Protecting confidentiality through care

Criterion 45 covers the handling of private information throughout a referral. Clients need to know who can see their information, how it will be used, and what limits apply. The module examines the rules governing the actual program, permission to share, accurate records, group privacy, everyday staff practices, and responses to legal requests or suspected breaches. It also addresses access to records and the devices and services through which information travels.

Learning Objectives

By the end of this module, the trainee will be able to:

• Determine whether HIPAA applies to their program, and explain the covered entity concept.
• Identify what governs confidentiality when HIPAA does not, including state law, professional ethics, contract, and program policy.
• Distinguish confidentiality from evidentiary privilege and identify how each applies to the program's actual relationships and records.
• Explain why a promise of absolute confidentiality is a promise a facilitator cannot keep.
• Create accurate, relevant records while meeting care, accountability, retention, and privacy requirements.
• State the standard limits of confidentiality and disclose them to clients at intake rather than at the moment of breach.
• Explain what can and cannot be promised about confidentiality in a group or retreat setting.
• Respond promptly to a subpoena through the designated legal and privacy process while preserving records and deadlines.
• Build a program culture in which the ordinary breaches, gossip, digital exposure, and testimonials, do not occur.
• Map information flows and apply role appropriate access and current disclosure authority.
• Track transfers, respond to access requests, and document privacy incidents and corrections.

Key Terms

HIPAA. The Health Insurance Portability and Accountability Act of 1996. Its Privacy Rule protects specified health information held by covered entities and business associates in the United States.

Covered entity. A health plan, health care clearinghouse, or health care provider that conducts specified electronic transactions. Business associate obligations may also apply to an organization that handles protected information on behalf of a covered entity. Billing method alone is not a sufficient test of the program's status.

Confidentiality. The duty to protect what a client discloses, arising from ethics, contract, program policy, and in many cases state law. A facilitator can commit to it, and it is not absolute.

Privilege. A legal protection for specified communications in a legal proceeding. Its source, holder, scope, exceptions, and possible waiver depend on the jurisdiction and relationship. Confidentiality duties do not automatically establish privilege.

Limits of legal protection. Circumstances in which information may be accessible or disclosable despite a privacy commitment. These must be established for the program rather than inferred solely from a practitioner's title.

Authorization to share information. The applicable permission or legal basis for a disclosure. A written client authorization is required in some circumstances; other disclosures may be permitted or required by law without one. The program must determine which rule applies before sharing.

Limits of confidentiality. The circumstances in which confidentiality may or must yield, commonly including imminent risk of serious harm to the client or another person, mandated reporting of abuse of a child or vulnerable adult where the facilitator is a mandated reporter, and lawful court orders. These are disclosed at intake.

Minimum necessary. A defined HIPAA standard for certain uses, disclosures, and requests, with exceptions including disclosures for treatment. It should be distinguished from the broader practice of collecting and recording information relevant to care and required accountability.

Core Teaching

Protecting information during care

Clients may disclose health concerns, trauma, substance use, and circumstances affecting their family or work. Explain who can see this information and how it will be used before asking for sensitive details. Privacy can affect what a person feels able to discuss, and a breach can have practical as well as emotional consequences. Establish secure ways to collect, store, discuss, and transfer information across the service. The same care applies to identifying someone as a participant, even when no clinical detail is disclosed.

Determining whether HIPAA applies

HIPAA applies to covered entities and their business associates as defined in the regulations. A professional license alone does not determine coverage, and a cash payment model does not settle it either. Review the organization's activities, electronic transactions, relationships with other entities, and handling of protected information. Obtain appropriate privacy or legal advice and record the determination. Staff should be able to explain the program's actual obligations without using “HIPAA compliant” as an unsupported assurance. Where HIPAA applies, the program must address all relevant requirements rather than relying on a secure software product as proof of compliance (U.S. Department of Health and Human Services, n.d.-c).

Other sources of privacy obligations

State law, professional duties, contractual commitments, and program specific rules may apply alongside or outside HIPAA. Additional federal protections may govern qualifying substance use disorder records under 42 CFR Part 2. Determine applicability from the program's actual activities and funding or other relevant status; a mention of substance use in a record does not by itself make the record subject to Part 2. For work across jurisdictions, examine the rules governing both the service and the information transfer. Maintain a written policy that reflects these obligations, including the responsible person for questions and incidents.

