drive accessible to all staff, reasoning that since the records are HIPAA-protected, standard handling is sufficient.

Guided questions: Once the records reach this non-covered program, what is their HIPAA status, and what is the reasoning error? Under what framework must the program actually protect them? How does the redisclosure reality change the storage decision?

Vignette C

During a family interview conducted with consent, a client's spouse reports that the client drinks heavily most evenings, which the client had described as 'a glass of wine now and then.' The facilitator, uncomfortable, files the family report without raising it with the client.

Guided questions: What type of discrepancy is this, and what does filing it without addressing it cost? How should the discrepancy have been handled with the client? Why is addressing it directly better for both safety and the alliance?

Vignette D

Corroboration from a client's cardiologist reveals a significant arrhythmia history relevant to an ibogaine program the client is entering. The facilitator notes it in the file and proceeds with the scheduled admission, planning to 'keep an eye on it.'

Guided questions: What kind of discrepancy is this, and what should it have triggered? Which criteria govern the required response? Why is 'keep an eye on it' an inadequate response to a safety-critical corroborative finding?

Vignette E

A facilitator, wanting to be thorough, contacts a client's employer, estranged sibling, and ex-partner for corroboration, without a clear safety rationale for any of them, having obtained a broad blanket authorization the client signed quickly.

Guided questions: What principle of source selection was violated? Even with a signed authorization, why is this contact a problem? How does proportionality govern who should be contacted, and what should the facilitator have done instead?

Role-Play and Practice Scripts

Practice in pairs, then switch. The aim is to obtain authorization, contact sources, and handle discrepancies in a way that is lawful, proportionate, and transparent.

Introducing corroboration and obtaining authorization

“Part of doing this safely is making sure I have an accurate and complete picture of your history, and some of that is best confirmed with people who have cared for you. With your permission, I would like to reach your physician and your therapist. You decide who I contact and what they share, you can change your mind at any time, and I will tell you what I learn. Let me walk you through the release form so you know exactly what you are authorizing.”

Explaining why a verbal okay is not enough

“I appreciate you saying it is fine for me to talk to your doctor. For your protection and theirs, your doctor needs a signed release before they can share anything, and it has to say specifically what, with whom, and for how long. It is a short form, and it keeps this clean and above board. Let us fill it out together.” Practice treating the form as protection rather than bureaucracy.

Raising a safety-critical discrepancy with the client

“Your physician’s records mention something we did not talk about, a history of seizures. I want to be clear that I am not raising this to catch you in anything. It matters for your safety with this medicine specifically, and I would rather understand it with you than around you. Can you tell me about it?” Practice a tone of partnership, not accusation, on a fact that changes the plan.

Addressing a minimized psychosocial report

“When I spoke with your partner, with your permission, they described your drinking differently than we did. I am not interested in who is right. I am interested in an accurate picture, because it affects how we keep you safe and what support you might need. Can we talk honestly about it?”

Self-Assessment and Reflection

Knowledge check

1. Explain why corroboration is a safety practice and what specifically it protects against in psychedelic work.
2. List the six core elements and three required statements of a valid HIPAA authorization.
3. Distinguish the legal footing of contacting a covered physician from contacting a family member, and what each requires.
4. State accurately what HIPAA governs, and explain the redisclosure reality for a non-covered program.
5. Explain the principle of proportionality in selecting collateral sources.
6. Give the three tiers of the discrepancy framework and the response to each, with a safety-critical example.
7. Explain why a safety-critical discrepancy is a stop condition rather than a note in the file.

Reflection

1. Does your program's release-of-information form actually contain all six core elements and three required statements? Check it against the tool in this module; if any are missing, the form may be invalid.
2. Is your program a HIPAA covered entity? If not, under what framework are you protecting the corroborative information you collect, and is that framework actually in place?
3. Recall a time self-report and reality diverged in your practice. Was there a corroboration process that would have caught it earlier, and what would it have changed?

Summary

Criterion 12 addresses the information the client cannot or does not provide, obtained from secondary sources with authorization. Corroboration is a safety practice before it is a thoroughness practice, because self-report is reliably incomplete and the omitted fact is often the one that feeds the hazards of Criteria 1 and 2. The instrument that makes corroboration lawful is the release of information, and where the source is a covered provider the governing authorization is defined at 45 CFR 164.508, with six core elements and three required statements that a facilitator should know, since an authorization missing an element is invalid. Two flows must be distinguished: contacting a covered provider is a HIPAA-authorization matter, while contacting a family member is governed by the client's consent and the program's own duty of confidentiality. HIPAA governs covered entities and their PHI, not every holder of health information, and once records reach a non-covered program, the redisclosure reality means they may no longer be HIPAA-protected and must be safeguarded under the program's own confidentiality framework from Criterion 6. Sources and methods are chosen proportionately, contacting whoever materially affects safety without opening a client's private life wider than the assessment requires. Corroboration is integrated with self-report, and discrepancies are handled by a graded framework in which a safety-critical discrepancy, an omitted seizure or medication or cardiac history, is a stop condition that halts the work, routes the finding to a medical professional, and reconsiders eligibility. Throughout, the process is transparent and conducted with the client rather than around them, which keeps corroboration collaborative and preserves the alliance. This criterion feeds the history-gathering of Criterion 13 and the integrated evaluation that closes Core Function IV.

References

Uses and disclosures for which an authorization is required, 45 C.F.R. § 164.508. https://www.law.cornell.edu/cfr/text/45/164.508

HIPAA definitions and applicability, 45 C.F.R. §§ 160.102–160.103 and 164.104. https://www.law.cornell.edu/cfr/text/45/160.103

Lee, A., Rosenbaum, D., & Buchman, D. Z. (2024). Informed consent to psychedelic-assisted psychotherapy: Ethical considerations. The Canadian Journal of Psychiatry, 69(5), 309–313. https://doi.org/10.1177/07067437231225937

Jacobs, E. (2023). Transformative experience and informed consent to psychedelic-assisted psychotherapy. Frontiers in Psychology, 14, 1108333. https://doi.org/10.3389/fpsyg.2023.1108333

Tarasoff v. Regents of the University of California, 17 Cal. 3d 425, 551 P.2d 334 (1976). https://scocal.stanford.edu/opinion/tarasoff-v-regents-university-california-30278/