Confidentiality and evidentiary privilege

A duty to keep information confidential and a legal basis for resisting compelled disclosure answer different questions. Privilege can arise from statute or other law and may depend on the relationship, purpose of the communication, and forum. Do not assume that all licensed practitioners hold the same protection or that every unlicensed helper's communication has none. Establish what applies with counsel and explain the limits accurately. A subpoena, court order, client authorization, and statutory reporting duty also have different implications. Staff should route them through the appropriate process without promising that a record can never be disclosed.

Recording relevant information accurately

Create records sufficient for care, required reporting, and accountability. Include clinically relevant exposures, symptoms, decisions, consent, and adverse events. Avoid unnecessary intimate detail, speculative diagnoses, and identifying information about others that has no appropriate purpose. The possibility of legal scrutiny is not a reason to omit an exposure or incident that the record needs to contain. A concise record can still have legal consequences, and no wording can guarantee protection from disclosure or use in a proceeding. Criteria 47 through 49 develop preparation, maintenance, and review of the file.

Explaining limits before disclosure

During consent and intake, explain the routine uses of information, who has access, how sharing is authorized, and the circumstances in which disclosure may be permitted or required. Duties concerning threats, abuse, vulnerable people, or legal process depend on the applicable rules and the practitioner's role. Explain the program's actual process rather than presenting a generic list as universal law. Check understanding and provide a written version the client can revisit. When a limit must be applied, involve the designated professional and explain what will happen to the client when it is safe and legally permitted to do so.

Privacy in groups and retreats

A group agreement should explain expectations concerning stories, names, photographs, recordings, and contact outside the group. Other participants may have duties under an agreement or applicable law, but the program cannot guarantee that everyone will comply. Give clients a private alternative for sensitive material and make disclosure voluntary. Explain how staff will respond to a breach. Consider transport, meal areas, shared accommodation, visitor access, and social media, where participation can become visible even without a formal group disclosure. A person should not have to appear in a photograph or testimonial to maintain access to care.

Legal requests and everyday handling

When a subpoena or other legal demand arrives, preserve relevant records, identify the response deadline, and send it promptly to the designated legal and privacy contacts. Determine validity, scope, applicable protections, and any notice requirements before producing information. Do not ignore the demand, destroy records, or assume that immediate disclosure is required. Day to day protection also depends on staff access, private conversations, verified recipients, locked devices, and secure storage. Train employees and volunteers for the information they may encounter, including transport and administrative staff. Report a suspected breach through the program's process promptly so containment and required notification can begin.

Permission to share and the purpose of sharing

Before routine coordination, establish the applicable authority for the disclosure and explain the plan to the client. Identify the recipient, purpose, information to be shared, and any limits. A signed authorization may be required, but the rules also contain circumstances in which information may or must be disclosed without one. Staff need a procedure that covers both routine referrals and emergencies. They should not delay necessary emergency action while searching for a routine release form.

Keep the client's preferences specific enough to use. Ask whether a voicemail may mention the program, whether a text is safe, and whether a shared email account could expose participation. Explain that withdrawing an authorization generally cannot undo a disclosure already made in reliance on it. Check the actual governing rules and document any revocation or change so staff do not continue using an outdated instruction.

HIPAA's minimum necessary standard concerns specified uses, disclosures, and requests for protected health information. HHS identifies exceptions, including disclosures to or requests by a healthcare provider for treatment. It is not a universal instruction to remove clinically relevant facts from a record. Apply the appropriate disclosure rule, protect access, and keep the information needed for safe care and required documentation (U.S. Department of Health and Human Services, n.d.-b).

Additional rules for substance use disorder records

Determine whether 42 CFR Part 2 applies to the program or records involved. It does not apply merely because someone mentions using a substance. HHS's updated fact sheet describes the rule's coverage and changes with a February 16, 2026 compliance date. Programs subject to it need current forms, notices, procedures, and staff training.

The revised rule permits a single consent for future treatment, payment, and healthcare operations and specified HIPAA redisclosure. It retains additional restrictions on using records in proceedings against a patient. Separately maintained SUD counseling notes require specific consent. These distinctions need review by the program's privacy lead or counsel; a general release template may not address them correctly (U.S. Department of Health and Human Services, 2026).

Devices and services that handle information

List the places client information travels: scheduling, billing, forms, messaging, video calls, transcription, storage, backups, and any system used to summarize notes. Review who can access each service, how accounts are protected, and what the vendor may do with the information. A product's claim that it is secure does not settle whether the program may use it for a particular purpose. Applicable contracts and permissions need to be in place before sensitive information is entered.

Use individual accounts and role appropriate access. Remove access when a person leaves the program and provide coverage through authorized accounts instead of shared passwords. Train staff to check recipients and attachments before sending, lock unattended devices, and protect printed material. Notifications on a shared screen can reveal information even when the underlying file is secured.

Recording and automated transcription require a separate, clear discussion. Explain whether recording is optional, where the material goes, who reviews it, and how long it is retained. Do not make a client discover afterward that an application stored their voice or that their disclosure was entered into a general purpose AI service. A generated summary also needs accuracy review before it becomes part of the record.

Requests for access and suspected breaches

Give clients a usable process for requesting records, seeking corrections, and raising privacy concerns. Follow the rights, timelines, and exceptions that govern the service. A facilitator's discomfort with what a client may read is not, by itself, a reason to withhold access. Where an amendment is disputed, use the applicable process and preserve the history of the record.

When information reaches the wrong person, contain further disclosure promptly, preserve relevant logs, and notify the responsible privacy lead. Assess the event under the applicable breach rules and carry out required notifications. Do not quietly delete the message and assume the issue has ended. Legal requests need their own procedure: preserve records, record deadlines, obtain advice, determine notice requirements and protections, and respond lawfully. Never alter a record because a request has arrived.

Privacy in the ordinary working day

Arrange reception and meeting spaces so sensitive conversations are not easily overheard. Avoid discussing a client in a corridor simply because their name has been omitted. In a small community, a few distinctive details can identify them. Check calendars and group invitations for visible participant names and email addresses before sending them.

At the start of a remote meeting, ask whether the client can speak privately and whether anyone else is present. Staff should make the same check on their side. Agree on what to do if privacy changes during the conversation. A simple phrase or request to switch topics can help a client end a discussion safely when someone enters the room.

Mapping who holds the information

Map the information collected from the first inquiry through the end of care. Identify the forms, messages, assessments, reports, recordings, payment records, and backups the organization creates or receives. Record where each is held, who administers the system, which roles can access it, and which outside organizations receive it. Include volunteers, contractors, interpreters, transport staff, and people who provide technical support when their work gives them access.

Use this map to check the actual privacy notice and service agreements. A client may reasonably believe a form goes only to their facilitator when it is also visible to a booking company or transcription provider. Explain the real arrangement. Resolve unnecessary access and unapproved transfers before collecting further information through the system. Keep staff instructions current when a vendor or workflow changes.

Receiving information safely

Provide an approved route for records from clients and other providers. Confirm identity before attaching a document to the file. Check that the pages belong together, that the sender and date are clear, and that the information reaches the person responsible for review. A confidential document placed in the wrong client's record creates both a privacy problem and a care problem.

Treat unsolicited information carefully. A relative may send allegations or a clinician may transmit more records than requested. Limit access while the responsible practitioner and privacy lead decide how to handle the material under the governing rules. Record its source and status. Do not confirm a person's participation to a caller merely because the caller already seems to know about it.

Authorizations that staff can apply

Where authorization is required, use a form that satisfies the applicable rules and identifies the information, recipient, purpose, and duration or expiration event. Give the client the explanation needed to decide. Check that the authorization is current and covers the proposed disclosure. If the client changes or revokes it, communicate the change to everyone carrying out the referral and record the effective point.

Keep a record of disclosures as required by the governing rules and the program's policy. A practical transfer log can identify what was sent, the recipient, date, authority, and staff member. It helps the program respond when a client asks where information went or when an attachment reached the wrong address. Distinguish this operational log from any legally defined accounting of disclosures, whose scope and exceptions must be checked separately.

Access when a family member or representative asks

A partner, parent of an adult, emergency contact, employer, or person who paid for services does not gain unrestricted access through that relationship alone. Verify the identity and authority of anyone requesting records on another person's behalf. Where a legally authorized representative is involved, determine the extent of that authority and any relevant exceptions with the responsible privacy professional. Keep the client's own preferences and communication safety in view (U.S. Department of Health and Human Services, n.d.-a).

Plan for sensitive contact. Ask whether a voicemail can name the service, whether an email account is shared, and whether a mailed envelope could create a problem. Record a usable instruction, such as a safe number and permitted wording. Recheck it when circumstances change. Emergency disclosures require their own lawful basis and documentation; staff should know whom to contact when an urgent decision is needed.

Testing the protections in use

Review permissions when staff join, change roles, or leave. Use individual accounts, appropriate authentication, locked devices, and approved transfer methods. Test the process for retrieving records after a system failure. Check that printed forms, scanned copies, temporary notes, and backups receive the same attention as the main application. A policy that covers only the electronic chart leaves ordinary sources of exposure unaddressed.

For a suspected breach, preserve the facts, contain further disclosure, and involve the designated privacy lead promptly. Record the affected information, known recipients, time discovered, actions taken, and outstanding questions. Determine notification duties and deadlines under the rules that apply. Include the corrective action in staff review, then check whether it has been implemented. Training can address a recurring error, but a confusing system or excessive access may also need to change.

Clinical and Decision Tools

Tool 1 Does HIPAA apply to you

Ask this before invoking HIPAA. Getting it wrong in either direction causes harm. Determine status with counsel; this is orientation, not legal advice.

Tool 2 Consequences of an incorrect privacy determination

Check the program's obligations before describing them to a client.

Tool 3 Confidentiality and legal protection

Establish the duties and protections that apply to each professional role and type of record.

Explain what the program will do to protect information and which exceptions or legal demands may affect it.

Tool 4 Relevant and accurate records

Document what care and accountability require, and protect access to the resulting record.

Privacy precautions must preserve accurate accounts of exposures, decisions, consent, and adverse events.

Tool 5 Explaining confidentiality at intake

Explain the applicable limits before requesting sensitive information and check what the client understood.

Tool 6 A subpoena arrives

Preserve the record and response deadline while obtaining qualified review of the demand.

Tool 7 Confidentiality checklist

Review staff practices, client explanations, access controls, and the response to legal demands or suspected breaches.

Information transfer record

Worked Example The Confidentiality Conversation Told Honestly

This fictional example applies the practices discussed in this module.

Context: A program has determined, with counsel, that it is not a HIPAA covered entity, that state confidentiality law applies to it, and that its facilitators hold no evidentiary privilege. A new client is at intake, about to disclose a great deal.

Opening the explanation: The facilitator describes the program's actual privacy practices and gives the client time to ask questions before discussing sensitive information.

Describing protection: The facilitator explains which staff may access the record, how information is secured, and the situations in which it may be shared. The client receives the policy in writing.

Naming the limits plainly: serious and imminent risk of harm to herself or someone else; abuse of a child or vulnerable adult, which the program is obliged to report; and a lawful court order, which can compel records the program would never volunteer.

Explaining legal limits: The facilitator describes the determination counsel made for this program and explains that a legal demand would receive appropriate review. They do not promise that a court could never require disclosure.

Group privacy: Staff obligations and participant confidentiality agreements are explained separately. The facilitator makes clear that agreements cannot guarantee every participant's behavior, and the client can choose what to share in the group.

Documentation: The facilitator records information needed for care and applicable requirements, including relevant exposure and safety information. Unnecessary intimate detail is omitted, and access is restricted appropriately.

A later legal request: A subpoena arrives in the client's divorce proceedings. The program preserves the records, notes the response deadline, and obtains legal advice about the request, protections, notice, and response. It does not alter the file or assume that immediate disclosure is required.

Case Vignettes

For each vignette, identify the concern, describe the response, and explain your reasoning. Record your responses on a separate page.

Vignette A

A facilitator tells every client at intake, warmly and sincerely, that everything shared is completely confidential and that what is said in the room stays in the room. He is unlicensed and holds no privilege. A client's records are later subpoenaed in a custody dispute and used against her.

Guided questions: What did the facilitator promise that he could not deliver? Distinguish confidentiality from privilege. What should he have said at intake instead?

Vignette B

A program's leadership believes HIPAA governs it because it handles health information, and tells clients so. It has never determined its covered entity status and does not bill insurance. Meanwhile it has no written policy of its own, assuming HIPAA covers the question.

Guided questions: Determine which privacy rules govern the program and which facts are needed to establish that. Write an accurate explanation for the client.

Vignette C

A facilitator records clinically relevant information alongside long transcripts of intimate disclosures that serve no identified care or reporting purpose. The program has no clear policy for access, retention, or responding to legal requests.

Guided questions: Which information is needed for care and required documentation? Which detail has no identified purpose? How should access, retention, and legal requests be handled without omitting safety information?

Vignette D

A subpoena arrives demanding a client's file. The facilitator, anxious and wanting to comply with the law, photocopies the file and sends it the same day without telling the client or consulting anyone.

Guided questions: What is the difference between a subpoena and an authorization to disclose? What was the correct sequence? Whose decision was it to assert protection, and who made it?

Vignette E

At a retreat, a participant discloses a sexual assault in the sharing circle. A fellow participant later repeats the story at a dinner party. The program had promised participants that everything shared in circle was confidential.

Guided questions: What could the program legitimately promise, and what could it not? What should have been said before anyone disclosed? Whose control over the decision was removed by the false assurance?

Role Play and Practice Scripts

Practice with a partner or team, then exchange roles. Use fictional details and discuss the choices made in each response.

Explaining privacy at intake

Practice explaining the confidentiality rules that actually apply to your role, including reporting obligations, emergency disclosures, records access, and legal requests. Use the program's verified policy. Avoid an absolute promise or a statement that every facilitator has the same reporting duties.

Discussing legal protection

Practice explaining confidentiality and legal privilege as separate questions. State the protection that has been established for this service, its limits, and how a legal request would be reviewed. Avoid promising to resist every request or predicting a court's decision.

The group limit before anyone shares

Practice: “Our staff have confidentiality obligations, and participants agree to respect one another's privacy. We cannot guarantee what another participant will do. You can choose how much to share here and ask for an individual conversation.”

The subpoena and who decides

Practice notifying a client of a records request when notice is permitted or required: identify the request, the review process, relevant deadlines, and the appropriate contact. Do not promise a particular legal outcome.

Additional Practice

A shared phone and an automated transcript

A client receives a message naming the retreat on a phone used by their partner. Staff also learn that an unapproved transcription service retained a session recording.

Practice questions: Identify immediate containment, review, documentation, and notification steps under the applicable rules. Describe what the consent and safe contact process should have established.

Applied Record Exercise

A report attached to the wrong file

An external assessment is placed in the file of a client with a similar name. A summary has already been sent to another provider.

Task: Describe immediate containment, the care decisions needing review, the correction and notification process, and the information required for the privacy lead.

Review: The trainee addresses privacy and care consequences, preserves the history, verifies recipients, and follows the applicable response duties.

Self Assessment and Reflection

Knowledge check

Explain the covered entity concept, and how a program determines whether HIPAA applies to it.

Describe the consequences of assuming HIPAA applies and of assuming there are no privacy duties when it does not.

Name what governs confidentiality when HIPAA does not.

Distinguish confidentiality from privilege and explain why the applicable relationship and jurisdiction require review.

Explain why a promise of absolute confidentiality is a promise most facilitators cannot keep.

Explain how to keep relevant care information while limiting unnecessary detail, and distinguish record content from disclosure rules.

State the standard limits of confidentiality and when they must be disclosed.

Explain what a program can and cannot promise about confidentiality in a group setting.

Describe the steps for reviewing and responding to a subpoena, including preservation, deadlines, protections, and notice.

Reflection

What do you currently tell clients about confidentiality? Is every sentence of it true?

Review a fictional note for relevant care information and unnecessary intimate detail. What should be retained, clarified, or omitted?

Have you determined your covered entity status, or assumed it? Who told you, and were they qualified to?

Observed Practice Assessment

Use the misfiled report exercise together with a request from a relative who paid for the service. Ask the trainee to prepare a response and an incident record.

The trainee checks identity and authority, contains further exposure, preserves an accurate account, and promptly involves the privacy lead. They distinguish routine permission, lawful exceptions, access rights, and the limits of their own judgment. Their proposed disclosure identifies the recipient, purpose, information, authority, method, and applicable review.

Disclosing solely because someone paid, promising absolute confidentiality, destroying evidence, or ignoring the event because the recipient is another client requires immediate correction and reassessment.

The assessor records the scenario, date, work reviewed, observed performance, feedback, and any required practice. Use the ratings demonstrated, needs further practice, or not observed for each task. A verbal answer alone cannot establish performance on a task requiring demonstration. Confirm readiness only for the work assessed and within the trainee’s authorized role.

Summary

Confidentiality depends on the rules and duties that govern the actual service. Establish HIPAA status, other applicable requirements, and any additional protection for substance use disorder records. Explain confidentiality, privilege, reporting duties, group limits, and legal requests accurately. Obtain the authority required for routine sharing while maintaining a workable emergency procedure. Keep relevant care information, limit unnecessary detail, and secure records across devices, vendors, and staff roles. Provide access and amendment procedures, respond properly to suspected breaches, and preserve records when a legal request arrives. No promise should exceed the protection the program can provide.

References

U.S. Department of Health and Human Services. (2026, January 30). Fact sheet: 42 CFR Part 2 final rule. https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html

U.S. Department of Health and Human Services. (n.d.-a). Individuals’ right under HIPAA to access their health information. Retrieved September 18, 2026, from https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html

U.S. Department of Health and Human Services. (n.d.-b). Minimum necessary requirement. Retrieved September 18, 2026, from https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html

U.S. Department of Health and Human Services. (n.d.-c). Summary of the HIPAA Privacy Rule. Retrieved September 18, 2026, from https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html